# cp_mgmt_threat_indicator – Manages threat-indicator objects on Check Point over Web Services API

New in version 2.9.

- Synopsis

- Parameters

- Examples

- Return Values

- Status

## Synopsis

- Manages threat-indicator objects on Check Point devices including creating, updating and removing objects.

- All operations are performed over Web Services API.

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---

action
string

Choices:
- Inactive
- Ask
- Prevent
- Detect

The indicator's action.

auto_publish_session
boolean

Choices:
- no
- yes

Publish the current session if changes have been performed after task completes.

color
string

Choices:
- aquamarine
- black
- blue
- crete blue
- burlywood
- cyan
- dark green
- khaki
- orchid
- dark orange
- dark sea green
- pink
- turquoise
- dark blue
- firebrick
- brown
- forest green
- gold
- dark gold
- gray
- dark gray
- light green
- lemon chiffon
- coral
- sea green
- sky blue
- magenta
- purple
- slate blue
- violet red
- navy blue
- olive
- orange
- red
- sienna
- yellow

Color of the object. Should be one of existing colors.

comments string |  | Comments string.

details_level
string

Choices:
- uid
- standard
- full

The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed representation of the object.

ignore_errors
boolean

Choices:
- no
- yes

Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.

ignore_warnings
boolean

Choices:
- no
- yes

Apply changes ignoring warnings.

name string / required |  | Object name.
observables list |  | The indicator's observables.
| comments string |  | Comments string.

confidence
string

Choices:
- low
- medium
- high
- critical

The confidence level the indicator has that a real threat has been uncovered.

| domain string |  | The name of a domain.

ignore_errors
boolean

Choices:
- no
- yes

Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.

ignore_warnings
boolean

Choices:
- no
- yes

Apply changes ignoring warnings.

| ip_address string |  | A valid IP-Address.
| ip_address_first string |  | A valid IP-Address, the beginning of the range. If you configure this parameter with a value, you must also configure the value of the 'ip-address-last' parameter.
| ip_address_last string |  | A valid IP-Address, the end of the range. If you configure this parameter with a value, you must also configure the value of the 'ip-address-first' parameter.
| mail_cc string |  | A valid E-Mail address, cc field.
| mail_from string |  | A valid E-Mail address, sender field.
| mail_reply_to string |  | A valid E-Mail address, reply-to field.
| mail_subject string |  | Subject of E-Mail.
| mail_to string |  | A valid E-Mail address, recipient filed.
| md5 string |  | A valid MD5 sequence.
| name string |  | Object name. Should be unique in the domain.

product
string

Choices:
- AV
- AB

The software blade that processes the observable, AV - AntiVirus, AB - AntiBot.

severity
string

Choices:
- low
- medium
- high
- critical

The severity level of the threat.

| url string |  | A valid URL.
observables_raw_data string |  | The contents of a file containing the indicator's observables.
profile_overrides list |  | Profiles in which to override the indicator's default action.

action
string

Choices:
- Inactive
- Ask
- Prevent
- Detect

The indicator's action in this profile.

| profile string |  | The profile in which to override the indicator's action.

state
string

Choices:
- present ←
- absent

State of the access rule (present or absent). Defaults to present.

tags list |  | Collection of tag identifiers.
version string |  | Version of checkpoint. If not given one, the latest version taken.

wait_for_task
boolean

Choices:
- no
- yes ←

Wait for the task to end. Such as publish task.

## Examples

    - name: add-threat-indicator
      cp_mgmt_threat_indicator:
        action: ask
        ignore_warnings: true
        name: My_Indicator
        observables:
        - confidence: medium
          mail_to: someone@somewhere.com
          name: My_Observable
          product: AV
          severity: low
        profile_overrides:
        - action: detect
          profile: My_Profile
        state: present

    - name: set-threat-indicator
      cp_mgmt_threat_indicator:
        action: prevent
        ignore_warnings: true
        name: My_Indicator
        state: present

    - name: delete-threat-indicator
      cp_mgmt_threat_indicator:
        name: My_Indicator
        state: absent

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
cp_mgmt_threat_indicator dictionary | always, except when deleting the object. | The checkpoint object created or updated.

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]

- This module is maintained by the Ansible Community. [community]

### Authors

- Or Soffer (@chkp-orso)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.