Blocklist management with PIR

Overview

This playbook automates blocklist label management for threat intelligence objects linked to a Priority Intelligence Requirement (PIR). When a new indicator is created under the targeted PIR, the playbook evaluates its score and applies the appropriate label — adding blocklist or removing it. High-scoring observables that are not yet indicators are automatically promoted. Low-scoring objects are cleaned up by having any previously applied blocklist label removed.

Use case: Threat intelligence teams that maintain a scored, PIR-driven blocklist and want to eliminate manual label triage on incoming indicators and observables.

---

Dependencies

• PIR — A PIR must exist in your platform and be assigned to the relevant indicators
• Labels — blocklist and allowlist labels must exist in your OpenCTI instance before importing the playbook
• Scoring — Indicators and observables must have an OpenCTI score populated, either manually or via a connector
• Ingestion pipeline — Standard OpenCTI ingestion must be active to persist label changes

---

How to use it

1. Create the blocklist and allowlist labels in your instance if they don't already exist
2. If importing via JSON, retrieve both labels' UUIDs from your OpenCTI instance and replace the hardcoded IDs in the playbook file before importing
3. Identify or create the PIR the playbook should listen to, then update the PIR filter accordingly
4. Review the score thresholds (> 70 for indicators, ≥ 70 for observables) and adjust them to match your scoring policy
5. Import the playbook and enable it
6. Verify that the trigger is scoped to create events only and points to the correct PIR

---

Expected outcome

• Newly created indicators with a score > 70 under the PIR receive the blocklist label and lose the allowlist label
• Observables with a score ≥ 70 are promoted to indicators and labeled as blocklist
• Objects below the score threshold automatically have the blocklist label removed
• All label changes are visible in the object's label history and activity log in OpenCTI

---

Additional detail

• Label IDs are instance-specific — the playbook will silently fail or mislabel objects if the UUIDs are not updated in the JSON file before import
• Only creation events are handled — score changes on existing indicators will not re-trigger the playbook unless the trigger configuration is explicitly updated
• Observable promotion applies to all related elements, not just the main object