iboss

Integration version: 9.0

Use Cases

  1. Perform enrichment actions - get data from iboss to enrich data inGoogle Security Operations alerts.
  2. Perform active actions - block an IP or URL in iboss fromGoogle SecOps.

Product Permission

In order to authenticate, actions perform two requests. The first request is toget a token and the second request is to get a special XSRF token.

Configure iboss integration in Google SecOps

For detailed instructions on how to configure an integration inGoogle SecOps, seeConfigureintegrations.

Integration parameters

Use the following parameters to configure the integration:

Note: iboss may change your API root from time to time. Make sure that it isupdated to the latest version.
Parameter Display NameTypeDefault ValueIs MandatoryDescription
Instance NameStringN/ANoName of the Instance you intend to configure integration for.
DescriptionStringN/ANoDescription of the Instance.
Cloud API RootStringhttps://cloud.iboss.com/YesSpecify the iboss cloud API Root.
Account API RootStringhttps://accounts.iboss.com/YesSpecify the iboss Account API Root.
UsernameStringN/AYesSpecify the username of the iboss account.
PasswordPasswordN/AYesSpecify the password of the iboss account.
Verify SSLCheckboxUncheckedNoIf enabled, verify the SSL certificate for the connection to the iboss public cloud server is valid.
Run RemotelyCheckboxCheckedNoCheck the field in order to run the configured integration remotely. Once checked, the option appears to select the remote user (agent).
Note: You can make changes at a later stage if needed. Once configured, theInstances can be used in Playbooks. For detailed information on configuring andsupporting multiple instances, please seeSupporting multiple instances.

Actions

Ping

Description

Test connectivity to the iboss with parameters provided at the integrationconfiguration page in the Google Security Operations Marketplace tab.

Run On

This action doesn't run on entities, nor has mandatory input parameters.

Action Results

Script Result
Script Result NameValue OptionsExample
is_successTrue/Falseis_success:False
Case Wall
Result TypeValue / DescriptionType
Output message*

The action should not fail nor stop a playbook execution:
if successful:
print "Successfully connected to the iboss server with the provided connection parameters!"

The action should fail and stop a playbook execution:
if not successful:

print "Failed to connect to the iboss server! Error is {0}".format(exception.stacktrace)

General

Add URL to Policy Block List

Description

Add URL to iboss Block List.

How to find Category ID

  1. Navigate toWeb Security ->Policy Layers.
  2. OpenDeveloper Tools Console (Ctrl + Shift + I in Google Chrome).
  3. Navigate there toNetwork tab.
  4. Try to edit the needed block list.

In the console, you will see requests that are being made. Search among thoserequests for customCategoryId=xxxx parameter.

Parameters
Parameter Display NameTypeDefault ValueIs MandatoryDescription
Category IDInteger1001YesSpecify to which policy category you want to add the URL.
PriorityInteger50YesSpecify priority of the URL that needs to be blocked.
DirectionDDL

Destination

Possible values:

Destination

Source

Destination and Source

YesSpecify what is the direction of the URL.
Start PortIntegerN/ANoSpecify the start port related to the URL that needs to be blocked. Note: if only "Start Port" or "End Port" is specified, the value will be added to both action parameters.
End PortIntegerN/ANoSpecify the end port related to the URL that needs to be blocked. Note: if only "Start Port" or "End Port" is specified, the value will be added to both action parameters.
NoteStringN/ANoAdd a note related to the URL that needs to be blocked.
Is Regular ExpressionCheckboxUncheckedNoIf enabled, the URL will be considered as a regular expression.
Strip SchemeCheckboxUncheckedNoIf enabled, action will strip the scheme related to the URL.

Run On

This action runs on the following entities:

  • URL
  • Hostname

Action Results

Script Result
Script Result NameValue OptionsExample
is_successTrue/Falseis_success:False
Case Wall
Result TypeValue / DescriptionType
Output message*

The action should not fail nor stop a playbook execution:

if successful and at least one of the provided URLs were blocked(is_success = true):
print "Successfully blocked the following URLs in the iboss category with ID {0}: \n {1}".format(category_id, entity.identifier list)

If fail to block specific URLs(is_success = true):
print "Action was not able to block the following URLs in the iboss category with ID {0}\n: {1}".format(category_id, [entity.identifier])

If fail to enrich for all entities (is_success = false):

print: "No URLs were blocked in the iboss category with ID {0}.".format(category_id)

If Policy is not a Block list: (is_success = false):

print "Category with ID {category_id} is not associated with a Block list."

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other:

print "Error executing action "Add URL to Policy Block List". Reason: {0}''.format(error.Stacktrace)

General

Add IP to Policy Block List

Description

Add IP to iboss Block List.

How to find Category ID

  1. Navigate toWeb Security ->Policy Layers.
  2. OpenDeveloper Tools Console (Ctrl + Shift + I in Google Chrome).
  3. Navigate there toNetwork tab.
  4. Try to edit the needed block list.

In the console, you will see requests that are being made. Search among thoserequests for customCategoryId=xxxx parameter.

Parameters
Parameter Display NameTypeDefault ValueIs MandatoryDescription
Category IDInteger1001YesSpecify to which policy category you want to add the URL.
PriorityInteger50YesSpecify priority of the URL that needs to be blocked.
DirectionDDL

Destination

Possible values:

Destination

Source

Destination and Source

YesSpecify what is the direction of the URL.
Start PortIntegerN/ANoSpecify the start port related to the URL that needs to be blocked. Note: if only "Start Port" or "End Port" is specified, the value will be added to both action parameters.
End PortIntegerN/ANoSpecify the end port related to the URL that needs to be blocked. Note: if only "Start Port" or "End Port" is specified, the value will be added to both action parameters.
NoteStringN/ANoAdd a note related to the URL that needs to be blocked.
Is Regular ExpressionCheckboxFalseNoIf enabled, URL will be considered as a regular expression.

Run On

This action runs on the IP Address entity.

Action Results

Script Result
Script Result NameValue OptionsExample
is_successTrue/Falseis_success:False
Case Wall
Result TypeValue / DescriptionType
Output message*

The action should not fail nor stop a playbook execution:

if successful and at least one of the provided URLs were blocked(is_success = true):
print "Successfully blocked the following URLs in the iboss category with ID {0}: \n {1}".format(category_id, entity.identifier list)

If fail to block specific URLs(is_success = true):
print "Action was not able to block the following URLs in the iboss category with ID {0}\n: {1}".format(category_id, [entity.identifier])

If fail to enrich for all entities (is_success = false):

print: "No URLs were blocked in the iboss category with ID {0}.".format(category_id)

If Policy is not a Block list: (is_success = false):

print "Category with ID {category_id} is not associated with a Block list."

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other:

print "Error executing action "Add URL to Policy Block List". Reason: {0}''.format(error.Stacktrace)

General

Add IP to Policy Block List

Description

Add IP to iboss Block List.

How to find Category ID

  1. Navigate toWeb Security ->Policy Layers.
  2. OpenDeveloper Tools Console (Ctrl + Shift + I in Google Chrome).
  3. Navigate there toNetwork tab.
  4. Try to edit the needed block list.

In the console, you will see requests that are being made. Search among thoserequests for customCategoryId=xxxx parameter.

Parameters
Parameter Display NameTypeDefault ValueIs MandatoryDescription
Category IDInteger1001YesSpecify to which policy category you want to add the IP.
PriorityInteger50YesSpecify priority of the IP that needs to be blocked.
DirectionDDL

Destination

Possible values:

Destination

Source

Destination and Source

YesSpecify what is the direction of the IP.
Start PortIntegerN/ANoSpecify the start port related to the IP that needs to be blocked. Note: if only "Start Port" or "End Port" is specified, the value will be added to both action parameters.
End PortIntegerN/ANoSpecify the end port related to the IP that needs to be blocked. Note: if only "Start Port" or "End Port" is specified, the value will be added to both action parameters.
NoteStringN/ANoAdd a note related to the IP that needs to be blocked.
Is Regular ExpressionCheckboxUncheckedNoIf enabled, IP will be considered as a regular expression.

Run On

This action runs on the IP Address entity.

Action Results

Script Result
Script Result NameValue OptionsExample
is_successTrue/Falseis_success:False
Case Wall
Result TypeValue / DescriptionType
Output message*

The action should not fail nor stop a playbook execution:

if successful and at least one of the provided IPs were blocked(is_success = true):
print "Successfully blocked the following IPs in the iboss category with ID {0}: \n {1}".format(category_id, entity.identifier list)

If fail to block specific IPs(is_success = true):
print "Action was not able to block the following IPs in the iboss category with ID {0}\n: {1}".format(category_id, [entity.identifier])

If fail to enrich for all entities (is_success = false):

print: "No IPs were blocked in the iboss category with ID {0}.".format(category_id)

If Policy is not a Block list: (is_success = false):

print "Category with ID {category_id} is not associated with a Block list."

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other:

print "Error executing action "Add IP to Policy Block List". Reason: {0}''.format(error.Stacktrace)

General

List Policy Block List Entries

Description

Return iboss Block List entries in a specific group.

How to find Category ID

  1. Navigate toWeb Security ->Policy Layers.
  2. OpenDeveloper Tools Console (Ctrl + Shift + I in Google Chrome).
  3. Navigate there toNetwork tab.
  4. Try to edit the needed block list.

In the console, you will see requests that are being made. Search among thoserequests for customCategoryId=xxxx parameter.

Parameters
Parameter Display NameTypeDefault ValueIs MandatoryDescription
Category IDInteger1001YesSpecify in which policy category do you want to list Block List entries.
Max Entries to ReturnInteger50YesSpecify how many entries to return.

Run On

This action doesn't run on entities.

Action Results

Script Result
Script Result NameValue OptionsExample
is_successTrue/Falseis_success:False
JSON Result
{"entries":[{"direction":0,"endPort":0,"isRegex":0,"note":"","priority":0,"startPort":0,"type":0,"url":"asaa.com","weight":501}],"message":""}
Case Wall
Result TypeValue / DescriptionType
Output message*

The action should not fail nor stop a playbook execution:

if successful returned and is available data(is_success = true):
print "Successfully listed entries from the iboss Block List in a category with ID '{0}'".format(category_id)

If returned and no data (is_success = false):

print: "No Block List entries were found in the iboss category with ID {0}.".format(category_id)

If Policy is not a Block list: (is_success = false)

Print "Category with ID {category_id} is not associated with a Block list."

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other:

print "Error executing action "List Policy Block List Entries". Reason: {0}''.format(error.Stacktrace)

General
CSV Case Wall

Name: "Block List Entries. Category {0}".format(Category)

Columns:

  • Name (mapped as url)
  • Priority (mapped as priority)
  • Weight (mapped as weight)
  • Direction (mapped as direction. Check action behaviour)
  • Start Port (mapped as startPort)
  • End Port (mapped as endPort)
  • Note (mapped as note)
  • Regex (mapped as isRegex. 1 = True, 0 = False)

Remove URL from Policy Block List

Description

Remove URL from iboss Block List.

How to find Category ID

  1. Navigate toWeb Security ->Policy Layers.
  2. OpenDeveloper Tools Console (Ctrl + Shift + I in Google Chrome).
  3. Navigate there toNetwork tab.
  4. Try to edit the needed block list.

In the console, you will see requests that are being made. Search among thoserequests for customCategoryId=xxxx parameter.

Parameters
Parameter Display NameTypeDefault ValueIs MandatoryDescription
Category IDInteger1001YesSpecify from which policy category do you want to remove the URL.
Start PortIntegerN/ANoSpecify the start port related to the URL that needs to be deleted. This parameter is mandatory if the desired URL has a defined start port. This is an iboss limitation.
End PortIntegerN/ANoSpecify end port related to the URL that needs to be deleted. This parameter is mandatory if the desired URL has a defined end port. This is an iboss limitation.
Strip SchemeCheckboxUn-checkedNoIf enabled, action will strip the scheme related to the URL.

Run On

This action runs on the following entities:

  • URL
  • Hostname

Action Results

Script Result
Script Result NameValue OptionsExample
is_successTrue/Falseis_success:False
Case Wall
Result TypeValue / DescriptionType
Output message*

The action should not fail nor stop a playbook execution:

if successful and at least one of the provided URLs were removed (is_success = true):
print "Successfully removed the following URLs from the iboss category with ID {0}: \n {1}".format(category_id, entity.identifier list)

If fail to remove specific URLs(is_success = true):

print "Action was not able to remove the following URLs from the category with ID {0}\n: {1}".format(category_id, [entity.identifier])

If fail to enrich for all entities (is_success = false):

Print: "No URLs were removed from the iboss category with ID {0}.".format(category_id)

If Policy is not a Block list: (is_success = false):

Print "Category with ID {category_id} is not associated with a Block list."

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other:

print "Error executing action "Remove URL from Policy Block List". Reason: {0}''.format(error.Stacktrace)

General

Remove IP from Policy Block List

Description

Remove IP from iboss Block List.

How to find Category ID

  1. Navigate toWeb Security ->Policy Layers.
  2. OpenDeveloper Tools Console (Ctrl + Shift + I in Google Chrome).
  3. Navigate there toNetwork tab.
  4. Try to edit the needed block list.

In the console, you will see requests that are being made. Search among thoserequests for customCategoryId=xxxx parameter.

Parameters
Parameter Display NameTypeDefault ValueIs MandatoryDescription
Category IDInteger1001YesSpecify from which policy category do you want to remove IP.
Start PortIntegerN/ANoSpecify start port related to the IP that needs to be deleted. This parameter is mandatory if the desired URL has a defined start port. This is an iboss limitation.
End PortIntegerN/ANoSpecify end port related to the IP that needs to be deleted. This parameter is mandatory if the desired IP has a defined end port. This is an iboss limitation.

Run On

This action runs on the IP Address entity.

Action Results

Script Result
Script Result NameValue OptionsExample
is_successTrue/Falseis_success:False
Case Wall
Result TypeValue / DescriptionType
Output message*

The action should not fail nor stop a playbook execution:

if successful and at least one of the provided URLs was removed (is_success = true):
print "Successfully removed the following IPs from the iboss category with ID {0}: \n {1}".format(category_id, entity.identifier list)

If fail to remove specific URLs(is_success = true):

print "Action was not able to remove the following IPs from the iboss category with ID {0}\n: {1}".format(category_id, [entity.identifier])

If fail to enrich for all entities (is_success = false):

print: "No IPs were removed from the iboss category with ID {0}.".format(category_id)

If Policy is not a Block list: (is_success = false)

Print "Category with ID {category_id} is not associated with a Block list."

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to the server, other:

print "Error executing action "Remove IP from Policy Block List". Reason: {0}''.format(error.Stacktrace)

General

URL Lookup

Description

Perform URL Lookup.

Parameters

Parameter Display NameTypeDefault ValueIs MandatoryDescription
Group IDIntegerN/ANoSpecify for which group to perform a URL Lookup. If nothing is specified, the "Default" group will be used.

Run On

This action runs on the following entities:

  • URL
  • Hostname

Action Results

Entity Enrichment
Enrichment Field NameSource (JSON Key)Logic - When to apply
IBOSS_group_{group_id}_categoriescategoriesWhen available in JSON
IBOSS_group_{group_id}_actionactionWhen available in JSON
IBOSS_group_{group_id}_messagemessageWhen available in JSON
Script Result
Script Result NameValue OptionsExample
is_successTrue/Falseis_success:False
JSON Result
{"action":"Not Blocked","categories":"Pornography/Nudity","message":"Url Known."}
Case Wall
Result TypeValue / DescriptionType
Output message*

The action should not fail nor stop a playbook execution:

If successful and at least one of the provided URLs was looked up (is_success = true):
print "Successfully retrieved information about the following URLs: \n {0}".format( entity.identifier list)

If fail to lookup specific URLs(is_success = true):

Print: "Action was not able to retrieve information about the following URLs\n: {0}".format([entity.identifier])

If fail to lookup for all entities (is_success = false):

Print "No information was retrieved about URLs."

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to the server, other:

print "Error executing action "URL Lookup". Reason: {0}''.format(error.Stacktrace)

General

URL Recategorization

Description

Submit URL for recategorization.

Run On

This action runs on the URL entity.

Action Results

Script Result
Script Result NameValue OptionsExample
is_successTrue/Falseis_success:False
Case Wall
Result TypeValue / DescriptionType
Output message*

The action should not fail nor stop a playbook execution:

if successful and at least one of the provided URLs was submitted(is_success = true):
print "Successfully submitted the following URLs for recategorization: \n {0}".format( entity.identifier list)

If fail to remove specific URLs(is_success = true):

print "Action was not able to submit the following URLs for recategorization\n: {0}".format([entity.identifier])

If fail to enrich for all entities (is_success = false):

print: "No URLs were submitted for recategorization."

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other:

print "Error executing action "URL Recategorization". Reason: {0}''.format(error.Stacktrace)

General

Need more help?Get answers from Community members and Google SecOps professionals.

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-19 UTC.