This is a ThreatConnect playbook that gets run every time a new URL is created. It checks to see if that URL has already been archived in the Wayback Machine and sends a slack message whether or not the given URL has ever been archived before.
This playbook now has a user action trigger so that it can be run from the page for any url or host indicator:
