diff --git a/contentctl.yml b/contentctl.yml index 1608f85298..3cc7816952 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -155,9 +155,9 @@ apps: - uid: 3110 title: Splunk Add-on for Microsoft Cloud Services appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES - version: 5.4.1 + version: 5.4.2 description: description of app - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_541.tgz + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_542.tgz - uid: 4055 title: Splunk Add-on for Microsoft Office 365 appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365 diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 5acf9c76b5..2fa460b33f 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -10,4 +10,4 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index 9db213655d..f527bda794 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index c62d91a8c2..3a0db1013e 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 6e3b00d39a..a58de4a47b 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index 798a1dd0c9..e3970586a3 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 2cb8e93738..d4103cfef6 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 9464b69c7a..d7a04aa5ad 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 2b1fd79f79..2ef98d1f69 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 710007e9f8..b09a4f4204 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index ebb0a4dea9..e66920d152 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index 1247baa3b5..b3fb17cd5e 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 07fbd4945f..dda3730b7f 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 71e28dc986..7b53354989 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 821d432ecf..b77b1dfa80 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 6d43b471e6..d04c125346 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index 4efa2a3816..c589966ec2 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index f7bef825fe..5880ca36cd 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 8e30686b23..b341d24461 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 024427c038..6511f9fe3e 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 35fccd817e..da046c0e0b 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 4a4eb3f0b0..d3526f723c 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -3,14 +3,17 @@ id: 1997a515-a61a-4f78-ada9-54af34c764f2 version: 1 date: '2025-01-13' author: Bhavin Patel, Splunk -description: Data source object for Azure Monitor Activity. The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. +description: Data source object for Azure Monitor Activity. The Splunk Add-on for + Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure + EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic + settings > Add diagnostic settings & send events to the activity audit event hub. source: Azure AD sourcetype: azure:monitor:activity separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - column - action @@ -93,4 +96,16 @@ fields: - vendor_product - vendor_region - _time -example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"}, "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", "Category": 3, "RelationId": null, "TargetDisplayNames": [""], "TargetObjectIds": ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", "identity": "brian.cove@frothlydev.onmicrosoft.com"}' +example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", + "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", + "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, + "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", + "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, + "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": + "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"}, + "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", + "Category": 3, "RelationId": null, "TargetDisplayNames": [""], "TargetObjectIds": + ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": + "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, + "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", + "identity": "brian.cove@frothlydev.onmicrosoft.com"}' diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index c055850294..1d636ec76c 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -22,7 +22,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", "*\\temp\\*" , "*\\PerfLogs\\*","*\\windows\\tasks\\*", "*:\\programdata\\*") by - Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest + Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_path Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_file_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index 27d9a6ccb8..d8050741e3 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -65,8 +65,3 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog -- name: True Positive Test - CrowdStrike - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png similarity index 100% rename from playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png rename to playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json index 827ec3798e..24bb6ab01d 100644 --- a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json +++ b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json @@ -1,752 +1,752 @@ { - "blockly": false, - "blockly_xml": "", - "category": "Identifier Reputation Analysis", - "coa": { - "data": { - "description": "Accepts a URL, IP or Domain and does reputation analysis on the objects. Generates a threat level, threat categories and AUP categories that are formatted and added to a container as a note.", - "edges": [ - { - "id": "port_0_to_port_2", - "sourceNode": "0", - "sourcePort": "0_out", - "targetNode": "2", - "targetPort": "2_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_2_to_port_3", - "sourceNode": "2", - "sourcePort": "2_out", - "targetNode": "3", - "targetPort": "3_in" - }, - { - "conditions": [ - { - "index": 1 - } - ], - "id": "port_2_to_port_4", - "sourceNode": "2", - "sourcePort": "2_out", - "targetNode": "4", - "targetPort": "4_in" - }, - { - "conditions": [ - { - "index": 2 - } - ], - "id": "port_2_to_port_5", - "sourceNode": "2", - "sourcePort": "2_out", - "targetNode": "5", - "targetPort": "5_in" - }, - { - "id": "port_3_to_port_6", - "sourceNode": "3", - "sourcePort": "3_out", - "targetNode": "6", - "targetPort": "6_in" - }, - { - "id": "port_4_to_port_10", - "sourceNode": "4", - "sourcePort": "4_out", - "targetNode": "10", - "targetPort": "10_in" - }, - { - "id": "port_5_to_port_13", - "sourceNode": "5", - "sourcePort": "5_out", - "targetNode": "13", - "targetPort": "13_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_6_to_port_17", - "sourceNode": "6", - "sourcePort": "6_out", - "targetNode": "17", - "targetPort": "17_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_10_to_port_16", - "sourceNode": "10", - "sourcePort": "10_out", - "targetNode": "16", - "targetPort": "16_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_13_to_port_18", - "sourceNode": "13", - "sourcePort": "13_out", - "targetNode": "18", - "targetPort": "18_in" - }, - { - "id": "port_17_to_port_26", - "sourceNode": "17", - "sourcePort": "17_out", - "targetNode": "26", - "targetPort": "26_in" - }, - { - "id": "port_26_to_port_1", - "sourceNode": "26", - "sourcePort": "26_out", - "targetNode": "1", - "targetPort": "1_in" - }, - { - "id": "port_16_to_port_27", - "sourceNode": "16", - "sourcePort": "16_out", - "targetNode": "27", - "targetPort": "27_in" - }, - { - "id": "port_27_to_port_1", - "sourceNode": "27", - "sourcePort": "27_out", - "targetNode": "1", - "targetPort": "1_in" - }, - { - "id": "port_18_to_port_28", - "sourceNode": "18", - "sourcePort": "18_out", - "targetNode": "28", - "targetPort": "28_in" - }, - { - "id": "port_28_to_port_1", - "sourceNode": "28", - "sourcePort": "28_out", - "targetNode": "1", - "targetPort": "1_in" - } - ], - "hash": "eba6b9d077093e83e07346cba73e6ed0a16e86ea", - "nodes": { - "0": { - "data": { - "advanced": { - "join": [] - }, - "functionName": "on_start", - "id": "0", - "type": "start" - }, - "errors": {}, - "id": "0", - "type": "start", - "warnings": {}, - "x": 1000, - "y": 419.9999999999985 - }, - "1": { - "data": { - "advanced": { - "join": [] - }, - "functionName": "on_finish", - "id": "1", - "type": "end" - }, - "errors": {}, - "id": "1", - "type": "end", - "warnings": {}, - "x": 1000, - "y": 1520 - }, - "10": { - "data": { - "advanced": { - "customName": "domain reputation filter", - "customNameId": 0, - "description": "Exclude failing domain reputations", - "join": [], - "note": "Exclude failing domain reputations" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "==", - "param": "domain_reputation:action_result.status", - "value": "success" - } - ], - "conditionIndex": 0, - "customName": "Success", - "logic": "and" - } - ], - "functionId": 3, - "functionName": "domain_reputation_filter", - "id": "10", - "type": "filter" - }, - "errors": {}, - "id": "10", - "type": "filter", - "warnings": {}, - "x": 1040, - "y": 840 - }, - "13": { - "data": { - "advanced": { - "customName": "ip reputation filter", - "customNameId": 0, - "description": "Exclude failing ip reputations", - "join": [], - "note": "Exclude failing ip reputations" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "==", - "param": "ip_reputation:action_result.status", - "value": "success" - } - ], - "conditionIndex": 0, - "customName": "Success", - "logic": "and" - } - ], - "functionId": 4, - "functionName": "ip_reputation_filter", - "id": "13", - "type": "filter" - }, - "errors": {}, - "id": "13", - "type": "filter", - "warnings": {}, - "x": 1380, - "y": 840 - }, - "16": { - "customCode": null, - "data": { - "advanced": { - "customName": "format 2", - "customNameId": 0, - "description": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects.", - "join": [], - "note": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects." - }, - "functionId": 4, - "functionName": "format_2", - "id": "16", - "parameters": [ - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" - ], - "template": "SOAR analyzed Domain using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| Domain | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", - "type": "format" - }, - "errors": {}, - "id": "16", - "type": "format", - "userCode": null, - "warnings": {}, - "x": 980, - "y": 1160 - }, - "17": { - "data": { - "advanced": { - "customName": "format 1", - "customNameId": 0, - "description": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects.", - "join": [], - "note": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects." - }, - "functionId": 5, - "functionName": "format_1", - "id": "17", - "parameters": [ - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" - ], - "template": "SOAR analyzed URL using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| URL | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", - "type": "format" - }, - "errors": {}, - "id": "17", - "type": "format", - "warnings": {}, - "x": 640, - "y": 1160 - }, - "18": { - "data": { - "advanced": { - "customName": "format 3", - "customNameId": 0, - "description": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. ", - "join": [], - "note": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. " - }, - "functionId": 6, - "functionName": "format_3", - "id": "18", - "parameters": [ - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" - ], - "template": "SOAR analyzed IP using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| IP | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", - "type": "format" - }, - "errors": {}, - "id": "18", - "type": "format", - "warnings": {}, - "x": 1320, - "y": 1160 - }, - "2": { - "data": { - "advanced": { - "customName": "input filter", - "customNameId": 0, - "description": "Filter to pass in a url, domain or ip to it's appropriate action", - "join": [], - "note": "Filter to pass in a url, domain or ip to it's appropriate action" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "!=", - "param": "playbook_input:url", - "value": "" - } - ], - "conditionIndex": 0, - "customName": "url", - "logic": "and" - }, - { - "comparisons": [ - { - "conditionIndex": 1, - "op": "!=", - "param": "playbook_input:domain", - "value": "" - } - ], - "conditionIndex": 1, - "customName": "domain", - "logic": "and" - }, - { - "comparisons": [ - { - "conditionIndex": 2, - "op": "!=", - "param": "playbook_input:ip", - "value": "" - } - ], - "conditionIndex": 2, - "customName": "ip", - "logic": "and" - } - ], - "functionId": 1, - "functionName": "input_filter", - "id": "2", - "type": "filter" - }, - "errors": {}, - "id": "2", - "type": "filter", - "warnings": {}, - "x": 1040, - "y": 564.5 - }, - "26": { - "customCode": null, - "data": { - "advanced": { - "customName": "build url output", - "customNameId": 0, - "description": "Generate an observable dictionary to output into the observables data path.", - "join": [], - "note": "Generate an observable dictionary to output into the observables data path." - }, - "functionId": 1, - "functionName": "build_url_output", - "id": "26", - "inputParameters": [ - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" - ], - "outputVariables": [ - "observable_array" - ], - "type": "code" - }, - "errors": {}, - "id": "26", - "type": "code", - "userCode": "\n from urllib.parse import urlparse\n build_url_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for url, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n parsed_url = urlparse(url)\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": url,\n \"type\": \"url\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"attributes\": {\n \"hostname\": parsed_url.hostname,\n \"scheme\": parsed_url.scheme\n },\n \"source\": \"Cisco Talos Intelligence\",\n }\n if parsed_url.path:\n observable_object['attributes']['path'] = parsed_url.path\n if parsed_url.query:\n observable_object['attributes']['query'] = parsed_url.query\n if parsed_url.port:\n observable_object['attributes']['port'] = parsed_url.port\n \n build_url_output__observable_array.append(observable_object)\n\n", - "warnings": {}, - "x": 640, - "y": 1380 - }, - "27": { - "customCode": null, - "data": { - "advanced": { - "customName": "build domain output", - "customNameId": 0, - "description": "Generate an observable dictionary to output into the observables data path.", - "join": [], - "note": "Generate an observable dictionary to output into the observables data path." - }, - "functionId": 2, - "functionName": "build_domain_output", - "id": "27", - "inputParameters": [ - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" - ], - "outputVariables": [ - "observable_array" - ], - "type": "code" - }, - "errors": {}, - "id": "27", - "type": "code", - "userCode": "\n build_domain_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for domain, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": domain,\n \"type\": \"domain\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n build_domain_output__observable_array.append(observable_object)\n\n", - "warnings": {}, - "x": 980, - "y": 1380 - }, - "28": { - "customCode": null, - "data": { - "advanced": { - "customName": "build ip output", - "customNameId": 0, - "description": "Generate an observable dictionary to output into the observables data path.", - "join": [], - "note": "Generate an observable dictionary to output into the observables data path." - }, - "functionId": 3, - "functionName": "build_ip_output", - "id": "28", - "inputParameters": [ - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" - ], - "outputVariables": [ - "observable_array" - ], - "type": "code" - }, - "errors": {}, - "id": "28", - "type": "code", - "userCode": "\n import ipaddress\n build_ip_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for ip, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": ip,\n \"type\": \"ipv4\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n ip_addr = ipaddress.ip_address(ip)\n if isinstance(ip_addr, ipaddress.IPv6Address):\n observable_object[\"type\"] = \"ipv6\"\n\n build_ip_output__observable_array.append(observable_object)\n\n", - "warnings": {}, - "x": 1320, - "y": 1380 - }, - "3": { - "data": { - "action": "url reputation", - "actionType": "investigate", - "advanced": { - "customName": "url reputation", - "customNameId": 0, - "description": "Use Talos to get threat data on an url", - "join": [], - "note": "Use Talos to get threat data on an url" - }, - "connector": "Cisco Talos Intelligence", - "connectorConfigs": [ - "cisco_talos_intelligence" - ], - "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", - "connectorVersion": "v1", - "functionId": 1, - "functionName": "url_reputation", - "id": "3", - "loop": { - "enabled": false, - "exitAfterUnit": "m", - "exitAfterValue": 10, - "exitConditionEnabled": false, - "exitLoopAfter": 2, - "pauseUnit": "m", - "pauseValue": 2 - }, - "parameters": { - "url": "filtered-data:input_filter:condition_1:playbook_input:url" - }, - "requiredParameters": [ - { - "data_type": "string", - "default": "", - "field": "url" - } - ], - "type": "action" - }, - "errors": {}, - "id": "3", - "type": "action", - "warnings": {}, - "x": 640, - "y": 700 - }, - "4": { - "data": { - "action": "domain reputation", - "actionType": "investigate", - "advanced": { - "customName": "domain reputation", - "customNameId": 0, - "description": "Use Talos to get threat data on a domain", - "join": [], - "note": "Use Talos to get threat data on a domain" - }, - "connector": "Cisco Talos Intelligence", - "connectorConfigs": [ - "cisco_talos_intelligence" - ], - "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", - "connectorVersion": "v1", - "functionId": 1, - "functionName": "domain_reputation", - "id": "4", - "loop": { - "enabled": false, - "exitAfterUnit": "m", - "exitAfterValue": 10, - "exitConditionEnabled": false, - "exitLoopAfter": 2, - "pauseUnit": "m", - "pauseValue": 2 - }, - "parameters": { - "domain": "filtered-data:input_filter:condition_2:playbook_input:domain" - }, - "requiredParameters": [ - { - "data_type": "string", - "default": "", - "field": "domain" - } - ], - "type": "action" - }, - "errors": {}, - "id": "4", - "type": "action", - "warnings": {}, - "x": 980, - "y": 700 - }, - "5": { - "data": { - "action": "ip reputation", - "actionType": "investigate", - "advanced": { - "customName": "ip reputation", - "customNameId": 0, - "description": "Use Talos to get threat data on an ip", - "join": [], - "note": "Use Talos to get threat data on an ip" - }, - "connector": "Cisco Talos Intelligence", - "connectorConfigs": [ - "cisco_talos_intelligence" - ], - "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", - "connectorVersion": "v1", - "functionId": 1, - "functionName": "ip_reputation", - "id": "5", - "loop": { - "enabled": false, - "exitAfterUnit": "m", - "exitAfterValue": 10, - "exitConditionEnabled": false, - "exitLoopAfter": 2, - "pauseUnit": "m", - "pauseValue": 2 - }, - "parameters": { - "ip": "filtered-data:input_filter:condition_3:playbook_input:ip" - }, - "requiredParameters": [ - { - "data_type": "string", - "default": "", - "field": "ip" - } - ], - "type": "action" - }, - "errors": {}, - "id": "5", - "type": "action", - "warnings": {}, - "x": 1320, - "y": 700 - }, - "6": { - "data": { - "advanced": { - "customName": "url reputation filter", - "customNameId": 0, - "description": "Exclude failing url reputations", - "join": [], - "note": "Exclude failing url reputations" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "==", - "param": "url_reputation:action_result.status", - "value": "success" - } - ], - "conditionIndex": 0, - "customName": "Success", - "logic": "and" - } - ], - "functionId": 2, - "functionName": "url_reputation_filter", - "id": "6", - "type": "filter" - }, - "errors": {}, - "id": "6", - "type": "filter", - "warnings": {}, - "x": 700, - "y": 840 - } - }, - "notes": "Inputs: url, ip, domain\nInteractions: Cisco Talos Intelligence\nActions: url reputation, ip reputation, domain reputation, file reputation\nOutputs: note, observables" + "blockly": false, + "blockly_xml": "", + "category": "Identifier Reputation Analysis", + "coa": { + "data": { + "description": "Accepts a URL, IP or Domain and does reputation analysis on the objects. Generates a threat level, threat categories and AUP categories that are formatted and added to a container as a note.", + "edges": [ + { + "id": "port_0_to_port_2", + "sourceNode": "0", + "sourcePort": "0_out", + "targetNode": "2", + "targetPort": "2_in" }, - "input_spec": [ + { + "conditions": [ { - "contains": [ - "url" - ], - "description": "A URL provided for reputation analysis", - "name": "url" - }, - { - "contains": [ - "domain" - ], - "description": "A Domain provided for reputation analysis", - "name": "domain" - }, - { - "contains": [ - "ip" - ], - "description": "An IP provided for reputation analysis", - "name": "ip" + "index": 0 } - ], - "output_spec": [ + ], + "id": "port_2_to_port_3", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "3", + "targetPort": "3_in" + }, + { + "conditions": [ { - "contains": [], - "datapaths": [ - "build_url_output:custom_function:observable_array", - "build_domain_output:custom_function:observable_array", - "build_ip_output:custom_function:observable_array" - ], - "deduplicate": false, - "description": "An array of observable dictionaries with value, threat level, threat categories and AUP categories", - "metadata": {}, - "name": "observable" - }, - { - "contains": [], - "datapaths": [ - "format_1:formatted_data", - "format_2:formatted_data", - "format_3:formatted_data" - ], - "deduplicate": false, - "description": "An array of reports. One report per observable type.", - "metadata": {}, - "name": "markdown_report" + "index": 1 } - ], - "playbook_trigger": "artifact_created", - "playbook_type": "data", - "python_version": "3", - "schema": "5.0.15", - "version": "6.3.1.176" + ], + "id": "port_2_to_port_4", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "4", + "targetPort": "4_in" + }, + { + "conditions": [ + { + "index": 2 + } + ], + "id": "port_2_to_port_5", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "5", + "targetPort": "5_in" + }, + { + "id": "port_3_to_port_6", + "sourceNode": "3", + "sourcePort": "3_out", + "targetNode": "6", + "targetPort": "6_in" + }, + { + "id": "port_4_to_port_10", + "sourceNode": "4", + "sourcePort": "4_out", + "targetNode": "10", + "targetPort": "10_in" + }, + { + "id": "port_5_to_port_13", + "sourceNode": "5", + "sourcePort": "5_out", + "targetNode": "13", + "targetPort": "13_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_6_to_port_17", + "sourceNode": "6", + "sourcePort": "6_out", + "targetNode": "17", + "targetPort": "17_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_10_to_port_16", + "sourceNode": "10", + "sourcePort": "10_out", + "targetNode": "16", + "targetPort": "16_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_13_to_port_18", + "sourceNode": "13", + "sourcePort": "13_out", + "targetNode": "18", + "targetPort": "18_in" + }, + { + "id": "port_17_to_port_26", + "sourceNode": "17", + "sourcePort": "17_out", + "targetNode": "26", + "targetPort": "26_in" + }, + { + "id": "port_26_to_port_1", + "sourceNode": "26", + "sourcePort": "26_out", + "targetNode": "1", + "targetPort": "1_in" + }, + { + "id": "port_16_to_port_27", + "sourceNode": "16", + "sourcePort": "16_out", + "targetNode": "27", + "targetPort": "27_in" + }, + { + "id": "port_27_to_port_1", + "sourceNode": "27", + "sourcePort": "27_out", + "targetNode": "1", + "targetPort": "1_in" + }, + { + "id": "port_18_to_port_28", + "sourceNode": "18", + "sourcePort": "18_out", + "targetNode": "28", + "targetPort": "28_in" + }, + { + "id": "port_28_to_port_1", + "sourceNode": "28", + "sourcePort": "28_out", + "targetNode": "1", + "targetPort": "1_in" + } + ], + "hash": "eba6b9d077093e83e07346cba73e6ed0a16e86ea", + "nodes": { + "0": { + "data": { + "advanced": { + "join": [] + }, + "functionName": "on_start", + "id": "0", + "type": "start" + }, + "errors": {}, + "id": "0", + "type": "start", + "warnings": {}, + "x": 1000, + "y": 419.9999999999985 + }, + "1": { + "data": { + "advanced": { + "join": [] + }, + "functionName": "on_finish", + "id": "1", + "type": "end" + }, + "errors": {}, + "id": "1", + "type": "end", + "warnings": {}, + "x": 1000, + "y": 1520 + }, + "10": { + "data": { + "advanced": { + "customName": "domain reputation filter", + "customNameId": 0, + "description": "Exclude failing domain reputations", + "join": [], + "note": "Exclude failing domain reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "domain_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 3, + "functionName": "domain_reputation_filter", + "id": "10", + "type": "filter" + }, + "errors": {}, + "id": "10", + "type": "filter", + "warnings": {}, + "x": 1040, + "y": 840 + }, + "13": { + "data": { + "advanced": { + "customName": "ip reputation filter", + "customNameId": 0, + "description": "Exclude failing ip reputations", + "join": [], + "note": "Exclude failing ip reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "ip_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 4, + "functionName": "ip_reputation_filter", + "id": "13", + "type": "filter" + }, + "errors": {}, + "id": "13", + "type": "filter", + "warnings": {}, + "x": 1380, + "y": 840 + }, + "16": { + "customCode": null, + "data": { + "advanced": { + "customName": "format 2", + "customNameId": 0, + "description": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects.", + "join": [], + "note": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects." + }, + "functionId": 4, + "functionName": "format_2", + "id": "16", + "parameters": [ + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed Domain using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| Domain | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "16", + "type": "format", + "userCode": null, + "warnings": {}, + "x": 980, + "y": 1160 + }, + "17": { + "data": { + "advanced": { + "customName": "format 1", + "customNameId": 0, + "description": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects.", + "join": [], + "note": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects." + }, + "functionId": 5, + "functionName": "format_1", + "id": "17", + "parameters": [ + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed URL using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| URL | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "17", + "type": "format", + "warnings": {}, + "x": 640, + "y": 1160 + }, + "18": { + "data": { + "advanced": { + "customName": "format 3", + "customNameId": 0, + "description": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. ", + "join": [], + "note": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. " + }, + "functionId": 6, + "functionName": "format_3", + "id": "18", + "parameters": [ + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed IP using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| IP | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "18", + "type": "format", + "warnings": {}, + "x": 1320, + "y": 1160 + }, + "2": { + "data": { + "advanced": { + "customName": "input filter", + "customNameId": 0, + "description": "Filter to pass in a url, domain or ip to it's appropriate action", + "join": [], + "note": "Filter to pass in a url, domain or ip to it's appropriate action" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "!=", + "param": "playbook_input:url", + "value": "" + } + ], + "conditionIndex": 0, + "customName": "url", + "logic": "and" + }, + { + "comparisons": [ + { + "conditionIndex": 1, + "op": "!=", + "param": "playbook_input:domain", + "value": "" + } + ], + "conditionIndex": 1, + "customName": "domain", + "logic": "and" + }, + { + "comparisons": [ + { + "conditionIndex": 2, + "op": "!=", + "param": "playbook_input:ip", + "value": "" + } + ], + "conditionIndex": 2, + "customName": "ip", + "logic": "and" + } + ], + "functionId": 1, + "functionName": "input_filter", + "id": "2", + "type": "filter" + }, + "errors": {}, + "id": "2", + "type": "filter", + "warnings": {}, + "x": 1040, + "y": 564.5 + }, + "26": { + "customCode": null, + "data": { + "advanced": { + "customName": "build url output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 1, + "functionName": "build_url_output", + "id": "26", + "inputParameters": [ + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "26", + "type": "code", + "userCode": "\n from urllib.parse import urlparse\n build_url_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for url, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n parsed_url = urlparse(url)\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": url,\n \"type\": \"url\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"attributes\": {\n \"hostname\": parsed_url.hostname,\n \"scheme\": parsed_url.scheme\n },\n \"source\": \"Cisco Talos Intelligence\",\n }\n if parsed_url.path:\n observable_object['attributes']['path'] = parsed_url.path\n if parsed_url.query:\n observable_object['attributes']['query'] = parsed_url.query\n if parsed_url.port:\n observable_object['attributes']['port'] = parsed_url.port\n \n build_url_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 640, + "y": 1380 + }, + "27": { + "customCode": null, + "data": { + "advanced": { + "customName": "build domain output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 2, + "functionName": "build_domain_output", + "id": "27", + "inputParameters": [ + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "27", + "type": "code", + "userCode": "\n build_domain_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for domain, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": domain,\n \"type\": \"domain\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n build_domain_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 980, + "y": 1380 + }, + "28": { + "customCode": null, + "data": { + "advanced": { + "customName": "build ip output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 3, + "functionName": "build_ip_output", + "id": "28", + "inputParameters": [ + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "28", + "type": "code", + "userCode": "\n import ipaddress\n build_ip_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for ip, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": ip,\n \"type\": \"ipv4\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n ip_addr = ipaddress.ip_address(ip)\n if isinstance(ip_addr, ipaddress.IPv6Address):\n observable_object[\"type\"] = \"ipv6\"\n\n build_ip_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 1320, + "y": 1380 + }, + "3": { + "data": { + "action": "url reputation", + "actionType": "investigate", + "advanced": { + "customName": "url reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on an url", + "join": [], + "note": "Use Talos to get threat data on an url" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "url_reputation", + "id": "3", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "url": "filtered-data:input_filter:condition_1:playbook_input:url" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "url" + } + ], + "type": "action" + }, + "errors": {}, + "id": "3", + "type": "action", + "warnings": {}, + "x": 640, + "y": 700 + }, + "4": { + "data": { + "action": "domain reputation", + "actionType": "investigate", + "advanced": { + "customName": "domain reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on a domain", + "join": [], + "note": "Use Talos to get threat data on a domain" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "domain_reputation", + "id": "4", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "domain": "filtered-data:input_filter:condition_2:playbook_input:domain" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "domain" + } + ], + "type": "action" + }, + "errors": {}, + "id": "4", + "type": "action", + "warnings": {}, + "x": 980, + "y": 700 + }, + "5": { + "data": { + "action": "ip reputation", + "actionType": "investigate", + "advanced": { + "customName": "ip reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on an ip", + "join": [], + "note": "Use Talos to get threat data on an ip" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "ip_reputation", + "id": "5", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "ip": "filtered-data:input_filter:condition_3:playbook_input:ip" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "ip" + } + ], + "type": "action" + }, + "errors": {}, + "id": "5", + "type": "action", + "warnings": {}, + "x": 1320, + "y": 700 + }, + "6": { + "data": { + "advanced": { + "customName": "url reputation filter", + "customNameId": 0, + "description": "Exclude failing url reputations", + "join": [], + "note": "Exclude failing url reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "url_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 2, + "functionName": "url_reputation_filter", + "id": "6", + "type": "filter" + }, + "errors": {}, + "id": "6", + "type": "filter", + "warnings": {}, + "x": 700, + "y": 840 + } + }, + "notes": "Inputs: url, ip, domain\nInteractions: Cisco Talos Intelligence\nActions: url reputation, ip reputation, domain reputation, file reputation\nOutputs: note, observables" }, - "create_time": "2024-12-11T22:12:36.759275+00:00", - "draft_mode": false, - "labels": [ - "*" + "input_spec": [ + { + "contains": [ + "url" + ], + "description": "A URL provided for reputation analysis", + "name": "url" + }, + { + "contains": [ + "domain" + ], + "description": "A Domain provided for reputation analysis", + "name": "domain" + }, + { + "contains": [ + "ip" + ], + "description": "An IP provided for reputation analysis", + "name": "ip" + } ], - "tags": [ - "reputation", - "url", - "ip", - "domain", - "Cisco Talos Intelligence" - ] -} \ No newline at end of file + "output_spec": [ + { + "contains": [], + "datapaths": [ + "build_url_output:custom_function:observable_array", + "build_domain_output:custom_function:observable_array", + "build_ip_output:custom_function:observable_array" + ], + "deduplicate": false, + "description": "An array of observable dictionaries with value, threat level, threat categories and AUP categories", + "metadata": {}, + "name": "observable" + }, + { + "contains": [], + "datapaths": [ + "format_1:formatted_data", + "format_2:formatted_data", + "format_3:formatted_data" + ], + "deduplicate": false, + "description": "An array of reports. One report per observable type.", + "metadata": {}, + "name": "markdown_report" + } + ], + "playbook_trigger": "artifact_created", + "playbook_type": "data", + "python_version": "3", + "schema": "5.0.15", + "version": "6.3.1.176" + }, + "create_time": "2024-12-11T22:12:36.759275+00:00", + "draft_mode": false, + "labels": [ + "*" + ], + "tags": [ + "reputation", + "url", + "ip", + "domain", + "Cisco Talos Intelligence" + ] +} diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml index de5b0d3276..a66cd2fd49 100644 --- a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml +++ b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml @@ -5,7 +5,7 @@ date: '2025-01-17' author: Kelby Shelton, Tapish Jain, Splunk type: Investigation description: "Accepts a URL, IP or Domain and provides intelligence on the objects. Generates a per observable report that includes the objects threat level, threat categories, acceptable use categories and score." -playbook: Cisco_Talos_Intelligence_Identifier_Reputation_Analysis +playbook: CiscoTalosIntelligence_Identifier_Reputation_Analysis how_to_implement: This input playbook requires the Cisco Talos Intelligence connector to be configured and a Splunk SOAR cloud license. references: - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/