diff --git a/playbooks/hunting.json b/playbooks/hunting.json new file mode 100644 index 0000000000..499206cba8 --- /dev/null +++ b/playbooks/hunting.json @@ -0,0 +1,5505 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Onboarding", + "coa": { + "data": { + "clean": true, + "code_block": "\"\"\"\nThe hunting Playbook queries a number of internal security technologies in order to determine if any of the artifacts present in your data source have been observed in your environment.\n\"\"\"\n\ndef get_specific_assets(action, include_products=None):\n \n supported_assets = phantom.get_assets(action=action)\n # phantom.debug(\"Action Supported Assets\")\n # phantom.debug(supported_assets)\n \n if not supported_assets:\n # no supported products configured\n return []\n \n if not include_products:\n # no product filters, so return whatever we found\n return [x['name'] for x in supported_assets]\n \n if include_products:\n \n if (type(include_products) != list):\n phantom.debug(\"Please specify a list for filter_products\")\n return []\n \n # make the product names sent to this funcion lower\n include_products = [x.lower() for x in include_products]\n \n # get products that are configured and asked for\n assets_matched = [x['name'] for x in supported_assets if x['product_name'].lower() in include_products]\n # phantom.debug(\"Action Supported Matches\")\n # phantom.debug(assets_matched)\n return assets_matched\n \n # should not reach here\n return []", + "description": "Hunt for internal sightings of malicious files or connections to malicious domains or IP addresses.", + "joint": { + "cells": [ + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "370dd52c-9988-4e95-bfa0-7326d1710717", + "router": { + "name": "metro" + }, + "source": { + "id": "316c9705-7ae6-421d-8e39-09ed4d5eaf72", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "2c95ee18-c36d-40b4-9a1d-889badec9d4f", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 4 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "c3529b6a-3e65-4955-ba02-34c06302327a", + "router": { + "name": "metro" + }, + "source": { + "id": "2c95ee18-c36d-40b4-9a1d-889badec9d4f", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "8656f57d-779a-4133-a244-5191a6714a83", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 29 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "6d247fbe-3ded-4151-ad4a-93302a55e32b", + "router": { + "name": "metro" + }, + "source": { + "id": "316c9705-7ae6-421d-8e39-09ed4d5eaf72", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "ed123d2f-999b-4cdc-b141-a48f7da89227", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 69 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "1b0673da-2779-464c-a51c-2563217414a2", + "router": { + "name": "metro" + }, + "source": { + "id": "8656f57d-779a-4133-a244-5191a6714a83", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "666fe7a3-1c31-4238-ba36-ea3cfd8d2884", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 177 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "5191bf3b-fdaa-4f48-ac52-4e7419e69664", + "router": { + "name": "metro" + }, + "source": { + "id": "666fe7a3-1c31-4238-ba36-ea3cfd8d2884", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "65cec994-6cd3-47da-849a-f015982d8a23", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "vertices": [ + { + "x": 1600, + "y": 80 + } + ], + "z": 202 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "f6873242-210c-4a03-9461-9a251503c199", + "router": { + "name": "metro" + }, + "source": { + "id": "5578c85f-4a27-401e-be14-7793e82b92c5", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7ca41dcf-c8bd-46f4-bb7d-6df6d254c01f", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 609 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "6011a55b-8289-4934-9db9-70b4416ebd1f", + "router": { + "name": "metro" + }, + "source": { + "id": "7ca41dcf-c8bd-46f4-bb7d-6df6d254c01f", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "9052a241-042b-4189-b56d-fcc0bf461cc6", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 616 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "e75dcbfb-0575-442a-a3ec-468a815144a2", + "router": { + "name": "metro" + }, + "source": { + "id": "9052a241-042b-4189-b56d-fcc0bf461cc6", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "93d4e099-5891-4c2b-b6db-ac512e981f06", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 686 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "282072cb-d450-40c0-b142-6727d131f38a", + "router": { + "name": "metro" + }, + "source": { + "id": "93d4e099-5891-4c2b-b6db-ac512e981f06", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "e07929c3-d5ce-44c1-b08d-3b4fede3bc59", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 713 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "8346a4a6-4ca6-429c-a9ed-df734d719534", + "router": { + "name": "metro" + }, + "source": { + "id": "316c9705-7ae6-421d-8e39-09ed4d5eaf72", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "8c6c1d82-e40b-4f58-b6c0-cc8c40791cae", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 864 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "028d5235-a996-48e5-9f5e-05042bf25230", + "router": { + "name": "metro" + }, + "source": { + "id": "ed123d2f-999b-4cdc-b141-a48f7da89227", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "c79812bd-7079-4317-a492-d36f2de1ac83", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 918 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "e397dbe7-376c-4760-bdd8-a4cbf8ff7cc0", + "router": { + "name": "metro" + }, + "source": { + "id": "c79812bd-7079-4317-a492-d36f2de1ac83", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "5578c85f-4a27-401e-be14-7793e82b92c5", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1009 + }, + { + "0": "S", + "1": "T", + "2": "A", + "3": "R", + "4": "T", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "ref-x": 33, + "ref-y": 8, + "text": "START" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "ref-x": 13, + "xlink:href": "/inc/coa/img/block_icon_start.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'hunt_domain_1' block\n hunt_domain_1(container=container)\n\n # call 'hunt_file_1' block\n hunt_file_1(container=container)\n\n # call 'run_query_1' block\n run_query_1(container=container)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "316c9705-7ae6-421d-8e39-09ed4d5eaf72", + "inPorts": [], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 64, + "line_start": 50, + "name": "", + "notes": "", + "number": 0, + "order": 1, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 120, + "y": 60 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "START", + "type": "coa.StartEnd", + "warn": false, + "z": 1197 + }, + { + "0": "E", + "1": "N", + "2": "D", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".title": { + "text": "END" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_end.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "get system info, detonate file, run query", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "65cec994-6cd3-47da-849a-f015982d8a23", + "inPorts": [ + "in" + ], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 373, + "line_start": 360, + "name": "", + "notes": "", + "number": 0, + "order": 13, + "outPorts": [], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1660, + "y": 340 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "END", + "type": "coa.StartEnd", + "warn": false, + "z": 1273 + }, + { + "action": "get system info", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "ip_hostname": "filtered-artifact:*.cef.sourceAddress" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "ip_hostname": "filtered-artifact:*.cef.sourceAddress", + "sensor_id": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.parameter.sensor_id", + "data_type": "numeric" + }, + { + "contains": [ + "host name", + "ip" + ], + "data_path": "action_result.parameter.ip_hostname", + "data_type": "string" + }, + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.systemvolume_total_size", + "data_type": "string" + }, + { + "column_name": "OS", + "column_order": 4, + "data_path": "action_result.data.*.os_environment_display_string", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.systemvolume_free_size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.physical_memory_size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.shard_id", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.clock_delta", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.supports_cblr", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.sensor_uptime", + "data_type": "string" + }, + { + "column_name": "Is Isolated?", + "column_order": 2, + "data_path": "action_result.data.*.is_isolating", + "data_type": "boolean" + }, + { + "column_name": "Sensor ID", + "column_order": 5, + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.id", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.build_id", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.uptime", + "data_type": "string" + }, + { + "column_name": "DNS Name", + "column_order": 3, + "data_path": "action_result.data.*.computer_dns_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.last_update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.power_state", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.next_checkin_time", + "data_type": "string" + }, + { + "column_name": "Status", + "column_order": 2, + "data_path": "action_result.data.*.status", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.num_eventlog_bytes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sensor_health_status", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.sensor_health_message", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.build_version_string", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.computer_sid", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.node_id", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.cookie", + "data_type": "numeric" + }, + { + "column_name": "Name", + "column_order": 0, + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.computer_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.license_expiration", + "data_type": "string" + }, + { + "column_name": "Supports Isolation?", + "column_order": 4, + "data_path": "action_result.data.*.supports_isolation", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.parity_host_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.supports_2nd_gen_modloads", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.network_adapters", + "data_type": "string" + }, + { + "column_name": "IP Addresses", + "column_order": 1, + "data_path": "action_result.data.*.ips", + "data_type": "string" + }, + { + "column_name": "Isolation Enabled?", + "column_order": 3, + "data_path": "action_result.data.*.network_isolation_enabled", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.registration_time", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.restart_queued", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.num_storefiles_bytes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.os_environment_id", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.boot_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.last_checkin_time", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.group_id", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.display", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.uninstall", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.event_log_flush_time", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.emet_telemetry_path", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.emet_version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.emet_report_setting", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.emet_exploit_action", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.emet_is_gpo", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.emet_dump_flags", + "data_type": "string" + }, + { + "data_path": "action_result.summary.total_endpoints", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "get system info" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "stroke": "#5094D4" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#5094D4" + }, + "text.icon": { + "fill": "#5094D4" + } + }, + "block_code": "# read-only block view not available", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": false, + "connection_name": "hunt domain", + "connection_type": "action", + "custom_callback": "", + "custom_code": "def get_system_info_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n assets = get_specific_assets(\"get system info\", [\"Carbon Black\"])\n \n if (not assets):\n phantom.debug(\"Carbon Black::get system info not found returning.\")\n \n # collect data for 'get_system_info_1' call\n filtered_container_data = phantom.collect2(container=container, datapath=['filtered-artifact:*.cef.sourceAddress', 'filtered-artifact:*.id'], filter_artifacts=filtered_artifacts)\n\n parameters = []\n \n # build parameters list for 'get_system_info_1' call\n for filtered_container_item in filtered_container_data:\n if filtered_container_item[0]:\n parameters.append({\n 'ip_hostname': filtered_container_item[0],\n })\n\n if parameters:\n phantom.act(\"get system info\", parameters=parameters, assets=assets, name=\"get_system_info_1\") \n else:\n phantom.error(\"'get_system_info_1' will not be executed due to lack of parameters\")\n \n return", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": true, + "has_custom_block": true, + "has_custom_callback": false, + "has_custom_join": false, + "id": "666fe7a3-1c31-4238-ba36-ea3cfd8d2884", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 110, + "line_start": 84, + "message": "Configuring now", + "name": "get system info", + "notes": "", + "number": 1, + "order": 3, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 640, + "y": 40 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "get_system_info_1", + "required_params": {}, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 1320 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "1f411c3a-1b14-4e69-9501-b9110eb433be", + "router": { + "name": "metro" + }, + "source": { + "id": "e07929c3-d5ce-44c1-b08d-3b4fede3bc59", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "65cec994-6cd3-47da-849a-f015982d8a23", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "vertices": [ + { + "x": 1620, + "y": 220 + } + ], + "z": 1336 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "b859523d-1b6a-4d34-898d-3e5d5372a8ef", + "router": { + "name": "metro" + }, + "source": { + "id": "8c6c1d82-e40b-4f58-b6c0-cc8c40791cae", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "65cec994-6cd3-47da-849a-f015982d8a23", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1337 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "stroke": "#5094D4", + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 4 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_4() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"hunt_file_1:action_result.data.*.binary.total_results\", \">\", 0],\n [\"artifact:*.cef.fileHash\", \"==\", \"hunt_file_1:action_result.parameter.hash\"],\n ],\n logical_operator='and',\n name=\"filter_4:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n file_reputation_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "hunt file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "hasElse": false, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "c79812bd-7079-4317-a492-d36f2de1ac83", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 130, + "line_start": 110, + "name": "filter", + "notes": "", + "number": 4, + "order": 4, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": ">", + "data_type": "", + "param": "hunt_file_1:action_result.data.*.binary.total_results", + "value": "0" + }, + { + "comparison": "==", + "data_type": "", + "param": "artifact:*.cef.fileHash", + "value": "hunt_file_1:action_result.parameter.hash" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 500, + "y": 180 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "filter_4", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 1343 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "stroke": "#5094D4", + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 2 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"action_result.summary.positives\", \"==\", 0],\n [\"artifact:*.cef.fileHash\", \"==\", \"file_reputation_1:action_result.parameter.hash\"],\n ],\n logical_operator='and',\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n get_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "hasElse": false, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "7ca41dcf-c8bd-46f4-bb7d-6df6d254c01f", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 150, + "line_start": 130, + "name": "filter", + "notes": "", + "number": 2, + "order": 5, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "==", + "data_type": "", + "param": "action_result.summary.positives", + "value": "0" + }, + { + "comparison": "==", + "data_type": "", + "param": "artifact:*.cef.fileHash", + "value": "file_reputation_1:action_result.parameter.hash" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 880, + "y": 180 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "filter_2", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 1345 + }, + { + "action": "get file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-artifact:*.cef.fileHash" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.data.*.name", + "data_type": "string" + }, + { + "column_name": "Vault ID", + "column_order": 1, + "contains": [ + "vault id" + ], + "data_path": "action_result.data.*.vault_id", + "data_type": "string" + }, + { + "column_name": "MD5", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.file_details.md5", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.icon", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.group", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.signed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.os_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.endpoint", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.is_64bit", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.file_details.file_desc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.last_seen", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.timestamp", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.cb_version", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.file_details.host_count", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.file_details.watchlists.*.wid", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.watchlists.*.value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.company_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.file_version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.orig_mod_len", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.file_details.product_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.digsig_result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.internal_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.copied_mod_len", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.file_details.legal_copyright", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.product_version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.digsig_publisher", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.digsig_sign_time", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.observed_filename", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.original_filename", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.digsig_result_code", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_details.is_executable_image", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.file_details.server_added_timestamp", + "data_type": "string" + }, + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "action_result.summary.name", + "data_type": "string" + }, + { + "contains": [ + "vault id" + ], + "data_path": "action_result.summary.vault_id", + "data_type": "string" + }, + { + "data_path": "action_result.summary.file_type", + "data_type": "string" + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "get file" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "stroke": "#5094D4" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#5094D4" + }, + "text.icon": { + "fill": "#5094D4" + } + }, + "block_code": "# read-only block view not available", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "def get_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n assets = get_specific_assets(\"get file\", [\"Carbon Black\"])\n \n if (not assets):\n phantom.debug(\"Carbon Black::get file not found returning.\")\n \n # collect data for 'get_file_2' call\n filtered_container_data = phantom.collect2(container=container, datapath=['filtered-artifact:*.cef.fileHash', 'filtered-artifact:*.id'], filter_artifacts=filtered_artifacts)\n\n parameters = []\n \n # build parameters list for 'get_file_2' call\n for filtered_container_item in filtered_container_data:\n if filtered_container_item[0]:\n parameters.append({\n 'hash': filtered_container_item[0],\n })\n\n if parameters:\n phantom.act(\"get file\", parameters=parameters, assets=assets, callback=filter_3, name=\"get_file_2\") \n else:\n phantom.error(\"'get_file_2' will not be executed due to lack of parameters\")\n \n return", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": true, + "has_custom_block": true, + "has_custom_callback": false, + "has_custom_join": false, + "id": "9052a241-042b-4189-b56d-fcc0bf461cc6", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 205, + "line_start": 179, + "message": "Configuring now", + "name": "get file", + "notes": "", + "number": 2, + "order": 7, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1020, + "y": 180 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "get_file_2", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 1350 + }, + { + "action": "detonate file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "file_name": "", + "force_analysis": "", + "private": "", + "vault_id": "get_file_2:filtered-action_result.data.*.vault_id", + "vm": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "file_name": "", + "force_analysis": "", + "private": "", + "vault_id": "get_file_2:filtered-action_result.data.*.vault_id", + "vm": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "threatgrid", + "output": [ + { + "contains": [ + "threatgrid task id" + ], + "data_path": "action_result.summary.id", + "data_type": "string" + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.results_url", + "data_type": "string" + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.summary.target", + "data_type": "string" + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.data.*.report.disk.mbr.hashes.curr.md5", + "data_type": "string" + }, + { + "contains": [ + "hash", + "sha1" + ], + "data_path": "action_result.data.*.report.disk.mbr.hashes.curr.sha1", + "data_type": "string" + }, + { + "contains": [ + "hash", + "sha256" + ], + "data_path": "action_result.data.*.report.disk.mbr.hashes.curr.sha256", + "data_type": "string" + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.data.*.report.disk.mbr.hashes.orig.md5", + "data_type": "string" + }, + { + "contains": [ + "hash", + "sha1" + ], + "data_path": "action_result.data.*.report.disk.mbr.hashes.orig.sha1", + "data_type": "string" + }, + { + "contains": [ + "hash", + "sha256" + ], + "data_path": "action_result.data.*.report.disk.mbr.hashes.orig.sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.disk.mbr.changed", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.report.disk.mbr.contents.curr", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.disk.mbr.contents.orig", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.disk.partition_tables.curr.*.size", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.disk.partition_tables.curr.*.type", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.disk.partition_tables.curr.*.start", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.disk.partition_tables.orig.*.size", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.disk.partition_tables.orig.*.type", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.disk.partition_tables.orig.*.start", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.disk.partition_tables.changed", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.report.iocs.*.ioc", + "data_type": "string" + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.report.iocs.*.data.*.URL", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.iocs.*.data.*.Method", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.iocs.*.data.*.Network_Stream", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.iocs.*.hits", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.iocs.*.tags", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.iocs.*.title", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.iocs.*.category", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.iocs.*.severity", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.iocs.*.truncated", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.report.iocs.*.confidence", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.iocs.*.description", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.status.id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.status.vm", + "data_type": "string" + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.data.*.report.status.md5", + "data_type": "string" + }, + { + "contains": [ + "hash", + "sha1" + ], + "data_path": "action_result.data.*.report.status.sha1", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.status.origin", + "data_type": "string" + }, + { + "contains": [ + "hash", + "sha256" + ], + "data_path": "action_result.data.*.report.status.sha256", + "data_type": "string" + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.report.status.done_url", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.status.running_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.status.vm_runtime", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.status.original_filename", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.status.analysis_started_at", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.status.analysis_submitted_at", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.new", + "data_type": "boolean" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.report.dynamic.processes.*.pid", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.kpid", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.proc", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.time", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.monitored", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.process_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.tid", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.upid", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.uthread", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.dll_path", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.shell_info", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.command_line", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.desktop_info", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.runtime_data", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.window_title", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.image_pathname", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.current_directory", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.analyzed_because", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_read.*.key_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_read.*.key_value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.access", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.options", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.network.*.dst", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.network.*.src", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.network.*.uid", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.network.*.bytes", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.network.*.ts_end", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.network.*.history", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.network.*.packets", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.network.*.service", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.network.*.session", + "data_type": "numeric" + }, + { + "contains": [ + "port" + ], + "data_path": "action_result.data.*.report.network.*.dst_port", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.network.*.duration", + "data_type": "numeric" + }, + { + "contains": [ + "port" + ], + "data_path": "action_result.data.*.report.network.*.src_port", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.network.*.ts_begin", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.network.*.transport", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.network.*.bytes_orig", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.network.*.bytes_resp", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.network.*.conn_state", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.network.*.bytes_missed", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.network.*.packets_orig", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.network.*.packets_resp", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.network.*.bytes_payload", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.network.*.bytes_orig_payload", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.network.*.bytes_resp_payload", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.version", + "data_type": "numeric" + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.data.*.report.metadata.malware_desc.*.md5", + "data_type": "string" + }, + { + "contains": [ + "hash", + "sha1" + ], + "data_path": "action_result.data.*.report.metadata.malware_desc.*.sha1", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.metadata.malware_desc.*.size", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.metadata.malware_desc.*.type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.metadata.malware_desc.*.magic", + "data_type": "string" + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.data.*.report.metadata.malware_desc.*.sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.metadata.malware_desc.*.filename", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.metadata.sandcastle_env.vm", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.metadata.sandcastle_env.vm_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.metadata.sandcastle_env.run_time", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.metadata.sandcastle_env.current_os", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.metadata.sandcastle_env.sandcastle", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.metadata.sandcastle_env.analysis_end", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.metadata.sandcastle_env.analysis_start", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.metadata.sandcastle_env.controlsubject", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.metadata.sandcastle_env.sample_executed", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.metadata.general_details.sandbox_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.metadata.general_details.report_created", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.report.metadata.general_details.sandbox_version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.versions.file.js", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.versions.file.pe", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.versions.file.ini", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.versions.file.lnk", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.versions.file.pdf", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.versions.file.rtf", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.versions.file.txt", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.versions.file.html", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.versions.file.version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.versions.network.version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.versions.version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.created-time", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.entropy", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.exports", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.company_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.copyright", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.file_description", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.file_version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.internal_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.original_file_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.product_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.product_version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.checksum", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.header_relocations", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_code_segment", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_instruction_pointer", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_stack_pointer", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_stack_segment", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.pages", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.size_in_paragraphs", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.import_hash", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.number_of_symbols", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.actual_checksum", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.claimed_checksum", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.entrypoint_address", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.file_alignment", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.linker_major_version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.linker_minor_version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.loader_flag", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.number_of_rva_and_sizes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.reserved_field", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.section_alignment", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.subsystem", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.signed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.timestamp", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.imports.*.dll", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.imports.*.entries", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.internal_checksum_match", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.codepage", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.language", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.locale", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.offset", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.path", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.resource_sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.sublanguage", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.address", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.characteristics", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.data_pointer", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.entropy", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.entropy_type", + "data_type": "string" + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.report.artifacts.*.forensics.Sections.InternetShortcut.Properties.URL", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.section", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.section_hash", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.virtual_size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.signatures", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.tag_attrs", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.tags", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.forensics.urls", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.magic-type", + "data_type": "string" + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.data.*.report.artifacts.*.md5", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.mime-type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.origin", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.path", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.relation.network", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.relation.process", + "data_type": "string" + }, + { + "contains": [ + "hash", + "sha1" + ], + "data_path": "action_result.data.*.report.artifacts.*.sha1", + "data_type": "string" + }, + { + "contains": [ + "hash", + "sha256" + ], + "data_path": "action_result.data.*.report.artifacts.*.sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.artifacts.*.type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.report.annotations.network.*.ts", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.status.id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.status.os", + "data_type": "string" + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.data.*.status.md5", + "data_type": "string" + }, + { + "contains": [ + "hash", + "sha1" + ], + "data_path": "action_result.data.*.status.sha1", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.status.login", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.status.state", + "data_type": "string" + }, + { + "contains": [ + "hash", + "sha256" + ], + "data_path": "action_result.data.*.status.sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.status.status", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.status.filename", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.status.started_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.status.completed_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.status.submitted_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.status.submission_id", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.threat.bis", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.threat.count", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.threat.score", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.threat.sample", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.threat.max-severity", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.threat.max-confidence", + "data_type": "numeric" + }, + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.parameter.file_name", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.force_analysis", + "data_type": "boolean" + }, + { + "contains": [ + "vault id", + "pe file", + "pdf" + ], + "data_path": "action_result.parameter.vault_id", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.vm", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.private", + "data_type": "boolean" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "sandbox" + } + ], + "attrs": { + ".action": { + "text": "detonate file" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "stroke": "#5094D4" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#5094D4" + }, + "text.icon": { + "fill": "#5094D4" + } + }, + "block_code": "# read-only block view not available", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "get file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n assets = get_specific_assets(\"detonate file\", [\"Threat Grid\"])\n \n if (not assets):\n phantom.debug(\"Threat Grid::detonate file not found returning.\")\n \n # collect data for 'detonate_file_1' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"get_file_2:filtered-action_result.data.*.vault_id\", \"get_file_2:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n parameters = []\n \n # build parameters list for 'detonate_file_1' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'vault_id': filtered_results_item_1[0],\n 'file_name': \"\",\n 'vm': \"\",\n 'force_analysis': \"\",\n 'private': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n if parameters:\n phantom.act(\"detonate file\", parameters=parameters, assets=assets, name=\"detonate_file_1\") \n else:\n phantom.error(\"'detonate_file_1' will not be executed due to lack of parameters\")\n \n return", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": true, + "has_custom_block": true, + "has_custom_callback": false, + "has_custom_join": false, + "id": "e07929c3-d5ce-44c1-b08d-3b4fede3bc59", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 237, + "line_start": 205, + "message": "Configuring now", + "name": "detonate file", + "notes": "", + "number": 1, + "order": 8, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1400, + "y": 180 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "detonate_file_1", + "required_params": { + "vault_id": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 1351 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "stroke": "#5094D4", + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 3 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"get_file_2:action_result.data.*.vault_id\", \"!=\", \"\"],\n ],\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n detonate_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "get file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "hasElse": false, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "93d4e099-5891-4c2b-b6db-ac512e981f06", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 255, + "line_start": 237, + "name": "filter", + "notes": "", + "number": 3, + "order": 9, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "get_file_2:action_result.data.*.vault_id", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1260, + "y": 180 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "filter_3", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 1352 + }, + { + "action": "file reputation", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "artifact:*.cef.fileHash" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "reversinglabs", + "output": [ + { + "contains": [ + "hash", + "sha256", + "sha1", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.status", + "data_type": "string" + }, + { + "contains": [ + "sha1" + ], + "data_path": "action_result.data.*.sha1", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.first_seen_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.last_scanned_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.last_seen_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.single_scan", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.first_scanned_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sample_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sample_size", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.xref.*.scanner_match", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.xref.*.scanner_count", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.xref.*.results.*.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.xref.*.results.*.scanner", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.xref.*.scanned_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.xref.*.scanners.*.timestamp", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.xref.*.scanners.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.xref.*.scanners.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sha384", + "data_type": "string" + }, + { + "contains": [ + "sha256" + ], + "data_path": "action_result.data.*.sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sha512", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.ripemd160", + "data_type": "string" + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.md5", + "data_type": "string" + }, + { + "data_path": "action_result.summary.positives", + "data_type": "numeric" + }, + { + "data_path": "action_result.summary.total_scans", + "data_type": "numeric" + }, + { + "data_path": "summary.total_positives", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "reputation" + } + ], + "attrs": { + ".action": { + "text": "file reputation" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "stroke": "#5094D4" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#5094D4" + }, + "text.icon": { + "fill": "#5094D4" + } + }, + "block_code": "# read-only block view not available", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "hunt file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n assets = get_specific_assets(\"file reputation\", [\"TitaniumCloud\"])\n \n if (not assets):\n phantom.debug(\"ReversingLabs/TitaniumCloud::file reputation not found returning.\")\n\n # collect data for 'file_reputation_1' call\n container_data = phantom.collect2(container=container, datapath=['filtered-artifact:*.cef.fileHash', 'filtered-artifact:*.id'], filter_artifacts=filtered_artifacts)\n \n phantom.debug(container_data)\n\n parameters = []\n \n # build parameters list for 'file_reputation_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'hash': container_item[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n if parameters:\n phantom.act(\"file reputation\", parameters=parameters, assets=assets, name=\"file_reputation_1\", callback=filter_2) \n else:\n phantom.error(\"'file_reputation_1' will not be executed due to lack of parameters\")\n \n return", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": true, + "has_custom_block": true, + "has_custom_callback": false, + "has_custom_join": false, + "id": "5578c85f-4a27-401e-be14-7793e82b92c5", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 285, + "line_start": 255, + "message": "Configuring now", + "name": "file reputation", + "notes": "", + "number": 1, + "order": 10, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 640, + "y": 180 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "file_reputation_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 1353 + }, + { + "action": "run query", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "display": "adsf", + "query": "dfaf" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "display": "adsf", + "query": "dfaf" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "splunk_entr", + "output": [ + { + "column_name": "Host", + "column_order": "0", + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.host", + "data_type": "string" + }, + { + "column_name": "Time", + "column_order": "1", + "contains": [], + "data_path": "action_result.data.*._time", + "data_type": "string" + }, + { + "column_name": "Raw", + "column_order": "2", + "contains": [], + "data_path": "action_result.data.*._raw", + "data_type": "string" + }, + { + "data_path": "action_result.data.*._cd", + "data_type": "string" + }, + { + "data_path": "action_result.data.*._si", + "data_type": "string" + }, + { + "data_path": "action_result.data.*._bkt", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.index", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.source", + "data_type": "string" + }, + { + "data_path": "action_result.data.*._serial", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.linecount", + "data_type": "string" + }, + { + "data_path": "action_result.data.*._indextime", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sourcetype", + "data_type": "string" + }, + { + "data_path": "action_result.data.*._sourcetype", + "data_type": "string" + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.splunk_server", + "data_type": "string" + }, + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "action_result.summary.total_events", + "data_type": "numeric" + }, + { + "contains": [ + "splunk query" + ], + "data_path": "action_result.parameter.query", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.display", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "siem" + } + ], + "attrs": { + ".action": { + "text": "run query" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "stroke": "#5094D4" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#5094D4" + }, + "text.icon": { + "fill": "#5094D4" + } + }, + "block_code": "# read-only block view not available", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "def run_query_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n\n assets = get_specific_assets(\"run query\", [\"Splunk Enterprise\", \"Carbon Black\"])\n \n if (not assets):\n phantom.debug(\"Did not find any asset configured, supporting run query\")\n return\n \n container_data_src = phantom.collect2(container=container, datapath=['artifact:*.cef.sourceAddress', 'artifact:*.id'])\n container_data_dst = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'run_query_1' call\n \n phantom.debug(\"Got the following assets:\")\n phantom.debug(','.join([x for x in assets]))\n \n for container_item in container_data_src:\n if container_item[0]:\n parameters.append({\n 'query': container_item[0],\n 'display': \"\",\n 'type': \"process\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n \n for container_item in container_data_dst:\n if container_item[0]:\n parameters.append({\n 'query': container_item[0],\n 'display': \"\",\n 'type': \"process\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n \n if (parameters):\n phantom.act(\"run query\", parameters=parameters, assets=assets, name=\"run_query_1\")\n else:\n phantom.error(\"'run_query_1' will not be executed due to lack of parameters\")\n \n return", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": true, + "has_custom_block": true, + "has_custom_callback": false, + "has_custom_join": false, + "id": "8c6c1d82-e40b-4f58-b6c0-cc8c40791cae", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 330, + "line_start": 285, + "message": "Configuring now", + "name": "run query", + "notes": "", + "number": 1, + "order": 11, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 260, + "y": 320 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "run_query_1", + "required_params": { + "query": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 1355 + }, + { + "action": "hunt file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "artifact:*.cef.fileHash", + "range": "", + "type": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "artifact:*.cef.fileHash", + "range": "", + "type": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string" + }, + { + "contains": [ + "carbon black query type" + ], + "data_path": "action_result.parameter.type", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.range", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.terms", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.total_results", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.group.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.group.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.group.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.group.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.start.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.start.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.results.*.modload_count", + "data_type": "numeric" + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.process.results.*.sensor_id", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.results.*.process_md5", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.results.*.parent_unique_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.results.*.cmdline", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.results.*.filemod_count", + "data_type": "numeric" + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.process.results.*.id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.results.*.parent_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.results.*.parent_md5", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.results.*.group", + "data_type": "string" + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.process.results.*.hostname", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.results.*.last_update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.results.*.start", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.results.*.netconn_count", + "data_type": "numeric" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.process.results.*.process_pid", + "data_type": "numeric" + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.process.results.*.username", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.process.results.*.process_name", + "data_type": "string" + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.process.results.*.path", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.results.*.regmod_count", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.results.*.parent_pid", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.results.*.crossproc_count", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.results.*.segment_id", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.results.*.host_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.results.*.os_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.results.*.childproc_count", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.results.*.unique_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.process.elapsed", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.process.start", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.terms", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.total_results", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.highlights.*.ids", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.highlights.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.results.*.host_count", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.observed_filename", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.product_version", + "data_type": "string" + }, + { + "column_name": "Signed", + "column_order": 1, + "data_path": "action_result.data.*.binary.results.*.signed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.is_executable_image", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.binary.results.*.orig_mod_len", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.results.*.is_64bit", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.binary.results.*.group", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.file_version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.company_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.internal_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.product_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result_code", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.timestamp", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.copied_mod_len", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.md5", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.endpoint", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.legal_copyright", + "data_type": "string" + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.original_filename", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.cb_version", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.results.*.os_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.file_desc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.results.*.last_seen", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.binary.elapsed", + "data_type": "numeric" + }, + { + "data_path": "action_result.data.*.binary.start", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt file" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "stroke": "#5094D4" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#5094D4" + }, + "text.icon": { + "fill": "#5094D4" + } + }, + "block_code": "# read-only block view not available", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n\n assets = get_specific_assets(\"hunt file\", [\"Carbon Black\"])\n \n if (not assets):\n phantom.debug(\"Carbon Black::hunt file not found returning.\")\n \n # collect data for 'hunt_file_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'hunt_file_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'hash': container_item[0],\n 'range': \"\",\n 'type': \"binary\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n if parameters:\n phantom.act(\"hunt file\", parameters=parameters, assets=assets, name=\"hunt_file_1\", callback=filter_4) \n else:\n phantom.error(\"'hunt_file_1' will not be executed due to lack of parameters\")\n \n return", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": true, + "has_custom_block": true, + "has_custom_callback": false, + "has_custom_join": false, + "id": "ed123d2f-999b-4cdc-b141-a48f7da89227", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 360, + "line_start": 330, + "message": "Configuring now", + "name": "hunt file", + "notes": "", + "number": 1, + "order": 12, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 260, + "y": 180 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "hunt_file_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 1356 + }, + { + "action": "hunt domain", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "count_only": "True", + "domain": "artifact:*.cef.destinationDnsDomain" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "count_only": "True", + "domain": "artifact:*.cef.destinationDnsDomain" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "falconhostapi", + "output": [ + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "column_name": "Falcon Device ID", + "column_order": 0, + "contains": [ + "falcon device id" + ], + "data_path": "action_result.data.*.device_id", + "data_type": "string" + }, + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "contains": [ + "domain" + ], + "data_path": "action_result.parameter.domain", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.count_only", + "data_type": "boolean" + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt domain" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "stroke": "#5094D4" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#5094D4" + }, + "text.icon": { + "fill": "#5094D4" + } + }, + "block_code": "# read-only block view not available", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "def hunt_domain_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n\n assets = get_specific_assets(\"hunt domain\", [\"Falcon Host API\"])\n \n if (not assets):\n phantom.debug(\"hunt domain/Falcon Host API not found returning.\")\n\n # collect data for 'hunt_domain_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationDnsDomain', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'hunt_domain_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'domain': container_item[0],\n 'count_only': True,\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n if parameters:\n phantom.act(\"hunt domain\", parameters=parameters, assets=assets, callback=filter_1, name=\"hunt_domain_1\") \n else:\n phantom.error(\"'hunt_domain_1' will not be executed due to lack of parameters\")\n \n return", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": true, + "has_custom_block": true, + "has_custom_callback": false, + "has_custom_join": false, + "id": "2c95ee18-c36d-40b4-9a1d-889badec9d4f", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 179, + "line_start": 150, + "message": "Configuring now", + "name": "hunt domain", + "notes": "", + "number": 1, + "order": 6, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 260, + "y": 40 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "hunt_domain_1", + "required_params": { + "domain": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 1357 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "stroke": "#5094D4", + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 1 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"hunt_domain_1:action_result.summary.device_count\", \">\", 0],\n [\"artifact:*.cef.destinationDnsDomain\", \"==\", \"hunt_domain_1:action_result.parameter.domain\"],\n ],\n logical_operator='and',\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n get_system_info_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": false, + "connection_name": "hunt domain", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "hasElse": false, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "8656f57d-779a-4133-a244-5191a6714a83", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 84, + "line_start": 64, + "name": "filter", + "notes": "", + "number": 1, + "order": 2, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": ">", + "data_type": "", + "param": "hunt_domain_1:action_result.summary.device_count", + "value": "0" + }, + { + "comparison": "==", + "data_type": "", + "param": "artifact:*.cef.destinationDnsDomain", + "value": "hunt_domain_1:action_result.parameter.domain" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 500, + "y": 40 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "filter_1", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 1358 + } + ] + }, + "notes": "" + }, + "python_version": "3", + "schema": 4, + "version": "4.10.0.40961" + }, + "create_time": "2021-01-21T18:16:11.375283+00:00", + "draft_mode": false, + "labels": [ + "events" + ], + "tags": [], + "misc": { + "apps_list": [ + "Splunk", + "Carbon Black Response", + "Falcon Host API", + "ReversingLabs", + "Threat Grid" + ] + } +} \ No newline at end of file diff --git a/playbooks/hunting.png b/playbooks/hunting.png new file mode 100644 index 0000000000..a79631f02b Binary files /dev/null and b/playbooks/hunting.png differ diff --git a/playbooks/hunting.py b/playbooks/hunting.py new file mode 100644 index 0000000000..2d98e9f742 --- /dev/null +++ b/playbooks/hunting.py @@ -0,0 +1,373 @@ +""" +Hunt for internal sightings of malicious files or connections to malicious domains or IP addresses. +""" + +import phantom.rules as phantom +import json +from datetime import datetime, timedelta +############################## +# Start - Global Code Block + +""" +The hunting Playbook queries a number of internal security technologies in order to determine if any of the artifacts present in your data source have been observed in your environment. +""" + +def get_specific_assets(action, include_products=None): + + supported_assets = phantom.get_assets(action=action) + # phantom.debug("Action Supported Assets") + # phantom.debug(supported_assets) + + if not supported_assets: + # no supported products configured + return [] + + if not include_products: + # no product filters, so return whatever we found + return [x['name'] for x in supported_assets] + + if include_products: + + if (type(include_products) != list): + phantom.debug("Please specify a list for filter_products") + return [] + + # make the product names sent to this funcion lower + include_products = [x.lower() for x in include_products] + + # get products that are configured and asked for + assets_matched = [x['name'] for x in supported_assets if x['product_name'].lower() in include_products] + # phantom.debug("Action Supported Matches") + # phantom.debug(assets_matched) + return assets_matched + + # should not reach here + return [] + +# End - Global Code block +############################## + +def on_start(container): + phantom.debug('on_start() called') + + # call 'hunt_domain_1' block + hunt_domain_1(container=container) + + # call 'hunt_file_1' block + hunt_file_1(container=container) + + # call 'run_query_1' block + run_query_1(container=container) + + return + +def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_1() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["hunt_domain_1:action_result.summary.device_count", ">", 0], + ["artifact:*.cef.destinationDnsDomain", "==", "hunt_domain_1:action_result.parameter.domain"], + ], + logical_operator='and', + name="filter_1:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + get_system_info_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def get_system_info_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + + assets = get_specific_assets("get system info", ["Carbon Black"]) + + if (not assets): + phantom.debug("Carbon Black::get system info not found returning.") + + # collect data for 'get_system_info_1' call + filtered_container_data = phantom.collect2(container=container, datapath=['filtered-artifact:*.cef.sourceAddress', 'filtered-artifact:*.id'], filter_artifacts=filtered_artifacts) + + parameters = [] + + # build parameters list for 'get_system_info_1' call + for filtered_container_item in filtered_container_data: + if filtered_container_item[0]: + parameters.append({ + 'ip_hostname': filtered_container_item[0], + }) + + if parameters: + phantom.act("get system info", parameters=parameters, assets=assets, name="get_system_info_1") + else: + phantom.error("'get_system_info_1' will not be executed due to lack of parameters") + + return + +def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_4() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["hunt_file_1:action_result.data.*.binary.total_results", ">", 0], + ["artifact:*.cef.fileHash", "==", "hunt_file_1:action_result.parameter.hash"], + ], + logical_operator='and', + name="filter_4:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + file_reputation_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_2() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["action_result.summary.positives", "==", 0], + ["artifact:*.cef.fileHash", "==", "file_reputation_1:action_result.parameter.hash"], + ], + logical_operator='and', + name="filter_2:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + get_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def hunt_domain_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + + assets = get_specific_assets("hunt domain", ["Falcon Host API"]) + + if (not assets): + phantom.debug("hunt domain/Falcon Host API not found returning.") + + # collect data for 'hunt_domain_1' call + container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationDnsDomain', 'artifact:*.id']) + + parameters = [] + + # build parameters list for 'hunt_domain_1' call + for container_item in container_data: + if container_item[0]: + parameters.append({ + 'domain': container_item[0], + 'count_only': True, + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': container_item[1]}, + }) + + if parameters: + phantom.act("hunt domain", parameters=parameters, assets=assets, callback=filter_1, name="hunt_domain_1") + else: + phantom.error("'hunt_domain_1' will not be executed due to lack of parameters") + + return + +def get_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + + assets = get_specific_assets("get file", ["Carbon Black"]) + + if (not assets): + phantom.debug("Carbon Black::get file not found returning.") + + # collect data for 'get_file_2' call + filtered_container_data = phantom.collect2(container=container, datapath=['filtered-artifact:*.cef.fileHash', 'filtered-artifact:*.id'], filter_artifacts=filtered_artifacts) + + parameters = [] + + # build parameters list for 'get_file_2' call + for filtered_container_item in filtered_container_data: + if filtered_container_item[0]: + parameters.append({ + 'hash': filtered_container_item[0], + }) + + if parameters: + phantom.act("get file", parameters=parameters, assets=assets, callback=filter_3, name="get_file_2") + else: + phantom.error("'get_file_2' will not be executed due to lack of parameters") + + return + +def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + + assets = get_specific_assets("detonate file", ["Threat Grid"]) + + if (not assets): + phantom.debug("Threat Grid::detonate file not found returning.") + + # collect data for 'detonate_file_1' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["get_file_2:filtered-action_result.data.*.vault_id", "get_file_2:filtered-action_result.parameter.context.artifact_id"], action_results=filtered_results) + + parameters = [] + + # build parameters list for 'detonate_file_1' call + for filtered_results_item_1 in filtered_results_data_1: + if filtered_results_item_1[0]: + parameters.append({ + 'vault_id': filtered_results_item_1[0], + 'file_name': "", + 'vm': "", + 'force_analysis': "", + 'private': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + if parameters: + phantom.act("detonate file", parameters=parameters, assets=assets, name="detonate_file_1") + else: + phantom.error("'detonate_file_1' will not be executed due to lack of parameters") + + return + +def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_3() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["get_file_2:action_result.data.*.vault_id", "!=", ""], + ], + name="filter_3:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + detonate_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + + assets = get_specific_assets("file reputation", ["TitaniumCloud"]) + + if (not assets): + phantom.debug("ReversingLabs/TitaniumCloud::file reputation not found returning.") + + # collect data for 'file_reputation_1' call + container_data = phantom.collect2(container=container, datapath=['filtered-artifact:*.cef.fileHash', 'filtered-artifact:*.id'], filter_artifacts=filtered_artifacts) + + phantom.debug(container_data) + + parameters = [] + + # build parameters list for 'file_reputation_1' call + for container_item in container_data: + if container_item[0]: + parameters.append({ + 'hash': container_item[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': container_item[1]}, + }) + + if parameters: + phantom.act("file reputation", parameters=parameters, assets=assets, name="file_reputation_1", callback=filter_2) + else: + phantom.error("'file_reputation_1' will not be executed due to lack of parameters") + + return + +def run_query_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + + assets = get_specific_assets("run query", ["Splunk Enterprise", "Carbon Black"]) + + if (not assets): + phantom.debug("Did not find any asset configured, supporting run query") + return + + container_data_src = phantom.collect2(container=container, datapath=['artifact:*.cef.sourceAddress', 'artifact:*.id']) + container_data_dst = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id']) + + parameters = [] + + # build parameters list for 'run_query_1' call + + phantom.debug("Got the following assets:") + phantom.debug(','.join([x for x in assets])) + + for container_item in container_data_src: + if container_item[0]: + parameters.append({ + 'query': container_item[0], + 'display': "", + 'type': "process", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': container_item[1]}, + }) + + for container_item in container_data_dst: + if container_item[0]: + parameters.append({ + 'query': container_item[0], + 'display': "", + 'type': "process", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': container_item[1]}, + }) + + if (parameters): + phantom.act("run query", parameters=parameters, assets=assets, name="run_query_1") + else: + phantom.error("'run_query_1' will not be executed due to lack of parameters") + + return + +def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + + assets = get_specific_assets("hunt file", ["Carbon Black"]) + + if (not assets): + phantom.debug("Carbon Black::hunt file not found returning.") + + # collect data for 'hunt_file_1' call + container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id']) + + parameters = [] + + # build parameters list for 'hunt_file_1' call + for container_item in container_data: + if container_item[0]: + parameters.append({ + 'hash': container_item[0], + 'range': "", + 'type': "binary", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': container_item[1]}, + }) + + if parameters: + phantom.act("hunt file", parameters=parameters, assets=assets, name="hunt_file_1", callback=filter_4) + else: + phantom.error("'hunt_file_1' will not be executed due to lack of parameters") + + return + +def on_finish(container, summary): + phantom.debug('on_finish() called') + # This function is called after all actions are completed. + # summary of all the action and/or all details of actions + # can be collected here. + + # summary_json = phantom.get_summary() + # if 'result' in summary_json: + # for action_result in summary_json['result']: + # if 'action_run_id' in action_result: + # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False) + # phantom.debug(action_results) + + return \ No newline at end of file diff --git a/playbooks/hunting.yml b/playbooks/hunting.yml new file mode 100644 index 0000000000..4dc40bc20b --- /dev/null +++ b/playbooks/hunting.yml @@ -0,0 +1,24 @@ +name: Hunting +id: fb3edc76-ff2b-48b0-5f6f-63da6351ad63 +version: 1 +date: '2021-01-21' +author: Philip Royer, Splunk +type: Investigation +description: The hunting Playbook queries a number of internal security technologies in order to determine if any of the artifacts present in your data source have been observed in your environment. +playbook: hunting +how_to_implement: "Be sure to update asset naming to reflect the asset names configured in your environment." +references: [] +app_list: +- "Splunk" +- "Reversing Labs" +- "CarbonBlack Response" +- "Threat Grid" +- "Falcon Host API" +tags: + platform_tags: [] + playbook_type: Automation + playbook_fields: + - fileHash + - vault_id + product: + - Splunk SOAR \ No newline at end of file