Documentation for the Phantom app: Ansible Tower

1. Copyright © 2016 World Wide Technology, Inc. All rights reserved.
Phantom app: Ansible Tower
18 August 2016
Building And Automating The Next Generation Network
Joel W. King Engineering and Innovations
Network Solutions

2. Abstract
Ansible Tower by RedHat provides a visual dashboard (GUI) with role-based
access control and inventory management of the open source Ansible
orchestration and automation software. Tower provides an API which can be
used to launch job templates, while passing extra variables into the template in
the body of the REST POST.
The Phantom app for Ansible Tower is a force multiplier for Phantom, providing
a means to consume Ansible modules and playbooks without writing the
module functionality as an app in Phantom.
FOR YOUR REFERENCE

3. Phantom app

4. Solution Architecture
Remote Triggered Black Hole
PHANTOM
2.0.67
ANSIBLE
TOWER
3.0
ansible-tower.sandbox.wwtatc.local
phantom.sandbox.wwtatc.local
github.wwt.com
router bgp 65536
……
ISR-2911-D.sandbox.wwtatc.local

5. Phantom Playbook

6. Job Template ID
Job template name or id number can be specified

7. Ansible Playbook
"ip route {{malicious_ip}} 255.255.255.255 Null0 tag 66 name BGP_RTBH"

8. Ansible Job Template
Select
Prompt on
Launch

9. Ansible Job
extra vars
provided
from
Phantom
when job is
launched

10. Router Configuration
after playbook has executed
[phantom@localhost ansible_tower]$ ssh admin@isr-2911-d.sandbox.wwtatc.local
Password:
UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS PROHIBITED.
You must have explicit permission to access or configure this
device. All activities performed on this device are logged and
violations of this policy may result in disciplinary action.
WAN Edge (Outside) router
ISR-2911-D>en
Password:
ISR-2911-D#show run | inc RTBH
ip route 192.0.2.1 255.255.255.255 Null0 tag 66 name BGP_RTBH
ip route 198.200.139.176 255.255.255.255 Null0 tag 66 name BGP_RTBH

11. Solution Architecture
Incorporating ACI app
PHANTOM
2.0.67
ANSIBLE
TOWER
3.0
github.wwt.com
router bgp 65536
……
dbgacEpgToIp.yml
apply atomic counter configuration
atomic_counters.py
PhantomIngest.py
Create Incident in Phantom based on atomic counters exceeding threshold

12. Multiple variables can be passed to job template

13. Key Take-aways
 Launching job templates from Phantom provides access to existing
Ansible modules and playbooks.
 Phantom F5 app used Python module written for Ansible.
 Ideally, Remotely triggered black hole (RTBH) should be native
Phantom app
 Challenge, BGP speaking routers encompass wide range of vendors
and operating systems.

14. References
 Ansible Tower
www.ansible.com/tower
 Ansible Tower API Guide v3.0
docs.ansible.com/ansible-tower/latest/html/towerapi/
 Source Code
github.com/joelwking/Phantom-Cyber/tree/master/ansible_tower