This workflow consumes one or more IP addresses and attempts to block them in all supported products. Currently supported products include: Cisco Secure Access (IPv4), Cisco Umbrella (IPv4), Cisco XDR (intelligence feeds).

Cisco XDR intelligence feeds can be used by other products, such as firewalls, to fetch lists of observables from XDR for use in policies.

Targets: Automation APIs, Private Intelligence API, Cisco Secure Access, Umbrella

Steps:
- Check how the workflow was started (if not a playbook task, end the workflow)
- Get a list of targets and extract the supported integrations
- Check if there are supported integrations (if not, end the workflow)
- For each integration:
  - Complete setup as needed depending on the integration
- For each IP address:
  - For each integration:
    - Attempt to block the IP address in the given integration
  - Check if the IP address was blocked in at least one product (if not, update the workflow results)

XDR - Contain Incident: IP Addresses