diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index ef48bc9c3b..6f2e31b762 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -67,6 +67,7 @@ tags: mitre_attack_id: - T1505 - T1505.003 + - T1190 observable: - name: user type: User diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml new file mode 100644 index 0000000000..1172a5018a --- /dev/null +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -0,0 +1,69 @@ +name: Linux File Creation In Init Boot Directory +id: 97d9cfb2-61ad-11ec-bb2d-acde48001122 +version: 1 +date: '2021-12-20' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for suspicious file creation on init system directories + for automatic execution of script or file upon boot up. This technique is commonly + abuse by adversaries, malware author and red teamer to persist on the targeted or + compromised host. This behavior can be executed or use by an administrator or network + operator to add script files or binary files as part of a task or automation. + filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/init.d/*", + "*/etc/rc.d/*", "*/sbin/init.d/*", "*/etc/rc.local*") by Filesystem.dest Filesystem.file_name + Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_file_creation_in_init_boot_directory_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the file name, file path, and process_guid executions from your endpoints. + If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase +known_false_positives: Administrator or network operator can create file in this folders + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1037.004 + - T1037 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A file $file_name$ is created in $file_path$ on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_file_creation_in_profile_directory.yml b/detections/endpoint/linux_file_creation_in_profile_directory.yml new file mode 100644 index 0000000000..f9acf157ab --- /dev/null +++ b/detections/endpoint/linux_file_creation_in_profile_directory.yml @@ -0,0 +1,70 @@ +name: Linux File Creation In Profile Directory +id: 46ba0082-61af-11ec-9826-acde48001122 +version: 1 +date: '2021-12-20' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for suspicious file creation in /etc/profile.d directory + to automatically execute scripts by shell upon boot up of a linux machine. This technique is + commonly abused by adversaries, malware and red teamers as a persistence mechanism + to the targeted or compromised host. This Anomaly detection is a good indicator + that someone wants to run a code after boot up which can be done also by the administrator + or network operator for automation purposes. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/profile.d/*") + by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid + Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `linux_file_creation_in_profile_directory_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the file name, file path, and process_guid executions from your endpoints. + If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can create file in profile.d + folders for automation purposes. Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1546/004/ +- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1546.004 + - T1546 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + security_domain: endpoint + impact: 70 + confidence: 80 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A file $file_name$ is created in $file_path$ on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml new file mode 100644 index 0000000000..c388df7347 --- /dev/null +++ b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml @@ -0,0 +1,76 @@ +name: Linux Service File Created In Systemd Directory +id: c7495048-61b6-11ec-9a37-acde48001122 +version: 1 +date: '2021-12-20' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for suspicious file creation in systemd timer directory + in linux platform. systemd is a system and service manager for Linux distributions. + From the Windows perspective, this process fulfills the duties of wininit.exe and + services.exe combined. At the risk of simplifying the functionality of systemd, + it initializes a Linux system and starts relevant services that are defined in service + unit files. Adversaries, malware and red teamers may abuse this this feature by + stashing systemd service file to persist on the targetted or compromised host. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name = *.service + Filesystem.file_path IN ("*/etc/systemd/system*", "*/lib/systemd/system*", "*/usr/lib/systemd/system*", + "*/run/systemd/system*", "*~/.config/systemd/*", "*~/.local/share/systemd/*","*/etc/systemd/user*", + "*/lib/systemd/user*", "*/usr/lib/systemd/user*", "*/run/systemd/user*") by Filesystem.dest + Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `linux_service_file_created_in_systemd_directory_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the file name, file path, and process_guid executions from your endpoints. + If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can create file in systemd + folders for automation purposes. Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1053/006/ +- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ +- https://redcanary.com/blog/attck-t1501-understanding-systemd-service-persistence/ +- https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.006 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + security_domain: endpoint + impact: 80 + confidence: 80 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A service file named as $file_path$ is created in systemd folder on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml new file mode 100644 index 0000000000..601ea035f9 --- /dev/null +++ b/detections/endpoint/linux_service_restarted.yml @@ -0,0 +1,76 @@ +name: Linux Service Restarted +id: 084275ba-61b8-11ec-8d64-acde48001122 +version: 1 +date: '2021-12-20' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for restarted or re-enable services in linux platform. + This technique can be executed or performed using systemctl or service tool application. + Adversaries may create or modify Windows services to repeatedly execute malicious + payloads as part of persistence. When Windows boots up, it starts programs or applications + called services that perform background system functions. Administrator may also + create a legitimated service for a specific tool or normal application as part of + task or automation, in this scenario it is suggested to look for the service path + of the actual script or executable that register as service and who created the + service for further verification. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl", + "service") OR Processes.process IN ("*systemctl *", "*service *")) Processes.process + IN ("*restart*", "*reload*", "*reenable*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_service_restarted_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and commandline executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can use this commandline + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1543/003/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.006 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may create or start a service on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_service_started_or_enabled.yml b/detections/endpoint/linux_service_started_or_enabled.yml new file mode 100644 index 0000000000..3170d48284 --- /dev/null +++ b/detections/endpoint/linux_service_started_or_enabled.yml @@ -0,0 +1,76 @@ +name: Linux Service Started Or Enabled +id: e0428212-61b7-11ec-88a3-acde48001122 +version: 1 +date: '2021-12-20' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for created or enable services in linux platform. + This technique can be executed or performed using systemctl or service tool application. + Adversaries may create or modify Windows services to repeatedly execute malicious + payloads as part of persistence. When Windows boots up, it starts programs or applications + called services that perform background system functions. Administrator may also + create a legitimated service for a specific tool or normal application as part of + task or automation, in this scenario it is suggested to look for the service path + of the actual script or executable that register as service and who created the + service for further verification. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl", + "service") OR Processes.process IN ("*systemctl *", "*service *")) Processes.process + IN ("* start *", "* enable *") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_service_started_or_enabled_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can use this commandline + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1543/003/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.006 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 60 + confidence: 70 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: a commandline $process$ that may create or start a service on $dest + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml new file mode 100644 index 0000000000..f7d5fd506e --- /dev/null +++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml @@ -0,0 +1,75 @@ +name: Linux Setuid Using Chmod Utility +id: bf0304b6-6250-11ec-9d7c-acde48001122 +version: 1 +date: '2021-12-21' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for suspicious chmod utility execution to enable + SUID bit. This allows a user to temporarily gain root access, usually in order to + run a program. For example, only the root account is allowed to change the password + information contained in the password database; If the SUID bit appears as an s, + the file's owner also has execute permission to the file; if it appears as an S, + the file's owner does not have execute permission. The second specialty permission + is the SGID, or set group id bit. It is similar to the SUID bit, except it can temporarily + change group membership, usually to execute a program. The SGID bit is set if an + s or an S appears in the group section of permissions. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes WHERE (Processes.process_name = chmod + OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *", + "* 4777 *", "* 4577 *") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_setuid_using_chmod_utility_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. +references: +- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.001 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: a commandline $process$ that may set suid or sgid on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml new file mode 100644 index 0000000000..e39fc9f1ad --- /dev/null +++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml @@ -0,0 +1,77 @@ +name: Linux Setuid Using Setcap Utility +id: 9d96022e-6250-11ec-9a19-acde48001122 +version: 1 +date: '2021-12-21' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for suspicious setcap utility execution to enable + SUID bit. This allows a user to temporarily gain root access, usually in order to + run a program. For example, only the root account is allowed to change the password + information contained in the password database; If the SUID bit appears as an s, + the file's owner also has execute permission to the file; if it appears as an S, + the file's owner does not have execute permission. The second specialty permission + is the SGID, or set group id bit. It is similar to the SUID bit, except it can temporarily + change group membership, usually to execute a program. The SGID bit is set if an + s or an S appears in the group section of permissions. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = setcap + OR Processes.process = "*setcap *") AND Processes.process IN ("* cap_setuid=ep *", + "* cap_setuid+ep *", "* cap_net_bind_service+p *", "* cap_net_raw+ep *", "* cap_dac_read_search+ep + *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_setuid_using_setcap_utility_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_setcap/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.001 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may set suid or sgid on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml new file mode 100644 index 0000000000..cebbcc8ebe --- /dev/null +++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml @@ -0,0 +1,79 @@ +name: MSI Module Loaded by Non-System Binary +id: ccb98a66-5851-11ec-b91c-acde48001122 +version: 1 +date: '2021-12-08' +author: Michael Haag, Splunk +type: Hunting +datamodel: [] +description: 'The following hunting analytic identifies `msi.dll` being loaded by a binary not located in `system32`, `syswow64`, `winsxs` or `windows` paths. This behavior is most recently related to InstallerFileTakeOver, or CVE-2021-41379, and DLL side-loading. + CVE-2021-41379 requires a binary to be dropped and `msi.dll` to be loaded by it. To Successful exploitation of this issue happens in four parts \ + + 1. Generation of an MSI that will trigger bad behavior. \ + + 1. Preparing a directory for MSI installation. \ + + 1. Inducing an error state. \ + + 1. Racing to introduce a junction and a symlink to trick msiexec.exe to modify the attacker specified file. \ + + In addition, `msi.dll` has been abused in DLL side-loading attacks by being loaded by non-system binaries.' +search: '`sysmon` EventCode=7 ImageLoaded="*\\msi.dll" NOT (Image IN ("*\\System32\\*","*\\syswow64\\*","*\\windows\\*", "*\\winsxs\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime + by Image ImageLoaded process_name Computer EventCode ProcessId + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `msi_module_loaded_by_non_system_binary_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and imageloaded executions from your endpoints. If you + are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: It is possible some Administrative utilities will load msi.dll outside of normal system paths, filter as needed. +references: + - https://attackerkb.com/topics/7LstI2clmF/cve-2021-41379/rapid7-analysis + - https://github.com/klinix5/InstallerFileTakeOver + - https://github.com/mandiant/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/msi.dll%20Hijack%20(Methodology).ioc +cve: + - CVE-2021-41379 +tags: + analytic_story: + - Windows Privilege Escalation + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1574.002 + - T1574 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - ImageLoaded + - process_name + - Computer + - EventCode + - ProcessId + security_domain: endpoint + impact: 80 + confidence: 70 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The following module $ImageLoaded$ was loaded by $Image$ outside of the normal system paths on endpoint $Computer$, potentally related to DLL side-loading. + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: ImageLoaded + type: Other + role: + - Other + - name: process_name + type: Process + role: + - Child Process + \ No newline at end of file diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index 13d606a8f9..40e55b9dc5 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -28,8 +28,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. known_false_positives: network admin can resize the shadowstorage for valid purposes. references: -- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html + - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html + - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md + - https://redcanary.com/blog/blackbyte-ransomware/ + - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-resize-shadowstorage tags: analytic_story: - Clop Ransomware diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml new file mode 100644 index 0000000000..17df9c7817 --- /dev/null +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -0,0 +1,81 @@ +name: Windows DISM Remove Defender +id: 8567da9e-47f0-11ec-99a9-acde48001122 +version: 1 +date: '2021-11-17' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the use of the Windows Disk Image Utility, + `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable + Defender before completing their objective. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dism.exe + (Processes.process="*/online*" AND Processes.process="*/disable-feature*" AND Processes.process="*Windows-Defender*" + AND Processes.process="*/remove*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_dism_remove_defender_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Some legitimate administrative tools leverage `dism.exe` to + manipulate packages and features of the operating system. Filter as needed. +references: +- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: access + impact: 80 + confidence: 100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to disable Windows Defender. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + automated_detection_testing: passed diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml new file mode 100644 index 0000000000..623a9a5afb --- /dev/null +++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml @@ -0,0 +1,81 @@ +name: Windows Raccine Scheduled Task Deletion +id: c9f010da-57ab-11ec-82bd-acde48001122 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the Raccine Rules Updater scheduled + task being deleted. Adversaries may attempt to remove this task in order to prevent + the update of Raccine. Raccine is a "ransomware vaccine" created by security researcher + Florian Roth, designed to intercept and prevent precursors and active ransomware + behavior. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe + Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited, however filter as needed. +references: +- https://redcanary.com/blog/blackbyte-ransomware/ +- https://github.com/Neo23x0/Raccine +tags: + analytic_story: + - Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + automated_detection_testing: passed diff --git a/detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml b/detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml new file mode 100644 index 0000000000..c41f9440b6 --- /dev/null +++ b/detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml @@ -0,0 +1,100 @@ +name: Microsoft Exchange Mailbox Replication service writing Active Server Pages +id: 985f322c-57a5-11ec-b9ac-acde48001122 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following query identifies suspicious .aspx created in 3 paths identified + by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM + group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, + `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. The analytic is limited to process name MSExchangeMailboxReplication.exe, which typically does not write .aspx files to disk. + Upon triage, the suspicious + .aspx file will likely look obvious on the surface. inspect the contents for script + code inside. Identify additional log sources, IIS included, to review source and + other potential exploitation. It is often the case that a particular threat is only + applicable to a specific subset of systems in your environment. Typically analytics + to detect those threats are written without the benefit of being able to only target + those systems as well. Writing analytics against all systems when those behaviors + are limited to identifiable subsets of those systems is suboptimal. Consider the + case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, + a hunter can limit their analytics to systems that have been identified as Exchange + servers. A hunter may start with the theory that the exchange server is communicating + with new systems that it has not previously. If this theory is run against all publicly + facing systems, the amount of noise it will generate will likely render this theory + untenable. However, using the asset information to limit this analytic to just the + Exchange servers will reduce the noise allowing the hunter to focus only on the + systems where this behavioral change is relevant.' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=MSExchangeMailboxReplication.exe by _time span=1h Processes.process_id Processes.process_name Processes.process_guid + Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| + tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", + "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time + file_name file_path process_name process_path process process_guid] | dedup file_create_time + | table dest file_create_time, file_name, file_path, process_name | `microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` + node. +known_false_positives: The query is structured in a way that `action` (read, create) + is not defined. Review the results of this query, filter, and tune as necessary. + It may be necessary to generate this query specific to your endpoint product. +references: + - https://redcanary.com/blog/blackbyte-ransomware/ +tags: + analytic_story: + - ProxyShell + - Ransomware + confidence: 90 + context: + - Source:Endpoint + - Stage:Exploitation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: A file - $file_name$ was written to disk that is related to IIS exploitation + related to ProxyShell. Review further file modifications on endpoint + $dest$ by user $user$. + mitre_attack_id: + - T1505 + - T1505.003 + - T1190 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: file_name + type: File Name + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_path + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.file_hash + - Filesystem.user + - Filesystem.process_guid + - Processes.process_name + - Processes.process_id + - Processes.process_name + - Processes.process_guid + risk_score: 81 + security_domain: endpoint + + \ No newline at end of file diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index f4eb63a047..816596c7b9 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -60,8 +60,8 @@ sidebar: | [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP | | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP | | [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP | | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP | | [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | TTP | | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | diff --git a/docs/_pages/playbooks.md b/docs/_pages/playbooks.md index d0354aa223..eb535f5e60 100644 --- a/docs/_pages/playbooks.md +++ b/docs/_pages/playbooks.md @@ -11,8 +11,10 @@ sidebar: | Name | Detections | Type | | --------| ---------- | ----------- | | [Active Directory Reset password](/playbooks/active_directory_reset_password/)| None | Response | +| [Block Indicators](/playbooks/block_indicators/)| None | Response | | [Crowdstrike Malware Triage](/playbooks/crowdstrike_malware_triage/)| None | Response | | [Delete Detected Files](/playbooks/delete_detected_files/)|[Executable File Written in Administrative SMB Share](/endpoint/executable_file_written_in_administrative_smb_share/)| Response | +| [Email Notification for Malware](/playbooks/email_notification_for_malware/)| None | Response | | [Internal Host SSH Investigate](/playbooks/internal_host_ssh_investigate/)| None | Investigation | | [Internal Host SSH Log4j Investigate](/playbooks/internal_host_ssh_log4j_investigate/)| None | Investigation | | [Internal Host SSH Log4j Response](/playbooks/internal_host_ssh_log4j_response/)| None | Response | @@ -22,6 +24,7 @@ sidebar: | [Log4j Investigate](/playbooks/log4j_investigate/)|[Curl Download and Bash Execution](/endpoint/curl_download_and_bash_execution/)[Wget Download and Bash Execution](/endpoint/wget_download_and_bash_execution/)[Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/)[Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/)[Outbound Network Connection from Java Using Default Ports](/endpoint/outbound_network_connection_from_java_using_default_ports/)[Log4Shell JNDI Payload Injection Attempt](/web/log4shell_jndi_payload_injection_attempt/)[Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/)[Detect Outbound LDAP Traffic](/network/detect_outbound_ldap_traffic/)| Investigate | | [Log4j Respond](/playbooks/log4j_respond/)|[Curl Download and Bash Execution](/endpoint/curl_download_and_bash_execution/)[Wget Download and Bash Execution](/endpoint/wget_download_and_bash_execution/)[Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/)[Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/)[Outbound Network Connection from Java Using Default Ports](/endpoint/outbound_network_connection_from_java_using_default_ports/)[Log4Shell JNDI Payload Injection Attempt](/web/log4shell_jndi_payload_injection_attempt/)[Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/)[Detect Outbound LDAP Traffic](/network/detect_outbound_ldap_traffic/)| Response | | [Log4j Splunk Investigation](/playbooks/log4j_splunk_investigation/)| None | Investigation | +| [Malware Hunt and Contain](/playbooks/malware_hunt_and_contain/)| None | Response | | [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter](/endpoint/conti_common_exec_parameter/)| Response | | [Risk Notable Block Indicators](/playbooks/risk_notable_block_indicators/)| None | Response | | [Risk Notable Enrich](/playbooks/risk_notable_enrich/)| None | Investigation | diff --git a/docs/_playbooks/block_indicators.md b/docs/_playbooks/block_indicators.md new file mode 100644 index 0000000000..0e781251b7 --- /dev/null +++ b/docs/_playbooks/block_indicators.md @@ -0,0 +1,46 @@ +--- +title: "Block Indicators" +last_modified_at: 2021-01-21 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - Palo Alto Networks Firewall + - CarbonBlack Response + - OpenDNS Umbrella +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [Palo Alto Networks Firewall](https://splunkbase.splunk.com/apps/#/search/Palo Alto Networks Firewall/product/soar), [CarbonBlack Response](https://splunkbase.splunk.com/apps/#/search/CarbonBlack Response/product/soar), [OpenDNS Umbrella](https://splunkbase.splunk.com/apps/#/search/OpenDNS Umbrella/product/soar) +- **Last Updated**: 2021-01-21 +- **Author**: Philip Royer, Splunk +- **ID**: fc0edc76-ff2b-48b0-5f6f-63da6783fd63 + +#### Associated Detections + + +#### How To Implement +This playbook uses the following custom lists: ip_address_blocklist, domain_blocklist, filehash_blocklist. This playbook provides an easy, automated, and straightforward solution to maintaining up-to-date IP address, file, and domain blocklists. The playbook looks for any of the required CEF fields within the container. The CEF value is then cross-referenced with their respective Custom Lists. IP addresses are blocked on a Firewall, while domains are blocked using a blocklist service. The blocking of these two will prevent access to the IOCs. Finally, file hashes are blocked using an endpoint protection service, which will prevent the process from running on affected endpoints within a network. After the IOCs are blocked using various apps, they are added to their respective custom lists as to maintain a running blocklist record. + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/block_indicators.png) + +#### Required field +* destinationDnsDomain +* destinationAddress +* fileHash + + +#### Reference + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/block_indicators.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/email_notification_for_malware.md b/docs/_playbooks/email_notification_for_malware.md new file mode 100644 index 0000000000..ebd1df6037 --- /dev/null +++ b/docs/_playbooks/email_notification_for_malware.md @@ -0,0 +1,46 @@ +--- +title: "Email Notification for Malware" +last_modified_at: 2021-01-19 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - VirusTotal + - WildFire + - CarbonBlack Response + - SMTP +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [VirusTotal](https://splunkbase.splunk.com/apps/#/search/VirusTotal/product/soar), [WildFire](https://splunkbase.splunk.com/apps/#/search/WildFire/product/soar), [CarbonBlack Response](https://splunkbase.splunk.com/apps/#/search/CarbonBlack Response/product/soar), [SMTP](https://splunkbase.splunk.com/apps/#/search/SMTP/product/soar) +- **Last Updated**: 2021-01-19 +- **Author**: Philip Royer, Splunk +- **ID**: fb3edc76-ff2b-48b0-5f6f-63da6483fd63 + +#### Associated Detections + + +#### How To Implement +Be sure to update asset naming to reflect the asset names configured in your environment. + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/email_notification_for_malware.png) + +#### Required field +* fileHash +* vaultId + + +#### Reference + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/email_notification_for_malware.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/malware_hunt_and_contain.md b/docs/_playbooks/malware_hunt_and_contain.md new file mode 100644 index 0000000000..affcc75d0e --- /dev/null +++ b/docs/_playbooks/malware_hunt_and_contain.md @@ -0,0 +1,45 @@ +--- +title: "Malware Hunt and Contain" +last_modified_at: 2021-01-21 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - LDAP + - ServiceNow + - CarbonBlack Response + - VirusTotal +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook investigates and remediates malware infections on the endpoint. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [LDAP](https://splunkbase.splunk.com/apps/#/search/LDAP/product/soar), [ServiceNow](https://splunkbase.splunk.com/apps/#/search/ServiceNow/product/soar), [CarbonBlack Response](https://splunkbase.splunk.com/apps/#/search/CarbonBlack Response/product/soar), [VirusTotal](https://splunkbase.splunk.com/apps/#/search/VirusTotal/product/soar) +- **Last Updated**: 2021-01-21 +- **Author**: Philip Royer, Splunk +- **ID**: fb3edc76-ff2b-43c0-5f6f-63da4483fd63 + +#### Associated Detections + + +#### How To Implement +Be sure to update asset naming to reflect the asset names configured in your environment. + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/malware_hunt_and_contain.png) + +#### Required field +* fileHash + + +#### Reference + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/malware_hunt_and_contain.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md index 5a5c0b0274..8af72e4340 100644 --- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md +++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md @@ -25,7 +25,7 @@ tags: #### Description -DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, registering or loading dynwrapx.dll to a host highly suspect. Why is it needed? In most malicious instances, During triage, review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. +DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, registering or loading dynwrapx.dll to a host is highly suspicious. In most instances when it is used maliciously, the best way to triage is to review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This detection will return and identify the processes that invoke vbs/wscript/cscript. - **Type**: TTP - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud @@ -58,7 +58,7 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win #### How To Implement -To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. #### Required field * _time diff --git a/docs/_posts/2021-11-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2021-11-18-suspicious_process_dns_query_known_abuse_web_services.md index 449de0ca88..4a1007c03f 100644 --- a/docs/_posts/2021-11-18-suspicious_process_dns_query_known_abuse_web_services.md +++ b/docs/_posts/2021-11-18-suspicious_process_dns_query_known_abuse_web_services.md @@ -23,7 +23,7 @@ tags: #### Description -This analytic is to detect a suspicious process having a dns query on known abuse text paste web services, or VoIP, instant messaging and digital distribution platform to download some files. This technique is abused by adversaries, malware attacker and red team to download a malicious file on the target host. This is a good TTP indicator for possible initial access technique. Noise and false positive can be seen if the following instant messaging is allowed or common application in corporate network. +This analytic detects a suspicious process making a DNS query via known, abused text-paste web services, VoIP, instant messaging, and digital distribution platforms used to download external files. This technique is abused by adversaries, malware actors, and red teams to download a malicious file on the target host. This is a good TTP indicator for possible initial access techniques. A user will experience false positives if the following instant messaging is allowed or common applications like telegram or discord are allowed in the corporate network. - **Type**: TTP - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud @@ -56,7 +56,7 @@ This analytic is to detect a suspicious process having a dns query on known abus #### How To Implement -his detection relies on sysmon logs with the Event ID 7, Driver loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query. We suggest to run this detection at least once a day over the last 14 days. +This detection relies on sysmon logs with the Event ID 22, DNS Query. We suggest you run this detection at least once a day over the last 14 days. #### Required field * _time @@ -73,7 +73,7 @@ his detection relies on sysmon logs with the Event ID 7, Driver loaded. Please t #### Known False Positives -Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. filter is needed. +Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed. #### RBA diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md index 2f58ddb93b..4c8de317fe 100644 --- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md +++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md @@ -21,7 +21,7 @@ tags: #### Description -This analytic is to detect a suspicious dxdiag.exe process commandline can collect system info of the target host. This technique was seen in remcos, adversaries and other malware to collect information as part of recon or collection phase of attack. Even this behavior is rarely seen in a corporate network this commandline can be used by network administrator to audit host machine specification. Better to check what it did after it pipes out the result to a file for further processing. +This analytic is to detect a suspicious dxdiag.exe process command-line execution. Dxdiag is used to collect the system info of the target host. This technique has been used by Remcos RATS, various actors, and other malware to collect information as part of the recon or collection phase of an attack. This behavior should rarely be seen in a corporate network, but this command line can be used by a network administrator to audit host machine specifications. Thus in some rare cases, this detection will contain false positives in its results. To triage further, analyze what commands were passed after it pipes out the result to a file for further processing. - **Type**: Hunting - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud @@ -75,7 +75,7 @@ To successfully implement this search you need to be ingesting information on pr #### Known False Positives -this commandline can be used by network administrator to audit host machine specification.filter is needed. +This commandline can be used by a network administrator to audit host machine specifications. Thus, a filter is needed. #### RBA diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md index f1c868f3ab..07637bd0aa 100644 --- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md +++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md @@ -23,7 +23,7 @@ tags: #### Description -This analytic will detect a suspicious process contains a commandline parameter related to web browser credential dumper. This technique was used by Remcos RAT malware where it use the techique of Nirsoft webbrowserpassview.exe application to dump web browser credentials. Remcos use the "/stext" commandline to dump the credential in text format. This Hunting query is good indicator to look further for possible remcos infection within the network or possible compromised host. Since the detections is only base on the parameter command and the possible path where it will drop the text credential information, It may catch normal tools that having same command and behavior. +This analytic will detect if a suspicious process contains a commandline parameter related to a web browser credential dumper. This technique is used by Remcos RAT malware which uses the Nirsoft webbrowserpassview.exe application to dump web browser credentials. Remcos uses the "/stext" command line to dump the credentials in text format. This Hunting query is a good indicator of hosts suffering from possible Remcos RAT infection. Since the hunting query is based on the parameter command and the possible path where it will save the text credential information, it may catch normal tools that are using the same command and behavior. - **Type**: Hunting - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud diff --git a/docs/_stories/credential_dumping.md b/docs/_stories/credential_dumping.md index dc36fe0040..1bae69e6b5 100644 --- a/docs/_stories/credential_dumping.md +++ b/docs/_stories/credential_dumping.md @@ -35,8 +35,8 @@ The detection searches in this Analytic Story monitor access to the Local Securi | Name | Technique | Type | | ----------- | ----------- |--------------| | [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP | | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP | | [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | diff --git a/docs/index.markdown b/docs/index.markdown index 60f02392ab..1f87d60eab 100644 --- a/docs/index.markdown +++ b/docs/index.markdown @@ -28,7 +28,7 @@ feature_row: - image_path: /static/feature_playbooks.png alt: "100% free" title: "Playbooks" - excerpt: "See all **23** sets of steps 🐾 to automatically response to a threat." + excerpt: "See all **26** sets of steps 🐾 to automatically response to a threat." url: "/playbooks" btn_class: "btn--primary" btn_label: "Explore" diff --git a/playbooks/block_indicators.json b/playbooks/block_indicators.json new file mode 100644 index 0000000000..db7387542f --- /dev/null +++ b/playbooks/block_indicators.json @@ -0,0 +1,3808 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Use Cases", + "misc": { "apps_list": ["Palo Alto Networks Firewall", "Carbon Black Response", "OpenDNS Umbrella", "Phantom"] }, + "coa": { + "data": { + "clean": true, + "code_block": "", + "description": "This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists.", + "hash": "753b457bfed5fa341dd36803c11b681681df46f6", + "joint": { + "cells": [ + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "70140aee-e625-43c7-bf11-da4d1bc729c1", + "router": { + "name": "metro" + }, + "source": { + "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "81b07a3a-01ac-4d3a-b254-9cb7a3e97392", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 27 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "8f7b00cd-6206-4e1f-a1fd-c17ca7df99d1", + "router": { + "name": "metro" + }, + "source": { + "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "d230871e-ee71-44a6-af7f-fb4f2f584da4", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 43 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d333fcd2-eb73-4914-8e92-ad8551a6b068", + "router": { + "name": "metro" + }, + "source": { + "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "ea4b2594-8ef5-42a4-8285-125126536531", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 66 + }, + { + "0": "S", + "1": "T", + "2": "A", + "3": "R", + "4": "T", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "ref-x": 33, + "ref-y": 8, + "text": "START" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "ref-x": 13, + "xlink:href": "/inc/coa/img/block_icon_start.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'filter_1' block\n filter_1(container=container)\n\n # call 'filter_2' block\n filter_2(container=container)\n\n # call 'filter_3' block\n filter_3(container=container)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a", + "inPorts": [], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 22, + "line_start": 8, + "name": "", + "notes": "", + "number": 0, + "order": 1, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 180, + "y": 40 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "START", + "type": "coa.StartEnd", + "warn": false, + "z": 95 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "f157b9dd-877a-4fbe-94c7-7709af7c1ceb", + "router": { + "name": "metro" + }, + "source": { + "id": "81b07a3a-01ac-4d3a-b254-9cb7a3e97392", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "9537d314-97d6-484b-ae20-3d9564bab6d6", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 160 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "98116e8f-35f5-4a4d-b09d-f2f254b3f36a", + "router": { + "name": "metro" + }, + "source": { + "id": "9537d314-97d6-484b-ae20-3d9564bab6d6", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7a912b77-6a81-421d-b6f5-d865b3fffd73", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 177 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ea7e5f03-8b63-43f5-a2cb-1adf63b89c88", + "router": { + "name": "metro" + }, + "source": { + "id": "7a912b77-6a81-421d-b6f5-d865b3fffd73", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "08306503-f5d1-4cd0-b32b-90a7670ff1ca", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 190 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "429dcfde-c34b-40f8-9b0b-9614e6f0cb75", + "router": { + "name": "metro" + }, + "source": { + "id": "08306503-f5d1-4cd0-b32b-90a7670ff1ca", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 250 + }, + { + "0": "E", + "1": "N", + "2": "D", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".title": { + "text": "END" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_end.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "add to IP blocklist, add to domain blocklist, add to hash blocklist", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef", + "inPorts": [ + "in" + ], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 297, + "line_start": 284, + "name": "", + "notes": "", + "number": 0, + "order": 14, + "outPorts": [], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1080, + "y": 40 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "END", + "type": "coa.StartEnd", + "warn": false, + "z": 264 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "f19bbeed-6445-4a8c-bc7c-a2171961cf69", + "router": { + "name": "metro" + }, + "source": { + "id": "d230871e-ee71-44a6-af7f-fb4f2f584da4", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7862d46c-23ea-4cda-9ef9-db171fd5ac93", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 277 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "8b252e02-8361-4d12-8663-61c2e8965ed9", + "router": { + "name": "metro" + }, + "source": { + "id": "7862d46c-23ea-4cda-9ef9-db171fd5ac93", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "6ad60d9d-90e4-4515-9931-05f31cc5f87a", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 286 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "fddf6767-1020-4c4e-9178-5bdcc37ef938", + "router": { + "name": "metro" + }, + "source": { + "id": "ea4b2594-8ef5-42a4-8285-125126536531", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "25ad9a87-018a-440b-a48d-3a0bd95226f6", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 288 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ea23ca12-a7c3-40e3-b38c-67a92493b1b8", + "router": { + "name": "metro" + }, + "source": { + "id": "25ad9a87-018a-440b-a48d-3a0bd95226f6", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "45d563b4-3a4a-4cc8-bf1f-dfe4de434928", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 293 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "778389f4-851e-4b64-b5c1-e567e1277660", + "router": { + "name": "metro" + }, + "source": { + "id": "6ad60d9d-90e4-4515-9931-05f31cc5f87a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "1924c418-d049-478e-8cfd-ec94eb22f7c6", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 295 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "a111892b-a198-4573-9271-5f68da45f08d", + "router": { + "name": "metro" + }, + "source": { + "id": "1924c418-d049-478e-8cfd-ec94eb22f7c6", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 297 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "c17d4063-43db-4dc2-9ec2-b9c554f1a1f8", + "router": { + "name": "metro" + }, + "source": { + "id": "45d563b4-3a4a-4cc8-bf1f-dfe4de434928", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "dced0e6a-538a-4d02-800a-5e5c0caf92f7", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 301 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "0b7d5584-b8cd-47e6-8f0b-455358f4b318", + "router": { + "name": "metro" + }, + "source": { + "id": "dced0e6a-538a-4d02-800a-5e5c0caf92f7", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 303 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 1 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.destinationAddress\", \"!=\", \"\"],\n ],\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "81b07a3a-01ac-4d3a-b254-9cb7a3e97392", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 264, + "line_start": 247, + "name": "filter", + "notes": "Filtering on artifacts that have the destinationAddress CEF value populated.", + "number": 1, + "order": 12, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "artifact:*.cef.destinationAddress", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 320, + "y": 20 + }, + "previous_function": "", + "previous_name": "filter_1", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 404 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 3 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.fileHash\", \"!=\", \"\"],\n ],\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_6(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "ea4b2594-8ef5-42a4-8285-125126536531", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 123, + "line_start": 106, + "name": "filter", + "notes": "Filtering on artifacts that have the destinationDnsDomain CEF value populated.", + "number": 3, + "order": 6, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "artifact:*.cef.fileHash", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 320, + "y": 300 + }, + "previous_function": "", + "previous_name": "filter_3", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 412 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 2 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.destinationDnsDomain\", \"!=\", \"\"],\n ],\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_5(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "d230871e-ee71-44a6-af7f-fb4f2f584da4", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 106, + "line_start": 89, + "name": "filter", + "notes": "Filtering on artifacts that have the destinationDnsDomain CEF value populated.", + "number": 2, + "order": 5, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "artifact:*.cef.destinationDnsDomain", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 320, + "y": 160 + }, + "previous_function": "", + "previous_name": "filter_2", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 416 + }, + { + "action": "add listitem", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "create": "True", + "list": "custom_list:domain_blocklist", + "new_row": "block_domain_1:action_result.parameter.domain" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "add listitem", + "actions": [ + "no op", + "update list", + "get action result", + "create container", + "import container", + "export container", + "deflate item", + "add artifact", + "find listitem", + "add listitem", + "find artifacts", + "update artifact tags", + "add note", + "update artifact", + "test connectivity" + ], + "active": true, + "app_name": "Phantom", + "app_version": "3.0.2", + "appid": "deb82aa9-22cc-4675-9cf1-534b8d006eb7", + "asset_name": "phantom", + "config_type": "asset", + "count": 0, + "fields": { + "create": "True", + "list": "custom_list:domain_blocklist", + "new_row": "block_domain_1:action_result.parameter.domain" + }, + "has_app": true, + "id": 16, + "loaded": false, + "missing": false, + "name": "phantom", + "output": [ + { + "column_name": "Status", + "column_order": 0, + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "data_path": "action_result.parameter.create", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.parameter.list", + "data_type": "string", + "example_values": [ + "demo_list" + ] + }, + { + "contains": [ + "*" + ], + "data_path": "action_result.parameter.new_row", + "data_type": "string", + "example_values": [ + "[\"value1\",\"value2\",\"value3\"]" + ] + }, + { + "data_path": "action_result.data.*.failed", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.success", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.server", + "data_type": "string", + "example_values": [ + "https://10.1.1.10" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Server: https://10.1.1.10" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "parameters": { + "create": { + "data_type": "boolean", + "default": false, + "description": "Create list if it does not exist (default: false)", + "key": "create", + "order": 2, + "required": false + }, + "list": { + "data_type": "string", + "default": null, + "description": "Name or ID of a custom list", + "key": "list", + "order": 0, + "required": true + }, + "new_row": { + "contains": [ + "*" + ], + "data_type": "string", + "default": null, + "description": "New Row (string or JSON list)", + "key": "new_row", + "order": 1, + "primary": true, + "required": true + } + }, + "product_name": "Phantom", + "product_vendor": "Phantom", + "targets": "16", + "type": "information" + } + ], + "attrs": { + ".action": { + "text": "add to domain blocklist" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Generic" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def add_to_domain_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_to_domain_blocklist() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'add_to_domain_blocklist' call\n results_data_1 = phantom.collect2(container=container, datapath=['block_domain_1:action_result.parameter.domain', 'block_domain_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'add_to_domain_blocklist' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'list': \"custom_list:domain_blocklist\",\n 'create': True,\n 'new_row': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"add listitem\", parameters=parameters, assets=['phantom'], name=\"add_to_domain_blocklist\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": true, + "connection_name": "block domain", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "add to domain blocklist", + "delay": 0, + "description": "The domain is added to the custom list 'domain_blocklist' in order to prevent the Playbook from attempting to block a domain that has already been blocked.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "1924c418-d049-478e-8cfd-ec94eb22f7c6", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 219, + "line_start": 194, + "message": "Configuring now", + "name": "add listitem", + "notes": "The domain is added to the custom list 'domain_blocklist' in order to prevent the Playbook from attempting to block a domain that has already been blocked.", + "number": 2, + "order": 10, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 160 + }, + "previous_function": "", + "previous_name": "add_to_domain_blocklist", + "required_params": { + "list": true, + "new_row": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Generic", + "type": "coa.Action", + "warn": false, + "z": 421 + }, + { + "action": "block hash", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "comment": "", + "hash": "filtered-data:filter_6:condition_1:artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "comment": "", + "hash": "filtered-data:filter_6:condition_1:artifact:*.cef.fileHash" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "data_path": "action_result.parameter.comment", + "data_type": "string", + "example_values": [ + "Sample comment" + ] + }, + { + "column_name": "Hash", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "180469AE0B239E31DB4C65F02FD70BC1" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Block hash action succeeded. It might take some time for blacklisting to take effect." + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "block hash" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_hash_2() called')\n\n # collect data for 'block_hash_2' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_6:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_6:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'block_hash_2' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'hash': filtered_artifacts_item_1[0],\n 'comment': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], callback=add_to_hash_blocklist, name=\"block_hash_2\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "45d563b4-3a4a-4cc8-bf1f-dfe4de434928", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 67, + "line_start": 45, + "message": "Configuring now", + "name": "block hash", + "notes": "Blocks the hash utilizing the CarbonBlack Response endpoint technology app, preventing the process from running on endpoints utilizing CarbonBlack Response.", + "number": 2, + "order": 3, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 300 + }, + "previous_function": "", + "previous_name": "block_hash_2", + "required_params": { + "hash": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 423 + }, + { + "action": "block domain", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "disable_safeguards": "", + "domain": "filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "disable_safeguards": "", + "domain": "filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "opendns_umbrella", + "output": [ + { + "column_name": "Status", + "column_order": 1, + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.disable_safeguards", + "data_type": "boolean" + }, + { + "column_name": "Domain", + "column_order": 0, + "contains": [ + "domain" + ], + "data_path": "action_result.parameter.domain", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "column_name": "ID", + "column_order": 2, + "data_path": "action_result.data.*.id", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "block domain" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def block_domain_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_domain_1() called')\n\n # collect data for 'block_domain_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain', 'filtered-data:filter_5:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'block_domain_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'domain': filtered_artifacts_item_1[0],\n 'disable_safeguards': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"block domain\", parameters=parameters, assets=['opendns_umbrella'], callback=add_to_domain_blocklist, name=\"block_domain_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "6ad60d9d-90e4-4515-9931-05f31cc5f87a", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 89, + "line_start": 67, + "message": "Configuring now", + "name": "block domain", + "notes": "Blocks a domain utilizing the OpenDNS Umbrella app, preventing endpoints from accessing the domain from within the network.", + "number": 1, + "order": 4, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 160 + }, + "previous_function": "", + "previous_name": "block_domain_1", + "required_params": { + "domain": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 424 + }, + { + "action": "block ip", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "ip": "filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress", + "is_source_address": "", + "vsys": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "ip": "filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress", + "is_source_address": "", + "vsys": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "pan", + "output": [ + { + "column_name": "IP", + "column_order": 0, + "contains": [ + "ip" + ], + "data_path": "action_result.parameter.ip", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.vsys", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.is_source_address", + "data_type": "boolean" + }, + { + "column_name": "Status", + "column_order": 1, + "data_path": "action_result.status", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 2, + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "firewall" + } + ], + "attrs": { + ".action": { + "text": "block ip" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def block_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_ip_1() called')\n\n # collect data for 'block_ip_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress', 'filtered-data:filter_4:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'block_ip_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'ip': filtered_artifacts_item_1[0],\n 'vsys': \"\",\n 'is_source_address': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"block ip\", parameters=parameters, assets=['pan'], callback=add_to_IP_blocklist, name=\"block_ip_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "7a912b77-6a81-421d-b6f5-d865b3fffd73", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 45, + "line_start": 22, + "message": "Configuring now", + "name": "block ip", + "notes": "Blocks the IP as a destination address, utilizing the Palo Alto Networks Firewall app to prevent further access to the IP address as a destination.", + "number": 1, + "order": 2, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 20 + }, + "previous_function": "", + "previous_name": "block_ip_1", + "required_params": { + "ip": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 425 + }, + { + "action": "add listitem", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "create": "True", + "list": "custom_list:filehash_blocklist", + "new_row": "block_hash_2:action_result.parameter.hash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "add listitem", + "actions": [ + "no op", + "update list", + "get action result", + "create container", + "import container", + "export container", + "deflate item", + "add artifact", + "find listitem", + "add listitem", + "find artifacts", + "update artifact tags", + "add note", + "update artifact", + "test connectivity" + ], + "active": true, + "app_name": "Phantom", + "app_version": "3.0.2", + "appid": "deb82aa9-22cc-4675-9cf1-534b8d006eb7", + "asset_name": "phantom", + "config_type": "asset", + "count": 0, + "fields": { + "create": "True", + "list": "custom_list:filehash_blocklist", + "new_row": "block_hash_2:action_result.parameter.hash" + }, + "has_app": true, + "id": 16, + "loaded": false, + "missing": false, + "name": "phantom", + "output": [ + { + "column_name": "Status", + "column_order": 0, + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "data_path": "action_result.parameter.create", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.parameter.list", + "data_type": "string", + "example_values": [ + "demo_list" + ] + }, + { + "contains": [ + "*" + ], + "data_path": "action_result.parameter.new_row", + "data_type": "string", + "example_values": [ + "[\"value1\",\"value2\",\"value3\"]" + ] + }, + { + "data_path": "action_result.data.*.failed", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.success", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.server", + "data_type": "string", + "example_values": [ + "https://10.1.1.10" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Server: https://10.1.1.10" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "parameters": { + "create": { + "data_type": "boolean", + "default": false, + "description": "Create list if it does not exist (default: false)", + "key": "create", + "order": 2, + "required": false + }, + "list": { + "data_type": "string", + "default": null, + "description": "Name or ID of a custom list", + "key": "list", + "order": 0, + "required": true + }, + "new_row": { + "contains": [ + "*" + ], + "data_type": "string", + "default": null, + "description": "New Row (string or JSON list)", + "key": "new_row", + "order": 1, + "primary": true, + "required": true + } + }, + "product_name": "Phantom", + "product_vendor": "Phantom", + "targets": "16", + "type": "information" + } + ], + "attrs": { + ".action": { + "text": "add to hash blocklist" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Generic" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def add_to_hash_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_to_hash_blocklist() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'add_to_hash_blocklist' call\n results_data_1 = phantom.collect2(container=container, datapath=['block_hash_2:action_result.parameter.hash', 'block_hash_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'add_to_hash_blocklist' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'list': \"custom_list:filehash_blocklist\",\n 'create': True,\n 'new_row': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"add listitem\", parameters=parameters, assets=['phantom'], name=\"add_to_hash_blocklist\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": true, + "connection_name": "block hash", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "add to hash blocklist", + "delay": 0, + "description": "The file hash is added to the custom list 'filehash_blocklist' in order to prevent the Playbook from attempting to block a file hash that has already been blocked.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "dced0e6a-538a-4d02-800a-5e5c0caf92f7", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 191, + "line_start": 166, + "message": "Configuring now", + "name": "add listitem", + "notes": "The file hash is added to the custom list 'filehash_blocklist' in order to prevent the Playbook from attempting to block a file hash that has already been blocked.", + "number": 3, + "order": 9, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 300 + }, + "previous_function": "", + "previous_name": "add_to_hash_blocklist", + "required_params": { + "list": true, + "new_row": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Generic", + "type": "coa.Action", + "warn": false, + "z": 426 + }, + { + "action": "add listitem", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "create": "True", + "list": "custom_list:ip_address_blocklist", + "new_row": "block_ip_1:action_result.parameter.ip" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "add listitem", + "actions": [ + "no op", + "update list", + "get action result", + "create container", + "import container", + "export container", + "deflate item", + "add artifact", + "find listitem", + "add listitem", + "find artifacts", + "update artifact tags", + "add note", + "update artifact", + "test connectivity" + ], + "active": true, + "app_name": "Phantom", + "app_version": "3.0.2", + "appid": "deb82aa9-22cc-4675-9cf1-534b8d006eb7", + "asset_name": "phantom", + "config_type": "asset", + "count": 0, + "fields": { + "create": "True", + "list": "custom_list:ip_address_blocklist", + "new_row": "block_ip_1:action_result.parameter.ip" + }, + "has_app": true, + "id": 16, + "loaded": false, + "missing": false, + "name": "phantom", + "output": [ + { + "column_name": "Status", + "column_order": 0, + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "data_path": "action_result.parameter.create", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.parameter.list", + "data_type": "string", + "example_values": [ + "demo_list" + ] + }, + { + "contains": [ + "*" + ], + "data_path": "action_result.parameter.new_row", + "data_type": "string", + "example_values": [ + "[\"value1\",\"value2\",\"value3\"]" + ] + }, + { + "data_path": "action_result.data.*.failed", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.success", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.server", + "data_type": "string", + "example_values": [ + "https://10.1.1.10" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Server: https://10.1.1.10" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "parameters": { + "create": { + "data_type": "boolean", + "default": false, + "description": "Create list if it does not exist (default: false)", + "key": "create", + "order": 2, + "required": false + }, + "list": { + "data_type": "string", + "default": null, + "description": "Name or ID of a custom list", + "key": "list", + "order": 0, + "required": true + }, + "new_row": { + "contains": [ + "*" + ], + "data_type": "string", + "default": null, + "description": "New Row (string or JSON list)", + "key": "new_row", + "order": 1, + "primary": true, + "required": true + } + }, + "product_name": "Phantom", + "product_vendor": "Phantom", + "targets": "16", + "type": "information" + } + ], + "attrs": { + ".action": { + "text": "add to IP blocklist" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Generic" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def add_to_IP_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_to_IP_blocklist() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'add_to_IP_blocklist' call\n results_data_1 = phantom.collect2(container=container, datapath=['block_ip_1:action_result.parameter.ip', 'block_ip_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'add_to_IP_blocklist' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'list': \"custom_list:ip_address_blocklist\",\n 'create': True,\n 'new_row': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"add listitem\", parameters=parameters, assets=['phantom'], name=\"add_to_IP_blocklist\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": true, + "connection_name": "block ip", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "add to IP blocklist", + "delay": 0, + "description": "The IP address is added to the custom list 'ip_address_blocklist' in order to prevent the Playbook from attempting to block an IP address that has already been blocked.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "08306503-f5d1-4cd0-b32b-90a7670ff1ca", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 247, + "line_start": 222, + "message": "Configuring now", + "name": "add listitem", + "notes": "The IP address is added to the custom list 'ip_address_blocklist' in order to prevent the Playbook from attempting to block an IP address that has already been blocked.", + "number": 1, + "order": 11, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 20 + }, + "previous_function": "", + "previous_name": "add_to_IP_blocklist", + "required_params": { + "list": true, + "new_row": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Generic", + "type": "coa.Action", + "warn": false, + "z": 430 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 6 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_6(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_6() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"filtered-data:filter_3:condition_1:artifact:*.cef.fileHash\", \"in\", \"custom_list:filehash_blocklist\"],\n ],\n name=\"filter_6:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n block_hash_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "Checking to see if this filehash is in the custom list called \"filehash_blocklist\"", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "25ad9a87-018a-440b-a48d-3a0bd95226f6", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 163, + "line_start": 146, + "name": "filter", + "notes": "Checking to see if this filehash is in the custom list called \"filehash_blocklist\"", + "number": 6, + "order": 8, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "in", + "data_type": "", + "param": "filtered-data:filter_3:condition_1:artifact:*.cef.fileHash", + "value": "custom_list:filehash_blocklist" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 460, + "y": 300 + }, + "previous_function": "", + "previous_name": "filter_6", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 432 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 5 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_5() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"filtered-data:filter_2:condition_1:artifact:*.cef.destinationDnsDomain\", \"in\", \"custom_list:domain_blocklist\"],\n ],\n name=\"filter_5:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n block_domain_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "Checking to see if this domain address is in the custom list called \"domain_blocklist\"", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "7862d46c-23ea-4cda-9ef9-db171fd5ac93", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 143, + "line_start": 126, + "name": "filter", + "notes": "Checking to see if this domain address is in the custom list called \"domain_blocklist\"", + "number": 5, + "order": 7, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "in", + "data_type": "", + "param": "filtered-data:filter_2:condition_1:artifact:*.cef.destinationDnsDomain", + "value": "custom_list:domain_blocklist" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 460, + "y": 160 + }, + "previous_function": "", + "previous_name": "filter_5", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 433 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 4 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_4() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress\", \"not in\", \"custom_list:ip_address_blocklist\"],\n ],\n name=\"filter_4:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n block_ip_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "Checking to see if this IP address is in the custom list called \"ip_address_blocklist\"", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "9537d314-97d6-484b-ae20-3d9564bab6d6", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 284, + "line_start": 267, + "name": "filter", + "notes": "Checking to see if this IP address is in the custom list called \"ip_address_blocklist\"", + "number": 4, + "order": 13, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "not in", + "data_type": "", + "param": "filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress", + "value": "custom_list:ip_address_blocklist" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 460, + "y": 20 + }, + "previous_function": "", + "previous_name": "filter_4", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 434 + } + ] + }, + "notes": "This playbook uses the following Apps: \n\n- Palo Alto Networks Firewall (PAN)\n- CarbonBlack Response\n- OpenDNS Umbrella\n\nThis playbook uses the following custom list:\n\n- ip_address_blocklist\n- domain_blocklist\n- filehash_blocklist\n\nThis playbook provides an easy, automated, and straightforward solution to maintaining up-to-date IP address, file, and domain blocklists. The process is:\n\nEach Artifact within an event is checked for the presence of the following CEF fields:\nDestinationDnsDomain - Domains\nDestinationAddress - IP addresses\nFileHash - Files\nThe CEF value is then cross-referenced with their respective Custom Lists.\nIP addresses are blocked on a Firewall, while domains are blocked using a blocklist service. The blocking of these two will prevent access to the IOCs. Finally, file hashes are blocked using an endpoint protection service, which will prevent the process from running on affected endpoints within a network.\nAfter the IOCs are blocked using various apps, they are added to their respective custom lists as to maintain a running blocklist record." + }, + "python_version": "3", + "schema": 4, + "version": "4.10.0.40961" + }, + "create_time": "2021-01-21T21:26:58.710395+00:00", + "draft_mode": false, + "labels": [ + "events" + ], + "tags": [] +} diff --git a/playbooks/block_indicators.png b/playbooks/block_indicators.png new file mode 100644 index 0000000000..60fb2e8638 Binary files /dev/null and b/playbooks/block_indicators.png differ diff --git a/playbooks/block_indicators.py b/playbooks/block_indicators.py new file mode 100644 index 0000000000..55297ef4b2 --- /dev/null +++ b/playbooks/block_indicators.py @@ -0,0 +1,297 @@ +""" +This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists. +""" + +import phantom.rules as phantom +import json +from datetime import datetime, timedelta +def on_start(container): + phantom.debug('on_start() called') + + # call 'filter_1' block + filter_1(container=container) + + # call 'filter_2' block + filter_2(container=container) + + # call 'filter_3' block + filter_3(container=container) + + return + +def block_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_ip_1() called') + + # collect data for 'block_ip_1' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress', 'filtered-data:filter_4:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'block_ip_1' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'ip': filtered_artifacts_item_1[0], + 'vsys': "", + 'is_source_address': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="block ip", parameters=parameters, assets=['pan'], callback=add_to_IP_blocklist, name="block_ip_1") + + return + +def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_hash_2() called') + + # collect data for 'block_hash_2' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_6:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_6:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'block_hash_2' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'hash': filtered_artifacts_item_1[0], + 'comment': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="block hash", parameters=parameters, assets=['carbonblack'], callback=add_to_hash_blocklist, name="block_hash_2") + + return + +def block_domain_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_domain_1() called') + + # collect data for 'block_domain_1' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain', 'filtered-data:filter_5:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'block_domain_1' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'domain': filtered_artifacts_item_1[0], + 'disable_safeguards': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="block domain", parameters=parameters, assets=['opendns_umbrella'], callback=add_to_domain_blocklist, name="block_domain_1") + + return + +def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_2() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["artifact:*.cef.destinationDnsDomain", "!=", ""], + ], + name="filter_2:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + filter_5(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_3() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["artifact:*.cef.fileHash", "!=", ""], + ], + name="filter_3:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + filter_6(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Checking to see if this domain address is in the custom list called "domain_blocklist" +""" +def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_5() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["filtered-data:filter_2:condition_1:artifact:*.cef.destinationDnsDomain", "in", "custom_list:domain_blocklist"], + ], + name="filter_5:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + block_domain_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Checking to see if this filehash is in the custom list called "filehash_blocklist" +""" +def filter_6(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_6() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["filtered-data:filter_3:condition_1:artifact:*.cef.fileHash", "in", "custom_list:filehash_blocklist"], + ], + name="filter_6:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + block_hash_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +The file hash is added to the custom list 'filehash_blocklist' in order to prevent the Playbook from attempting to block a file hash that has already been blocked. +""" +def add_to_hash_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('add_to_hash_blocklist() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'add_to_hash_blocklist' call + results_data_1 = phantom.collect2(container=container, datapath=['block_hash_2:action_result.parameter.hash', 'block_hash_2:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'add_to_hash_blocklist' call + for results_item_1 in results_data_1: + if results_item_1[0]: + parameters.append({ + 'list': "custom_list:filehash_blocklist", + 'create': True, + 'new_row': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="add listitem", parameters=parameters, assets=['phantom'], name="add_to_hash_blocklist", parent_action=action) + + return + +""" +The domain is added to the custom list 'domain_blocklist' in order to prevent the Playbook from attempting to block a domain that has already been blocked. +""" +def add_to_domain_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('add_to_domain_blocklist() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'add_to_domain_blocklist' call + results_data_1 = phantom.collect2(container=container, datapath=['block_domain_1:action_result.parameter.domain', 'block_domain_1:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'add_to_domain_blocklist' call + for results_item_1 in results_data_1: + if results_item_1[0]: + parameters.append({ + 'list': "custom_list:domain_blocklist", + 'create': True, + 'new_row': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="add listitem", parameters=parameters, assets=['phantom'], name="add_to_domain_blocklist", parent_action=action) + + return + +""" +The IP address is added to the custom list 'ip_address_blocklist' in order to prevent the Playbook from attempting to block an IP address that has already been blocked. +""" +def add_to_IP_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('add_to_IP_blocklist() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'add_to_IP_blocklist' call + results_data_1 = phantom.collect2(container=container, datapath=['block_ip_1:action_result.parameter.ip', 'block_ip_1:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'add_to_IP_blocklist' call + for results_item_1 in results_data_1: + if results_item_1[0]: + parameters.append({ + 'list': "custom_list:ip_address_blocklist", + 'create': True, + 'new_row': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="add listitem", parameters=parameters, assets=['phantom'], name="add_to_IP_blocklist", parent_action=action) + + return + +def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_1() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["artifact:*.cef.destinationAddress", "!=", ""], + ], + name="filter_1:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Checking to see if this IP address is in the custom list called "ip_address_blocklist" +""" +def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_4() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress", "not in", "custom_list:ip_address_blocklist"], + ], + name="filter_4:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + block_ip_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def on_finish(container, summary): + phantom.debug('on_finish() called') + # This function is called after all actions are completed. + # summary of all the action and/or all details of actions + # can be collected here. + + # summary_json = phantom.get_summary() + # if 'result' in summary_json: + # for action_result in summary_json['result']: + # if 'action_run_id' in action_result: + # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False) + # phantom.debug(action_results) + + return \ No newline at end of file diff --git a/playbooks/block_indicators.yml b/playbooks/block_indicators.yml new file mode 100644 index 0000000000..9caf9a527c --- /dev/null +++ b/playbooks/block_indicators.yml @@ -0,0 +1,23 @@ +name: Block Indicators +id: fc0edc76-ff2b-48b0-5f6f-63da6783fd63 +version: 1 +date: '2021-01-21' +author: Philip Royer, Splunk +type: Response +description: This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists. +playbook: block_indicators +how_to_implement: "This playbook uses the following custom lists: ip_address_blocklist, domain_blocklist, filehash_blocklist. This playbook provides an easy, automated, and straightforward solution to maintaining up-to-date IP address, file, and domain blocklists. The playbook looks for any of the required CEF fields within the container. The CEF value is then cross-referenced with their respective Custom Lists. IP addresses are blocked on a Firewall, while domains are blocked using a blocklist service. The blocking of these two will prevent access to the IOCs. Finally, file hashes are blocked using an endpoint protection service, which will prevent the process from running on affected endpoints within a network. After the IOCs are blocked using various apps, they are added to their respective custom lists as to maintain a running blocklist record." +references: [] +app_list: +- "Palo Alto Networks Firewall" +- "CarbonBlack Response" +- "OpenDNS Umbrella" +tags: + platform_tags: + - Response + playbook_fields: + - destinationDnsDomain + - destinationAddress + - fileHash + product: + - Splunk SOAR \ No newline at end of file diff --git a/playbooks/email_notification_for_malware.json b/playbooks/email_notification_for_malware.json new file mode 100644 index 0000000000..24f8c4685e --- /dev/null +++ b/playbooks/email_notification_for_malware.json @@ -0,0 +1,8672 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Use Cases", + "coa": { + "data": { + "clean": true, + "code_block": "", + "description": "This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal \"file reputation\" and PAN WildFire \"detonate file\" are used to determine if a file is malware, and CarbonBlack Response \"hunt file\" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.", + "hash": "cd4b30ce1b1555275490936455ad489a860c1c98", + "joint": { + "cells": [ + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "b019e440-ef29-4772-bda2-a9386a65fccb", + "router": { + "name": "metro" + }, + "source": { + "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f86960a4-1d0d-4f37-924c-8640149388a8", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 32 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "eaa4fc01-be31-4366-b66d-7aaaa8cd5967", + "router": { + "name": "metro" + }, + "source": { + "id": "12461935-1aee-4aec-878c-0e2fb1742912", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 171 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "74fcb7c5-ea09-4556-90ce-c60cf8681d04", + "router": { + "name": "metro" + }, + "source": { + "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "cff987f2-2566-44d5-a694-26087dc2a0a2", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 767 + }, + { + "0": "S", + "1": "T", + "2": "A", + "3": "R", + "4": "T", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "ref-x": 33, + "ref-y": 8, + "text": "START" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "ref-x": 13, + "xlink:href": "/inc/coa/img/block_icon_start.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'filter_1' block\n filter_1(container=container)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "4f900fb0-068e-4214-8caa-1b065f7f9bfa", + "inPorts": [], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 16, + "line_start": 8, + "name": "", + "notes": "", + "number": 0, + "order": 1, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": -120, + "y": 120 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "START", + "type": "coa.StartEnd", + "warn": false, + "z": 1394 + }, + { + "0": "E", + "1": "N", + "2": "D", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".title": { + "text": "END" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_end.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "send email", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "cff987f2-2566-44d5-a694-26087dc2a0a2", + "inPorts": [ + "in" + ], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 338, + "line_start": 325, + "name": "", + "notes": "", + "number": 0, + "order": 13, + "outPorts": [], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1880, + "y": 120 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "END", + "type": "coa.StartEnd", + "warn": false, + "z": 1571 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "1af67ff6-453c-46aa-87e1-3731e1a659a5", + "router": { + "name": "metro" + }, + "source": { + "id": "4f900fb0-068e-4214-8caa-1b065f7f9bfa", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899", + "port": "in", + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1682 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d4f646d5-8ec0-41ef-8519-cd07b8de14f3", + "router": { + "name": "metro" + }, + "source": { + "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "35f205e2-949e-463e-9057-658f597b1dc9", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1834 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ef8c12b6-f42d-459c-a8b1-b04690b626ee", + "router": { + "name": "metro" + }, + "source": { + "id": "f86960a4-1d0d-4f37-924c-8640149388a8", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1951 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "0b2d5872-1c82-438a-bf42-2ffefc4b4bb1", + "router": { + "name": "metro" + }, + "source": { + "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1954 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ca25cb81-1e40-4c53-a811-3fd0be926cca", + "router": { + "name": "metro" + }, + "source": { + "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", + "port": "out-2", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "34337267-8e89-4ddf-a601-9040234d2744", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1960 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d3d6a860-6f58-4b63-86d5-8c1a7da31e5a", + "router": { + "name": "metro" + }, + "source": { + "id": "34337267-8e89-4ddf-a601-9040234d2744", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1967 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "50e35606-e056-445a-b71e-84a1d6026b43", + "router": { + "name": "metro" + }, + "source": { + "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "12461935-1aee-4aec-878c-0e2fb1742912", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1969 + }, + { + "action": "file reputation", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:initial_artifact_filter:condition_1:artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "VirusTotal", + "app_version": "1.2.37", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_1:condition_1:artifact:*.cef.fileHash" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "virustotal", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "sha256", + "sha1", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.data.*.md5", + "data_type": "string", + "example_values": [ + "494303294715f5ffad7ad3f43b73b00b" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.permalink", + "data_type": "string", + "example_values": [ + "https://www.test.com/file/27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7/analysis/1548112684/" + ] + }, + { + "data_path": "action_result.data.*.positives", + "data_type": "numeric", + "example_values": [ + 64 + ] + }, + { + "contains": [ + "sha1" + ], + "data_path": "action_result.data.*.resource", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "data_path": "action_result.data.*.response_code", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.scan_date", + "data_type": "string", + "example_values": [ + "2019-01-21 23:18:04" + ] + }, + { + "contains": [ + "virustotal scan id" + ], + "data_path": "action_result.data.*.scan_id", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684" + ] + }, + { + "data_path": "action_result.data.*.scans.*.detected", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.scans.*.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.*.update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.ALYac.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ALYac.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ALYac.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.ALYac.version", + "data_type": "string", + "example_values": [ + "1.1.1.5" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.result", + "data_type": "string", + "example_values": [ + "Win32:Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.version", + "data_type": "string", + "example_values": [ + "18.4.3895.0" + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b (v)" + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.update", + "data_type": "string", + "example_values": [ + "20180925" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.AVware.version", + "data_type": "string", + "example_values": [ + "1.6.0.52" + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.result", + "data_type": "string", + "example_values": [ + "suspicious" + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.update", + "data_type": "string", + "example_values": [ + "20190119" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Acronis.version", + "data_type": "string", + "example_values": [ + "1.0.1.37" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.version", + "data_type": "string", + "example_values": [ + "3.0.5.370" + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.AegisLab.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.version", + "data_type": "string", + "example_values": [ + "4.2" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.result", + "data_type": "string", + "example_values": [ + "Win32/Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.version", + "data_type": "string", + "example_values": [ + "3.14.1.22785" + ] + }, + { + "data_path": "action_result.data.*.scans.Alibaba.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Alibaba.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Alibaba.update", + "data_type": "string", + "example_values": [ + "20180921" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Alibaba.version", + "data_type": "string", + "example_values": [ + "0.1.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.result", + "data_type": "string", + "example_values": [ + "Virus/Win32.Parite.c" + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Antiy-AVL.version", + "data_type": "string", + "example_values": [ + "3.0.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.version", + "data_type": "string", + "example_values": [ + "1.0.0.837" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.version", + "data_type": "string", + "example_values": [ + "190121-00" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.result", + "data_type": "string", + "example_values": [ + "Win32:Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.version", + "data_type": "string", + "example_values": [ + "18.4.3895.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.result", + "data_type": "string", + "example_values": [ + "W32/Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Avira.version", + "data_type": "string", + "example_values": [ + "8.3.3.8" + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Babable.update", + "data_type": "string", + "example_values": [ + "20180918" + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.version", + "data_type": "string", + "example_values": [ + "9107201" + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.result", + "data_type": "string", + "example_values": [ + "Win32.Virus.Parite.d" + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Baidu.version", + "data_type": "string", + "example_values": [ + "1.0.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.version", + "data_type": "string", + "example_values": [ + "7.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.result", + "data_type": "string", + "example_values": [ + "W32.Pinfi.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.version", + "data_type": "string", + "example_values": [ + "1.3.0.9899" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.result", + "data_type": "string", + "example_values": [ + "W32.Perite.A" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.version", + "data_type": "string", + "example_values": [ + "14.00" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b!O" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.version", + "data_type": "string", + "example_values": [ + "1.1.0.977" + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.result", + "data_type": "string", + "example_values": [ + "Heuristics.W32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.ClamAV.version", + "data_type": "string", + "example_values": [ + "0.101.1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.result", + "data_type": "string", + "example_values": [ + "Malware@#1b1651nqd7ivb" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.version", + "data_type": "string", + "example_values": [ + "30310" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.result", + "data_type": "string", + "example_values": [ + "malicious_confidence_100% (W)" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.update", + "data_type": "string", + "example_values": [ + "20181023" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.result", + "data_type": "string", + "example_values": [ + "malicious.94715f" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.update", + "data_type": "string", + "example_values": [ + "20190109" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.version", + "data_type": "string", + "example_values": [ + "1.2.27" + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.result", + "data_type": "string", + "example_values": [ + "Unsafe" + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Cylance.version", + "data_type": "string", + "example_values": [ + "2.3.1.101" + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.result", + "data_type": "string", + "example_values": [ + "W32/Virut.E.gen!Eldorado" + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Cyren.version", + "data_type": "string", + "example_values": [ + "6.2.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.result", + "data_type": "string", + "example_values": [ + "Trojan.DownLoader20.25948" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.version", + "data_type": "string", + "example_values": [ + "7.0.34.11020" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.result", + "data_type": "string", + "example_values": [ + "Win32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.version", + "data_type": "string", + "example_values": [ + "18744" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B (B)" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.version", + "data_type": "string", + "example_values": [ + "2018.4.0.1029" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.result", + "data_type": "string", + "example_values": [ + "malicious (high confidence)" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.update", + "data_type": "string", + "example_values": [ + "20181108" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.version", + "data_type": "string", + "example_values": [ + "3.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.result", + "data_type": "string", + "example_values": [ + "W32/Virut.E.gen!Eldorado" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.F-Prot.version", + "data_type": "string", + "example_values": [ + "4.7.1.166" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.version", + "data_type": "string", + "example_values": [ + "11.0.19100.45" + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.result", + "data_type": "string", + "example_values": [ + "W32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Fortinet.version", + "data_type": "string", + "example_values": [ + "5.4.247.0" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.GData.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.version", + "data_type": "string", + "example_values": [ + "A:25.20275B:25.14197" + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Virut" + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Ikarus.version", + "data_type": "string", + "example_values": [ + "0.1.5.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.result", + "data_type": "string", + "example_values": [ + "heuristic" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.update", + "data_type": "string", + "example_values": [ + "20181128" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.version", + "data_type": "string", + "example_values": [ + "6.3.6.26157" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.result", + "data_type": "string", + "example_values": [ + "Win32/Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.version", + "data_type": "string", + "example_values": [ + "16.0.100" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.result", + "data_type": "string", + "example_values": [ + "Virus ( 00001b711 )" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.version", + "data_type": "string", + "example_values": [ + "11.24.29740" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.result", + "data_type": "string", + "example_values": [ + "Virus ( 00001b711 )" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.version", + "data_type": "string", + "example_values": [ + "11.24.29740" + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Kaspersky.version", + "data_type": "string", + "example_values": [ + "15.0.1.13" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b.5756" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.version", + "data_type": "string", + "example_values": [ + "2013.8.14.323" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.result", + "data_type": "string", + "example_values": [ + "malware (ai score=100)" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.version", + "data_type": "string", + "example_values": [ + "2018.9.12.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.result", + "data_type": "string", + "example_values": [ + "Trojan.Agent.QQ" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.version", + "data_type": "string", + "example_values": [ + "2.1.1.1115" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.result", + "data_type": "string", + "example_values": [ + "BehavesLike.Win32.Pate.hh" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.version", + "data_type": "string", + "example_values": [ + "v2017.3010" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.result", + "data_type": "string", + "example_values": [ + "W32/Pate.b" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.version", + "data_type": "string", + "example_values": [ + "6.0.6.653" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.version", + "data_type": "string", + "example_values": [ + "14.0.297.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.result", + "data_type": "string", + "example_values": [ + "Virus:Win32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.version", + "data_type": "string", + "example_values": [ + "1.1.15500.2" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.bgvo" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.version", + "data_type": "string", + "example_values": [ + "1.0.134.24576" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.result", + "data_type": "string", + "example_values": [ + "generic.ml" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.result", + "data_type": "string", + "example_values": [ + "W32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Panda.version", + "data_type": "string", + "example_values": [ + "4.6.4.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.H" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.version", + "data_type": "string", + "example_values": [ + "1.0.0.1120" + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.result", + "data_type": "string", + "example_values": [ + "Virus.Parite!1.9B80 (CLOUD)" + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Rising.version", + "data_type": "string", + "example_values": [ + "25.0.0.24" + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.update", + "data_type": "string", + "example_values": [ + "20190116" + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.version", + "data_type": "string", + "example_values": [ + "5.6.0.1032" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.result", + "data_type": "string", + "example_values": [ + "static engine - malicious" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.version", + "data_type": "string", + "example_values": [ + "1.0.21.268" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.result", + "data_type": "string", + "example_values": [ + "W32/Parite-B" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.version", + "data_type": "string", + "example_values": [ + "4.98.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.result", + "data_type": "string", + "example_values": [ + "Trojan.Gen.6" + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Symantec.version", + "data_type": "string", + "example_values": [ + "1.8.0.0" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.result", + "data_type": "string", + "example_values": [ + "Virus/W32.Parite.C" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.version", + "data_type": "string", + "example_values": [ + "2019-01-21.02" + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Dropper.c" + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Tencent.version", + "data_type": "string", + "example_values": [ + "1.0.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.result", + "data_type": "string", + "example_values": [ + "W32/Pate.B" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.version", + "data_type": "string", + "example_values": [ + "6.8.0.5.3962" + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.result", + "data_type": "string", + "example_values": [ + "Win32/Pinfi.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.TotalDefense.version", + "data_type": "string", + "example_values": [ + "37.1.62.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.result", + "data_type": "string", + "example_values": [ + "malicious.high.ml.score" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.update", + "data_type": "string", + "example_values": [ + "20190103" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.version", + "data_type": "string", + "example_values": [ + "3.0.34.707" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.result", + "data_type": "string", + "example_values": [ + "PE_PARITE.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.version", + "data_type": "string", + "example_values": [ + "10.0.0.1040" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.result", + "data_type": "string", + "example_values": [ + "PE_PARITE.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.version", + "data_type": "string", + "example_values": [ + "10.0.0.1040" + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Trustlook.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.version", + "data_type": "string", + "example_values": [ + "3.35.1" + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b (v)" + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.VIPRE.version", + "data_type": "string", + "example_values": [ + "None" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.A" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.version", + "data_type": "string", + "example_values": [ + "2014.3.20.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Webroot.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.version", + "data_type": "string", + "example_values": [ + "1.0.0.403" + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.update", + "data_type": "string", + "example_values": [ + "20190120" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Yandex.version", + "data_type": "string", + "example_values": [ + "5.5.1.3" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.result", + "data_type": "string", + "example_values": [ + "Virus.Parite.Win32.9" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.version", + "data_type": "string", + "example_values": [ + "2.0.0.3733" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.eGambit.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.version", + "data_type": "string", + "example_values": [ + "v4.3.5" + ] + }, + { + "contains": [ + "hash", + "sha1" + ], + "data_path": "action_result.data.*.sha1", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "contains": [ + "hash", + "sha256" + ], + "data_path": "action_result.data.*.sha256", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7" + ] + }, + { + "data_path": "action_result.data.*.total", + "data_type": "numeric", + "example_values": [ + 72 + ] + }, + { + "data_path": "action_result.data.*.verbose_msg", + "data_type": "string", + "example_values": [ + "Scan finished, information embedded" + ] + }, + { + "data_path": "action_result.summary.positives", + "data_type": "numeric", + "example_values": [ + 64 + ] + }, + { + "data_path": "action_result.summary.total_scans", + "data_type": "numeric", + "example_values": [ + 72 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Positives: 64, Total scans: 72" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_positives", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "VirusTotal", + "product_vendor": "VirusTotal", + "type": "" + } + ], + "attrs": { + ".action": { + "text": "file reputation" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('file_reputation_1() called')\n\n # collect data for 'file_reputation_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_1:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'file_reputation_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'hash': filtered_artifacts_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"file reputation\", parameters=parameters, assets=['virustotal'], callback=filter_2, name=\"file_reputation_1\")\n\n return", + "callback_code": "", + "callback_start": 55, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "f86960a4-1d0d-4f37-924c-8640149388a8", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 40, + "line_start": 19, + "message": "Configuring now", + "name": "file reputation", + "notes": "Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware.", + "number": 1, + "order": 2, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 160, + "y": 100 + }, + "previous_function": "", + "previous_name": "file_reputation_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 1981 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 5 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_5() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"detonate_file_1:action_result.summary.malware\", \"==\", \"yes\"],\n ],\n name=\"filter_5:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "detonate file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 5", + "description": "Only hunt files that are considered malware per the sandbox (malware == yes).", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 110, + "line_start": 92, + "name": "filter", + "notes": "Only hunt files that are considered malware per the sandbox (malware == yes).", + "number": 5, + "order": 5, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "==", + "data_type": "", + "param": "detonate_file_1:action_result.summary.malware", + "value": "yes" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1020, + "y": 240 + }, + "previous_function": "", + "previous_name": "filter_5", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2020 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 3 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash\", \"==\", \"artifact:*.cef.fileHash\"],\n ],\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 3", + "description": "Match hashes with less than 10 positives to artifacts to identify filtered_artifacts.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "34337267-8e89-4ddf-a601-9040234d2744", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 131, + "line_start": 113, + "name": "filter", + "notes": "Match hashes with less than 10 positives to artifacts to identify filtered_artifacts.", + "number": 3, + "order": 6, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "==", + "data_type": "", + "param": "filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash", + "value": "artifact:*.cef.fileHash" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 500, + "y": 240 + }, + "previous_function": "", + "previous_name": "filter_3", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2022 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 2 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + ".outPorts>.port-1": { + "port": { + "id": "out-2", + "type": "out" + }, + "ref-x": 41, + "ref-y": 82 + }, + ".outPorts>.port-1>.port-body": { + "port": { + "id": "out-2", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">=\", 10],\n ],\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n # collect filtered artifact ids for 'if' condition 2\n matched_artifacts_2, matched_results_2 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \"<\", 10],\n ],\n name=\"filter_2:condition_2\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_2 or matched_results_2:\n filter_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 2", + "description": "If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 165, + "line_start": 134, + "name": "filter", + "notes": "If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first.", + "number": 2, + "order": 7, + "outPorts": [ + "out-1", + "out-2" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": ">=", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + }, + { + "conditions": [ + { + "comparison": "<", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 400, + "y": 100 + }, + "previous_function": "", + "previous_name": "filter_2", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2023 + }, + { + "action": "hunt file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_9:condition_1:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "Carbon Black Response", + "app_version": "1.2.80", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7", + "13ded573464ba7f43fe640479b309e09", + "9bf50324444c46997c2492d505b47f2d", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.range", + "data_type": "string", + "example_values": [ + "0-10", + "0-2", + "5-8" + ] + }, + { + "contains": [ + "carbon black query type" + ], + "data_path": "action_result.parameter.type", + "data_type": "string", + "example_values": [ + "process", + "binary" + ] + }, + { + "data_path": "action_result.data.*.binary.elapsed", + "data_type": "numeric", + "example_values": [ + 0.1120398044586182, + 0.04952096939086914, + 0.1234798431396484, + 0.05507302284240723, + 0.05384993553161621 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", + "data_type": "string", + "example_values": [ + "2018-10-01T00:00:00Z", + "2015-01-01T00:00:00Z", + "2013-11-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.name", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "CB-TEST-02", + "WIN7-CLIENT1", + "ACCOUNTING-PC" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "16.7" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "C:\\Windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "50.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", + "data_type": "string", + "example_values": [ + "2018-10-19T00:00:00Z", + "2018-09-29T00:00:00Z", + "2018-10-02T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.highlights.*.ids", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.highlights.*.name", + "data_type": "string", + "example_values": [ + "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", + "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", + "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 510, + 511 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_issuer", + "data_type": "string", + "example_values": [ + "Microsoft Code Signing PCA" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Corp." + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-10-14T20:23:00Z", + "2015-01-30T19:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_subject", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.endpoint", + "data_type": "string", + "example_values": [ + "CB-TEST-02|27", + "WIN7-CLIENT1|15", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.event_partition_id", + "data_type": "numeric", + "example_values": [ + 100972684312576, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.facet_id", + "data_type": "numeric", + "example_values": [ + 883737, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_desc", + "data_type": "string", + "example_values": [ + "Microsoft Office Click-to-Run (SxS)", + "Microsoft Network Realtime Inspection Service", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.host_count", + "data_type": "numeric", + "example_values": [ + 1, + 6 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.internal_name", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.last_seen", + "data_type": "string", + "example_values": [ + "2018-10-28T10:06:02.456Z", + "2018-10-28T10:06:42.455Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.md5", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.original_filename", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "column_name": "Signed", + "column_order": 1, + "data_path": "action_result.data.*.binary.results.*.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-07-01T02:20:02.062Z", + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.binary.start", + "data_type": "numeric", + "example_values": [ + 0, + 5 + ] + }, + { + "data_path": "action_result.data.*.binary.terms", + "data_type": "string", + "example_values": [ + "md5:13ded573464ba7f43fe640479b309e09", + "md5:9bf50324444c46997c2492d505b47f2d", + "md5:5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.total_results", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.process.all_segments", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.comprehensive_search", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.elapsed", + "data_type": "numeric", + "example_values": [ + 0.2200779914855957 + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.value", + "data_type": "numeric", + "example_values": [ + 1566 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 10128 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.name", + "data_type": "string", + "example_values": [ + "domain_controller" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.value", + "data_type": "numeric", + "example_values": [ + 10123 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "dc2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "51.2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 5185 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", + "data_type": "numeric", + "example_values": [ + 411 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.parent_name.*.name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.facets.path_full.*.name", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.facets.process_md5.*.name", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.process_name.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.name", + "data_type": "string", + "example_values": [ + "2018-02-24T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.value", + "data_type": "numeric", + "example_values": [ + 324 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.name", + "data_type": "string", + "example_values": [ + "LOCAL SERVICE" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.4" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.value", + "data_type": "numeric", + "example_values": [ + 9966 + ] + }, + { + "data_path": "action_result.data.*.process.incomplete_results", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.childproc_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.process.results.*.cmdline", + "data_type": "string", + "example_values": [ + "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.comms_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.crossproc_count", + "data_type": "numeric", + "example_values": [ + 2 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_config", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filemod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.group", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.host_type", + "data_type": "string", + "example_values": [ + "workstation" + ] + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.process.results.*.hostname", + "data_type": "string", + "example_values": [ + "win7-client1" + ] + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.process.results.*.id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.interface_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_server_update", + "data_type": "string", + "example_values": [ + "2018-03-22T09:21:32.332Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_update", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.82Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.modload_count", + "data_type": "numeric", + "example_values": [ + 43 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.netconn_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.os_type", + "data_type": "string", + "example_values": [ + "windows" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_md5", + "data_type": "string", + "example_values": [ + "000000000000000000000000000000" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.results.*.parent_name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_pid", + "data_type": "numeric", + "example_values": [ + 600 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.path", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.process_md5", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "process name", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.process_name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.process.results.*.process_pid", + "data_type": "numeric", + "example_values": [ + 1672 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.processblock_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.regmod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.segment_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.process.results.*.sensor_id", + "data_type": "numeric", + "example_values": [ + 15 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.start", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.758Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.terminated", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243-000000000001" + ] + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.process.results.*.username", + "data_type": "string", + "example_values": [ + "SYSTEM" + ] + }, + { + "data_path": "action_result.data.*.process.start", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.terms", + "data_type": "string", + "example_values": [ + "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.total_results", + "data_type": "numeric", + "example_values": [ + 32404 + ] + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "numeric", + "example_values": [ + 32404, + 1 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Displaying 10 'process' results of total 32404", + "Displaying 1 'binary' results of total 1", + "Displaying 0 'binary' results of total 1" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "Carbon Black", + "product_vendor": "Bit9", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt file 1" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_1' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_1' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name=\"hunt_file_1\")\n\n return", + "callback_code": "", + "callback_start": 193, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Hunt for binaries with the malicious fileHash across endpoints.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 112, + "line_end": 193, + "line_start": 168, + "message": "Configuring now", + "name": "hunt file", + "notes": "Hunt for binaries with the malicious fileHash across endpoints.", + "number": 1, + "order": 8, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 780, + "y": 100 + }, + "previous_function": "", + "previous_name": "hunt_file_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2024 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 1 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.fileHash\", \"!=\", \"\"],\n ],\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n file_reputation_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 1", + "description": "Only process artifacts that have a CEF fileHash.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 37, + "line_end": 213, + "line_start": 196, + "name": "filter", + "notes": "Only process artifacts that have a CEF fileHash.", + "number": 1, + "order": 9, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "artifact:*.cef.fileHash", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 20, + "y": 100 + }, + "previous_function": "", + "previous_name": "filter_1", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2025 + }, + { + "action": "detonate file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "file_name": "", + "force_analysis": "", + "private": "", + "vault_id": "filtered-data:filter_11:condition_1:artifact:*.cef.vaultId", + "vm": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "WildFire", + "app_version": "1.0.24", + "appid": "", + "config_type": "asset", + "fields": { + "file_name": "", + "vault_id": "filtered-data:filter_4:condition_1:artifact:*.cef.vaultId" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "wildfire", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.parameter.file_name", + "data_type": "string" + }, + { + "contains": [ + "pe file", + "pdf", + "flash", + "apk", + "jar", + "doc", + "xls", + "ppt" + ], + "data_path": "action_result.parameter.vault_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_info.filetype", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_info.malware", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.file_info.md5", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.file_info.sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.file_info.sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_info.size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@behavior_id", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@md5", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@behavior_id", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@md5", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@deleted_file", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@process_image", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@written_file", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.malware", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.md5", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@query", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@response", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@country", + "data_type": "string" + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@ip", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@port", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@country", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@ip", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@port", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@host", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@method", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@uri", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@user_agent", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.platform", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@command", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@name", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@md5", + "data_type": "string" + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@name", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.mutex.createmutex.*.@name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@key", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@subkey", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@data", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@key", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@subkey", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@name", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@pid", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@text", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@reg_key", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@reg_key", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@reg_key", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.software", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@details", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@score", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.task", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.@seq", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.summary.malware", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "WildFire", + "product_vendor": "Palo Alto Networks", + "type": "sandbox" + } + ], + "attrs": { + ".action": { + "text": "detonate file" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('detonate_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'detonate_file_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.vaultId', 'filtered-data:filter_4:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'detonate_file_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'vault_id': filtered_artifacts_item_1[0],\n 'file_name': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"detonate file\", parameters=parameters, assets=['wildfire'], callback=filter_5, name=\"detonate_file_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Detonate the file(s) in the vault.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "12461935-1aee-4aec-878c-0e2fb1742912", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 135, + "line_end": 240, + "line_start": 216, + "message": "Configuring now", + "name": "detonate file", + "notes": "Detonate the file(s) in the vault.", + "number": 1, + "order": 10, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 780, + "y": 240 + }, + "previous_function": "", + "previous_name": "detonate_file_1", + "required_params": { + "vault_id": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2026 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "13fce689-6a47-484b-a70a-aa77e2e79cb1", + "router": { + "name": "metro" + }, + "source": { + "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f989d5e9-9586-408e-b424-8a3a5384936a", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 2037 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "eeca94e9-2c8b-4474-ad9f-39da792e28a3", + "router": { + "name": "metro" + }, + "source": { + "id": "35f205e2-949e-463e-9057-658f597b1dc9", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f989d5e9-9586-408e-b424-8a3a5384936a", + "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 2040 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 4 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_4() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"filtered-data:filter_3:condition_1:artifact:*.cef.vaultId\", \"!=\", \"\"],\n ],\n name=\"filter_4:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n detonate_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 4", + "description": "Detonate file requires a Vault file, so only proceed if vaultId is not null.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 89, + "line_start": 71, + "name": "filter", + "notes": "Detonate file requires a Vault file, so only proceed if vaultId is not null.", + "number": 4, + "order": 4, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "filtered-data:filter_3:condition_1:artifact:*.cef.vaultId", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 640, + "y": 240 + }, + "previous_function": "", + "previous_name": "filter_4", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2059 + }, + { + "action": "hunt file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", + "range": "", + "type": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", + "range": "", + "type": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7", + "13ded573464ba7f43fe640479b309e09", + "9bf50324444c46997c2492d505b47f2d", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.range", + "data_type": "string", + "example_values": [ + "0-10", + "0-2", + "5-8" + ] + }, + { + "contains": [ + "carbon black query type" + ], + "data_path": "action_result.parameter.type", + "data_type": "string", + "example_values": [ + "process", + "binary" + ] + }, + { + "data_path": "action_result.data.*.binary.elapsed", + "data_type": "numeric", + "example_values": [ + 0.1120398044586182, + 0.04952096939086914, + 0.1234798431396484, + 0.05507302284240723, + 0.05384993553161621 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", + "data_type": "string", + "example_values": [ + "2018-10-01T00:00:00Z", + "2015-01-01T00:00:00Z", + "2013-11-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.name", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "CB-TEST-02", + "WIN7-CLIENT1", + "ACCOUNTING-PC" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "16.7" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "C:\\Windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "50.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", + "data_type": "string", + "example_values": [ + "2018-10-19T00:00:00Z", + "2018-09-29T00:00:00Z", + "2018-10-02T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.highlights.*.ids", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.highlights.*.name", + "data_type": "string", + "example_values": [ + "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", + "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", + "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 510, + 511 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_issuer", + "data_type": "string", + "example_values": [ + "Microsoft Code Signing PCA" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Corp." + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-10-14T20:23:00Z", + "2015-01-30T19:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_subject", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.endpoint", + "data_type": "string", + "example_values": [ + "CB-TEST-02|27", + "WIN7-CLIENT1|15", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.event_partition_id", + "data_type": "numeric", + "example_values": [ + 100972684312576, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.facet_id", + "data_type": "numeric", + "example_values": [ + 883737, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_desc", + "data_type": "string", + "example_values": [ + "Microsoft Office Click-to-Run (SxS)", + "Microsoft Network Realtime Inspection Service", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.host_count", + "data_type": "numeric", + "example_values": [ + 1, + 6 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.internal_name", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.last_seen", + "data_type": "string", + "example_values": [ + "2018-10-28T10:06:02.456Z", + "2018-10-28T10:06:42.455Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.md5", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.original_filename", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "column_name": "Signed", + "column_order": 1, + "data_path": "action_result.data.*.binary.results.*.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-07-01T02:20:02.062Z", + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.binary.start", + "data_type": "numeric", + "example_values": [ + 0, + 5 + ] + }, + { + "data_path": "action_result.data.*.binary.terms", + "data_type": "string", + "example_values": [ + "md5:13ded573464ba7f43fe640479b309e09", + "md5:9bf50324444c46997c2492d505b47f2d", + "md5:5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.total_results", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.process.all_segments", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.comprehensive_search", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.elapsed", + "data_type": "numeric", + "example_values": [ + 0.2200779914855957 + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.value", + "data_type": "numeric", + "example_values": [ + 1566 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 10128 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.name", + "data_type": "string", + "example_values": [ + "domain_controller" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.value", + "data_type": "numeric", + "example_values": [ + 10123 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "dc2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "51.2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 5185 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", + "data_type": "numeric", + "example_values": [ + 411 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.parent_name.*.name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.facets.path_full.*.name", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.facets.process_md5.*.name", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.process_name.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.name", + "data_type": "string", + "example_values": [ + "2018-02-24T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.value", + "data_type": "numeric", + "example_values": [ + 324 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.name", + "data_type": "string", + "example_values": [ + "LOCAL SERVICE" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.4" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.value", + "data_type": "numeric", + "example_values": [ + 9966 + ] + }, + { + "data_path": "action_result.data.*.process.incomplete_results", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.childproc_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.process.results.*.cmdline", + "data_type": "string", + "example_values": [ + "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.comms_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.crossproc_count", + "data_type": "numeric", + "example_values": [ + 2 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_config", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filemod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.group", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.host_type", + "data_type": "string", + "example_values": [ + "workstation" + ] + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.process.results.*.hostname", + "data_type": "string", + "example_values": [ + "win7-client1" + ] + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.process.results.*.id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.interface_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_server_update", + "data_type": "string", + "example_values": [ + "2018-03-22T09:21:32.332Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_update", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.82Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.modload_count", + "data_type": "numeric", + "example_values": [ + 43 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.netconn_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.os_type", + "data_type": "string", + "example_values": [ + "windows" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_md5", + "data_type": "string", + "example_values": [ + "000000000000000000000000000000" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.results.*.parent_name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_pid", + "data_type": "numeric", + "example_values": [ + 600 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.path", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.process_md5", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "process name", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.process_name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.process.results.*.process_pid", + "data_type": "numeric", + "example_values": [ + 1672 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.processblock_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.regmod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.segment_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.process.results.*.sensor_id", + "data_type": "numeric", + "example_values": [ + 15 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.start", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.758Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.terminated", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243-000000000001" + ] + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.process.results.*.username", + "data_type": "string", + "example_values": [ + "SYSTEM" + ] + }, + { + "data_path": "action_result.data.*.process.start", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.terms", + "data_type": "string", + "example_values": [ + "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.total_results", + "data_type": "numeric", + "example_values": [ + 32404 + ] + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "numeric", + "example_values": [ + 32404, + 1 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Displaying 10 'process' results of total 32404", + "Displaying 1 'binary' results of total 1", + "Displaying 0 'binary' results of total 1" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt file 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_2' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5\", \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_2' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name=\"hunt_file_2\")\n\n return", + "callback_code": "", + "callback_start": 68, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "detonate file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Hunt for binaries with the malicious fileHash across endpoints.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "35f205e2-949e-463e-9057-658f597b1dc9", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 215, + "line_end": 68, + "line_start": 43, + "message": "Configuring now", + "name": "hunt file", + "notes": "Hunt for binaries with the malicious fileHash across endpoints.", + "number": 2, + "order": 3, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1160, + "y": 240 + }, + "previous_function": "", + "previous_name": "hunt_file_2", + "required_params": { + "hash": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2065 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".format": { + "text": "format_for_emailer" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "opacity": 0, + "text": "Configuring now" + }, + ".outPorts>.port-out-1": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out-1>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + ".title": { + "text": "format" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_for_emailer() called')\n \n template = \"\"\"Malware in a security event has been confirmed using file reputation and/or file detonation services.\n\nReputation Results:\nUsing file reputation services, the following file hashes have been identified as malware:\n{0}\n\nEDR tool detects that the above file hashes are present on the following endpoints: \n{1}\n\nDetonation Results:\nUsing sandboxing services, the following file hashes have been identified as malware:\n{2}\n\nThe Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows:\n{3}\n\nEDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: \n{4}\n\nContainer id: {5}\n\n[EOM]\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"hunt_file_1:action_result.parameter.hash\",\n \"hunt_file_1:action_result.data.*.process.results.*.hostname\",\n \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5\",\n \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id\",\n \"hunt_file_2:action_result.data.*.process.results.*.hostname\",\n \"container:id\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_for_emailer\")\n\n send_email_1(container=container)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "hunt file 1, hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "format_for_emailer", + "description": "Format all results for an email.", + "format": "format", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "f989d5e9-9586-408e-b424-8a3a5384936a", + "inPorts": [ + "in" + ], + "join_code": "def join_format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('join_format_for_emailer() called')\n\n # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n if phantom.completed(action_names=['hunt_file_1', 'hunt_file_2']):\n \n # call connected block \"format_for_emailer\"\n format_for_emailer(container=container, handle=handle)\n \n return", + "join_optional": [], + "join_start": 314, + "line_end": 325, + "line_start": 272, + "message": "Configuring now", + "name": "format", + "notes": "Format all results for an email.", + "number": 2, + "order": 12, + "outPorts": [ + "out-1" + ], + "parameters": [ + { + "position": 0, + "type": "", + "value": "hunt_file_1:action_result.parameter.hash" + }, + { + "position": 1, + "type": "", + "value": "hunt_file_1:action_result.data.*.process.results.*.hostname" + }, + { + "position": 2, + "type": "", + "value": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5" + }, + { + "position": 3, + "type": "", + "value": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id" + }, + { + "position": 4, + "type": "", + "value": "hunt_file_2:action_result.data.*.process.results.*.hostname" + }, + { + "position": 5, + "type": "", + "value": "container:id" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1400, + "y": 100 + }, + "previous_function": "", + "previous_name": "format_for_emailer", + "show_number": true, + "size": { + "height": 100, + "width": 180 + }, + "state": "format", + "status": "", + "template": "Malware in a security event has been confirmed using file reputation and/or file detonation services.\n\nReputation Results:\nUsing file reputation services, the following file hashes have been identified as malware:\n{0}\n\nEDR tool detects that the above file hashes are present on the following endpoints: \n{1}\n\nDetonation Results:\nUsing sandboxing services, the following file hashes have been identified as malware:\n{2}\n\nThe Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows:\n{3}\n\nEDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: \n{4}\n\n\nContainer id: {5}\n\n[EOM]", + "title": "format", + "type": "coa.Format", + "warn": false, + "z": 2067 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "24b9331c-ecbd-454d-bdbd-926babd67934", + "router": { + "name": "metro" + }, + "source": { + "id": "f989d5e9-9586-408e-b424-8a3a5384936a", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb", + "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 2068 + }, + { + "action": "send email", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "attachments": "", + "bcc": "", + "body": "format_for_emailer:formatted_data", + "cc": "", + "from": "automation@phantom.localhost", + "headers": "", + "subject": "Malware event confirmed", + "to": "recipient@phantom.localhost" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "SMTP", + "app_version": "1.2.29", + "appid": "", + "config_type": "asset", + "fields": { + "attachments": "", + "bcc": "", + "body": "format_for_emailer:formatted_data", + "cc": "", + "from": "automation@phantom.localhost", + "headers": "", + "subject": "Malware event confirmed", + "to": "recipient@phantom.localhost" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "smtp", + "output": [ + { + "column_name": "Status", + "column_order": 0, + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "contains": [ + "vault id" + ], + "data_path": "action_result.parameter.attachments", + "data_type": "string", + "example_values": [ + "ab2b2ccfba08ea538ef22f521caa01c3c2b17ccf" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.parameter.bcc", + "data_type": "string", + "example_values": [ + "test1@testdomain.com" + ] + }, + { + "data_path": "action_result.parameter.body", + "data_type": "string", + "example_values": [ + "Test body" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.parameter.cc", + "data_type": "string", + "example_values": [ + "test2@testdomain.com" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.parameter.from", + "data_type": "string", + "example_values": [ + "sender@testdomain.com" + ] + }, + { + "data_path": "action_result.parameter.headers", + "data_type": "string", + "example_values": [ + "{\"Subject\": \"Test1\", \"To\": \"test3@testdomain.com\"}" + ] + }, + { + "data_path": "action_result.parameter.subject", + "data_type": "string", + "example_values": [ + "Test" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.parameter.to", + "data_type": "string", + "example_values": [ + "receiver@testdomain.com" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Email sent" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "SMTP", + "product_vendor": "Generic", + "type": "email" + } + ], + "attrs": { + ".action": { + "text": "send email" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Generic" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def send_email_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('send_email_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'send_email_1' call\n formatted_data_1 = phantom.get_format_data(name='format_for_emailer')\n\n parameters = []\n \n # build parameters list for 'send_email_1' call\n parameters.append({\n 'cc': \"\",\n 'to': \"recipient@phantom.localhost\",\n 'bcc': \"\",\n 'body': formatted_data_1,\n 'from': \"automation@phantom.localhost\",\n 'headers': \"\",\n 'subject': \"Malware event confirmed\",\n 'attachments': \"\",\n })\n\n phantom.act(action=\"send email\", parameters=parameters, assets=['smtp'], name=\"send_email_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": true, + "connection_name": "hunt file 1, hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Send the formatted string as an email.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 269, + "line_start": 243, + "message": "Configuring now", + "name": "send email", + "notes": "Send the formatted string as an email.", + "number": 1, + "order": 11, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1640, + "y": 100 + }, + "previous_function": "", + "previous_name": "send_email_1", + "required_params": { + "body": true, + "to": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Generic", + "type": "coa.Action", + "warn": "", + "z": 2069 + } + ] + }, + "notes": "The playbook uses the following Apps: \n - Virus Total (file reputation) [asset name = virustotal]\n - Palo Alto Networks Wildfire (detonate file) [asset name = wildfire]\n - Carbon Black (hunt file) [asset name = carbonblack]\n - SMTP (send email) [asset name = smtp]\n\nBe sure to update asset naming to reflect the asset names configured in your environment." + }, + "python_version": "3", + "schema": 4, + "version": "4.10.0.40961" + }, + "create_time": "2021-01-19T21:50:52.204902+00:00", + "draft_mode": false, + "labels": [ + "*" + ], + "tags": [] +} \ No newline at end of file diff --git a/playbooks/email_notification_for_malware.png b/playbooks/email_notification_for_malware.png new file mode 100644 index 0000000000..bc5bb024d6 Binary files /dev/null and b/playbooks/email_notification_for_malware.png differ diff --git a/playbooks/email_notification_for_malware.py b/playbooks/email_notification_for_malware.py new file mode 100644 index 0000000000..020befaecf --- /dev/null +++ b/playbooks/email_notification_for_malware.py @@ -0,0 +1,338 @@ +""" +This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team. +""" + +import phantom.rules as phantom +import json +from datetime import datetime, timedelta +def on_start(container): + phantom.debug('on_start() called') + + # call 'filter_1' block + filter_1(container=container) + + return + +""" +Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware. +""" +def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('file_reputation_1() called') + + # collect data for 'file_reputation_1' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_1:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'file_reputation_1' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'hash': filtered_artifacts_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="file reputation", parameters=parameters, assets=['virustotal'], callback=filter_2, name="file_reputation_1") + + return + +""" +Hunt for binaries with the malicious fileHash across endpoints. +""" +def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('hunt_file_2() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'hunt_file_2' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", "filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'hunt_file_2' call + for filtered_results_item_1 in filtered_results_data_1: + if filtered_results_item_1[0]: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'type': "", + 'range': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name="hunt_file_2") + + return + +""" +Detonate file requires a Vault file, so only proceed if vaultId is not null. +""" +def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_4() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["filtered-data:filter_3:condition_1:artifact:*.cef.vaultId", "!=", ""], + ], + name="filter_4:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + detonate_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Only hunt files that are considered malware per the sandbox (malware == yes). +""" +def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_5() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["detonate_file_1:action_result.summary.malware", "==", "yes"], + ], + name="filter_5:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Match hashes with less than 10 positives to artifacts to identify filtered_artifacts. +""" +def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_3() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash", "==", "artifact:*.cef.fileHash"], + ], + name="filter_3:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first. +""" +def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_2() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">=", 10], + ], + name="filter_2:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + # collect filtered artifact ids for 'if' condition 2 + matched_artifacts_2, matched_results_2 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", "<", 10], + ], + name="filter_2:condition_2") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_2 or matched_results_2: + filter_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2) + + return + +""" +Hunt for binaries with the malicious fileHash across endpoints. +""" +def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('hunt_file_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'hunt_file_1' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'hunt_file_1' call + for filtered_results_item_1 in filtered_results_data_1: + if filtered_results_item_1[0]: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'type': "", + 'range': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name="hunt_file_1") + + return + +""" +Only process artifacts that have a CEF fileHash. +""" +def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_1() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["artifact:*.cef.fileHash", "!=", ""], + ], + name="filter_1:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + file_reputation_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Detonate the file(s) in the vault. +""" +def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('detonate_file_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'detonate_file_1' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.vaultId', 'filtered-data:filter_4:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'detonate_file_1' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'vault_id': filtered_artifacts_item_1[0], + 'file_name': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="detonate file", parameters=parameters, assets=['wildfire'], callback=filter_5, name="detonate_file_1") + + return + +""" +Send the formatted string as an email. +""" +def send_email_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('send_email_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'send_email_1' call + formatted_data_1 = phantom.get_format_data(name='format_for_emailer') + + parameters = [] + + # build parameters list for 'send_email_1' call + parameters.append({ + 'cc': "", + 'to': "recipient@phantom.localhost", + 'bcc': "", + 'body': formatted_data_1, + 'from': "automation@phantom.localhost", + 'headers': "", + 'subject': "Malware event confirmed", + 'attachments': "", + }) + + phantom.act(action="send email", parameters=parameters, assets=['smtp'], name="send_email_1") + + return + +""" +Format all results for an email. +""" +def format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('format_for_emailer() called') + + template = """Malware in a security event has been confirmed using file reputation and/or file detonation services. + +Reputation Results: +Using file reputation services, the following file hashes have been identified as malware: +{0} + +EDR tool detects that the above file hashes are present on the following endpoints: +{1} + +Detonation Results: +Using sandboxing services, the following file hashes have been identified as malware: +{2} + +The Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows: +{3} + +EDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: +{4} + +Container id: {5} + +[EOM]""" + + # parameter list for template variable replacement + parameters = [ + "hunt_file_1:action_result.parameter.hash", + "hunt_file_1:action_result.data.*.process.results.*.hostname", + "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", + "filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id", + "hunt_file_2:action_result.data.*.process.results.*.hostname", + "container:id", + ] + + phantom.format(container=container, template=template, parameters=parameters, name="format_for_emailer") + + send_email_1(container=container) + + return + +def join_format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None): + phantom.debug('join_format_for_emailer() called') + + # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed + if phantom.completed(action_names=['hunt_file_1', 'hunt_file_2']): + + # call connected block "format_for_emailer" + format_for_emailer(container=container, handle=handle) + + return + +def on_finish(container, summary): + phantom.debug('on_finish() called') + # This function is called after all actions are completed. + # summary of all the action and/or all details of actions + # can be collected here. + + # summary_json = phantom.get_summary() + # if 'result' in summary_json: + # for action_result in summary_json['result']: + # if 'action_run_id' in action_result: + # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False) + # phantom.debug(action_results) + + return \ No newline at end of file diff --git a/playbooks/email_notification_for_malware.yml b/playbooks/email_notification_for_malware.yml new file mode 100644 index 0000000000..a6c5b70531 --- /dev/null +++ b/playbooks/email_notification_for_malware.yml @@ -0,0 +1,23 @@ +name: Email Notification for Malware +id: fb3edc76-ff2b-48b0-5f6f-63da6483fd63 +version: 1 +date: '2021-01-19' +author: Philip Royer, Splunk +type: Response +description: This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team. +playbook: email_notification_for_malware +how_to_implement: "Be sure to update asset naming to reflect the asset names configured in your environment." +references: [] +app_list: +- "VirusTotal" +- "WildFire" +- "CarbonBlack Response" +- "SMTP" +tags: + platform_tags: + - Response + playbook_fields: + - fileHash + - vaultId + product: + - Splunk SOAR \ No newline at end of file diff --git a/playbooks/malware_hunt_and_contain.json b/playbooks/malware_hunt_and_contain.json new file mode 100644 index 0000000000..ab2ede583c --- /dev/null +++ b/playbooks/malware_hunt_and_contain.json @@ -0,0 +1,11686 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Use Cases", + "coa": { + "data": { + "clean": true, + "code_block": "\"\"\"Malicous file detected on endpoint\"\"\"", + "description": "This playbook investigates and remediates malware infections on the endpoint.", + "hash": "d1af271dc2c9e67bf0393c4503368436c574f31a", + "joint": { + "cells": [ + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "5ad21936-f8c5-45e3-ab48-4aa74d2185b3", + "router": { + "name": "metro" + }, + "source": { + "id": "4c86e34b-13d5-4884-b1d2-53d1f3448f91", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 14 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "c168d4c9-945d-4742-a662-6e4abbc945da", + "router": { + "name": "metro" + }, + "source": { + "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 651 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "3949529c-aff6-4401-90d8-a70c288b74d5", + "router": { + "name": "metro" + }, + "source": { + "id": "b9591115-e22e-48e0-952d-47c76448f051", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "0444efd4-6363-4dea-acca-b0c02ce9f973", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1290 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "9b55f239-b39d-4fe3-adda-f6168661b33a", + "router": { + "name": "metro" + }, + "source": { + "id": "72f13962-4d43-44be-9710-d2ed60cbbf00", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "0444efd4-6363-4dea-acca-b0c02ce9f973", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1558 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "9c84c8ba-08f4-4cec-acfd-c4dbccbbc66e", + "router": { + "name": "metro" + }, + "source": { + "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1694 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "b415fd2a-3939-4c18-a92e-efa93d32b1c6", + "router": { + "name": "metro" + }, + "source": { + "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "port": "in", + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1706 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "961848a5-5fd4-4e3b-8b7b-6ef40ea4d007", + "router": { + "name": "metro" + }, + "source": { + "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "port": "in", + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1710 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "1649dbd5-f0bf-43ec-951b-5ad008365d1d", + "router": { + "name": "metro" + }, + "source": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "b9591115-e22e-48e0-952d-47c76448f051", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1718 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "0db3fd7f-4779-44c3-8ea3-694bad0388d9", + "router": { + "name": "metro" + }, + "source": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1886 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "88f69577-f71a-4ee0-8386-9ab6bcd33e28", + "router": { + "name": "metro" + }, + "source": { + "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1892 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "48627df2-9bc5-40fa-858e-426631c72ab9", + "router": { + "name": "metro" + }, + "source": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "91866693-2720-43a1-a437-f65f19382b9a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1903 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "fbce023e-da26-4df2-829b-99d0a167cdd0", + "router": { + "name": "metro" + }, + "source": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "port": "out-2", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1968 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "509e0e96-ee20-4dd7-8a04-e5a9b8f1db85", + "router": { + "name": "metro" + }, + "source": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1982 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "f5d00299-537c-4bf8-b86b-a500fa1c2258", + "router": { + "name": "metro" + }, + "source": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1988 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ee268141-044c-48e5-b1ad-29803892a264", + "router": { + "name": "metro" + }, + "source": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1992 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "0a60f02d-fb84-4d21-af04-0adc070f3ccf", + "router": { + "name": "metro" + }, + "source": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "port": "out-2", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "e6a1a311-5337-4d44-b8d3-58d8a6cf8be1", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 2050 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "562f6e73-5fb8-4722-b99b-7b2b91109a37", + "router": { + "name": "metro" + }, + "source": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 2324 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "14967b49-8e3a-4a08-8c66-53f7e7b5b4b2", + "router": { + "name": "metro" + }, + "source": { + "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "port": "in", + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 2339 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d580f77a-9877-4c13-9a40-308797deca8d", + "router": { + "name": "metro" + }, + "source": { + "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 2544 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "c2f5849d-4fa9-4a35-93df-7570b63d2304", + "router": { + "name": "metro" + }, + "source": { + "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "72f13962-4d43-44be-9710-d2ed60cbbf00", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 2557 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 3 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 5],\n [\"file_reputation_1:action_result.summary.positives\", \"<=\", 10],\n ],\n logical_operator='and',\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n create_ticket_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": false, + "connection_name": "block hash 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "hasElse": false, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 44, + "line_start": 24, + "name": "filter", + "notes": "", + "number": 3, + "order": 2, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": ">", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "5" + }, + { + "comparison": "<=", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1080, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "filter_3", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2590 + }, + { + "action": "shutdown system", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname", + "message": "", + "wait_time": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname", + "message": "", + "ph": "", + "wait_time": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "domainctrl1", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.wait_time", + "data_type": "numeric" + }, + { + "data_path": "action_result.parameter.message", + "data_type": "string" + }, + { + "column_name": "Machine Ip Name", + "column_order": 0, + "contains": [ + "ip", + "host name" + ], + "data_path": "action_result.parameter.ip_hostname", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string" + }, + { + "column_name": "Total Objects", + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "column_name": "Total Objects Successful", + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "shutdown system" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def shutdown_system_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('shutdown_system_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'shutdown_system_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'shutdown_system_1' call\n for results_item_1 in results_data_1:\n parameters.append({\n 'ph': \"\",\n 'message': \"\",\n 'wait_time': \"\",\n 'ip_hostname': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"shutdown system\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"shutdown_system_1\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 69, + "line_start": 44, + "message": "Configuring now", + "name": "shutdown system", + "notes": "", + "number": 1, + "order": 3, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 760 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "shutdown_system_1", + "required_params": {}, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2794 + }, + { + "action": "create ticket", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "description": "", + "fields": "", + "short_description": "Virus Detected" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "description": "", + "fields": "", + "short_description": "Virus Detected", + "table": "", + "vault_id": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "servicenow", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.short_description", + "data_type": "string" + }, + { + "contains": [ + "servicenow table" + ], + "data_path": "action_result.parameter.table", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.fields", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.description", + "data_type": "string" + }, + { + "contains": [ + "servicenow ticket id" + ], + "data_path": "action_result.summary.created_ticket_id", + "data_type": "string" + }, + { + "contains": [ + "vault id" + ], + "data_path": "action_result.parameter.vault_id", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_updated_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_updated_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.escalation", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.watch_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.follow_up", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.made_sla", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.delivery_task", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sla_due", + "data_type": "string" + }, + { + "column_name": "Number", + "column_order": 0, + "data_path": "action_result.data.*.number", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.caller_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.correlation_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_mod_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.notify", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.resolved_by", + "data_type": "string" + }, + { + "column_name": "Closed On", + "column_order": 6, + "data_path": "action_result.data.*.closed_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_tags", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.cmdb_ci", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.subcategory", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.category", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.close_notes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.expected_start", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.knowledge", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.opened_by.link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.opened_by.value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.impact", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.calendar_stc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.caused_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.comments", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.problem_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.activity_due", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.state", + "data_type": "string" + }, + { + "column_name": "ID", + "column_order": 4, + "contains": [ + "servicenow ticket id" + ], + "data_path": "action_result.data.*.sys_id", + "data_type": "string" + }, + { + "column_name": "Opened On", + "column_order": 5, + "data_path": "action_result.data.*.opened_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.child_incidents", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_notes", + "data_type": "string" + }, + { + "column_name": "Short Description", + "column_order": 0, + "data_path": "action_result.data.*.short_description", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.comments_and_work_notes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.time_worked", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_created_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.upon_reject", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.reassignment_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_stc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.due_date", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_class_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.delivery_plan", + "data_type": "string" + }, + { + "column_name": "Description", + "column_order": 1, + "data_path": "action_result.data.*.description", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.parent", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_duration", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.rfc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.company", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.assigned_to", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval_history", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.user_input", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_start", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain.link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain.value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.resolved_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.calendar_duration", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.group_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.active", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.parent_incident", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain_path", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.closed_by", + "data_type": "string" + }, + { + "column_name": "Severity", + "column_order": 2, + "data_path": "action_result.data.*.severity", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.upon_approval", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.incident_state", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.reopen_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.contact_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_end", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_notes_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_created_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.location", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.correlation_display", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.close_code", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.assignment_group", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval_set", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.order", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.urgency", + "data_type": "string" + }, + { + "column_name": "Priority", + "column_order": 2, + "data_path": "action_result.data.*.priority", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.hold_reason", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_service", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_tags", + "data_type": "string" + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.attachment_details.*.file_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.compressed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.size_bytes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.table_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.image_width", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.content_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.image_height", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.table_sys_id", + "data_type": "string" + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.attachment_details.*.download_link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_mod_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_created_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_created_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_updated_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_updated_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.size_compressed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.average_image_color", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.additional_assignee_list", + "data_type": "string" + }, + { + "data_path": "action_result.summary.attachment_id", + "data_type": "string" + }, + { + "data_path": "action_result.summary.attachment_added", + "data_type": "boolean" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "ticketing" + } + ], + "attrs": { + ".action": { + "text": "create ticket 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Utilities" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "# read-only block view not available", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": false, + "connection_name": "logoff user, shutdown system, disable user, block hash 3", + "connection_type": "action", + "custom_callback": "", + "custom_code": "def create_ticket_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'create_ticket_2' call\n\n disabled_users = set(phantom.collect2(datapath='disable_user_1:action_result.parameter.username'))\n blocked_hashes = set(phantom.collect2(datapath='block_hash_3:action_result.parameter.hash'))\n loggedoff_users = set(phantom.collect2(datapath='logoff_user_1:action_result.parameter.username'))\n shutdown_systems = set(phantom.collect2(datapath='shutdown_system_1:action_result.parameter.ip_hostname'))\n file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash', \n 'file_reputation_1:filtered-action_result.summary.positives'])\n detected_users = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.username'))\n detected_systems = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.hostname'))\n \n title = \"Virus Detected on {0} devices\".format(len(detected_systems))\n \n description = \"Hashes sumbitted with detections:\\n{0}\\n\\n\".format(\", \".join([\"{0} ({1})\".format(*fr) for fr in file_reputation]))\n description += \"File was found on {0} devices:\\n{1}\\n\\n\".format(len(detected_systems), ', '.join(detected_systems))\n description += \"This impacts at least {0} users:\\n{1}\\n\\n\".format(len(detected_users), ', '.join(detected_users))\n if len(blocked_hashes):\n description += \"{0} hashes were submitted for blocking:\\n{1}\\n\\n\".format(len(blocked_hashes), \", \".join(blocked_hashes))\n if len(loggedoff_users):\n description += \"{0} users were forced to logoff:\\n{1}\\n\\n\".format(len(loggedoff_users), \", \".join(loggedoff_users))\n if len(disabled_users):\n description += \"{0} user accounts were disabled:\\n{1}\\n\\n\".format(len(disabled_users), \", \".join(disabled_users))\n if len(shutdown_systems):\n description += \"{0} systems were shutdown:\\n{1}\\n\\n\".format(len(shutdown_systems), \", \".join(shutdown_systems))\n\n parameters = []\n \n # build parameters list for 'create_ticket_2' call\n parameters.append({\n 'short_description': title,\n 'description': description,\n 'fields': \"\",\n })\n\n if parameters:\n phantom.act(\"create ticket\", parameters=parameters, assets=['servicenow'], name=\"create_ticket_2\", parent_action=action) \n else:\n phantom.error(\"'create_ticket_2' will not be executed due to lack of parameters\")\n \n return", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": true, + "has_custom_block": true, + "has_custom_callback": false, + "has_custom_join": false, + "id": "b9591115-e22e-48e0-952d-47c76448f051", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 114, + "line_start": 69, + "message": "Configuring now", + "name": "create ticket", + "notes": "", + "number": 2, + "order": 4, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1220, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "create_ticket_2", + "required_params": {}, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Utilities", + "type": "coa.Action", + "warn": false, + "z": 2825 + }, + { + "action": "logoff user", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname", + "username": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname", + "username": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "domainctrl1", + "output": [ + { + "column_name": "Username", + "column_order": 0, + "contains": [ + "user name" + ], + "data_path": "action_result.parameter.username", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "contains": [ + "ip", + "host name" + ], + "data_path": "action_result.parameter.ip_hostname", + "data_type": "string" + }, + { + "column_name": "Total Objects", + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "column_name": "Total Objects Successful", + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "logoff user" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def logoff_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('logoff_user_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'logoff_user_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'logoff_user_1' call\n for results_item_1 in results_data_1:\n parameters.append({\n 'username': \"\",\n 'ip_hostname': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"logoff user\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"logoff_user_1\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 166, + "line_start": 143, + "message": "Configuring now", + "name": "logoff user", + "notes": "", + "number": 1, + "order": 6, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 620 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "logoff_user_1", + "required_params": {}, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2827 + }, + { + "0": "S", + "1": "T", + "2": "A", + "3": "R", + "4": "T", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "ref-x": 33, + "ref-y": 8, + "text": "START" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "ref-x": 13, + "xlink:href": "/inc/coa/img/block_icon_start.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'file_reputation_1' block\n file_reputation_1(container=container)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "4c86e34b-13d5-4884-b1d2-53d1f3448f91", + "inPorts": [], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 24, + "line_start": 16, + "name": "", + "notes": "", + "number": 0, + "order": 1, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 80, + "y": 100 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "START", + "type": "coa.StartEnd", + "warn": false, + "z": 2895 + }, + { + "0": "E", + "1": "N", + "2": "D", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".title": { + "text": "END" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_end.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "create ticket 2, create ticket 3", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "0444efd4-6363-4dea-acca-b0c02ce9f973", + "inPorts": [ + "in" + ], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 456, + "line_start": 443, + "name": "", + "notes": "", + "number": 0, + "order": 17, + "outPorts": [], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1460, + "y": 100 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "END", + "type": "coa.StartEnd", + "warn": false, + "z": 2901 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 1 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + ".outPorts>.port-1": { + "port": { + "id": "out-2", + "type": "out" + }, + "ref-x": 41, + "ref-y": 82 + }, + ".outPorts>.port-1>.port-body": { + "port": { + "id": "out-2", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 5],\n [\"file_reputation_1:action_result.summary.positives\", \"<=\", 10],\n ],\n logical_operator='and',\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n get_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n # collect filtered artifact ids for 'if' condition 2\n matched_artifacts_2, matched_results_2 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 10],\n ],\n name=\"filter_1:condition_2\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_2 or matched_results_2:\n hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n get_file_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "hasElse": false, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 201, + "line_start": 166, + "name": "filter", + "notes": "", + "number": 1, + "order": 7, + "outPorts": [ + "out-1", + "out-2" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": ">", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "5" + }, + { + "comparison": "<=", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + }, + { + "conditions": [ + { + "comparison": ">", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 460, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "filter_1", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2941 + }, + { + "action": "hunt file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7", + "13ded573464ba7f43fe640479b309e09", + "9bf50324444c46997c2492d505b47f2d", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.range", + "data_type": "string", + "example_values": [ + "0-10", + "0-2", + "5-8" + ] + }, + { + "contains": [ + "carbon black query type" + ], + "data_path": "action_result.parameter.type", + "data_type": "string", + "example_values": [ + "process", + "binary" + ] + }, + { + "data_path": "action_result.data.*.binary.elapsed", + "data_type": "numeric", + "example_values": [ + 0.1120398044586182, + 0.04952096939086914, + 0.1234798431396484, + 0.05507302284240723, + 0.05384993553161621 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", + "data_type": "string", + "example_values": [ + "2018-10-01T00:00:00Z", + "2015-01-01T00:00:00Z", + "2013-11-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.name", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "CB-TEST-02", + "WIN7-CLIENT1", + "ACCOUNTING-PC" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "16.7" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "C:\\Windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "50.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", + "data_type": "string", + "example_values": [ + "2018-10-19T00:00:00Z", + "2018-09-29T00:00:00Z", + "2018-10-02T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.highlights.*.ids", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.highlights.*.name", + "data_type": "string", + "example_values": [ + "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", + "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", + "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 510, + 511 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_issuer", + "data_type": "string", + "example_values": [ + "Microsoft Code Signing PCA" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Corp." + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-10-14T20:23:00Z", + "2015-01-30T19:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_subject", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.endpoint", + "data_type": "string", + "example_values": [ + "CB-TEST-02|27", + "WIN7-CLIENT1|15", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.event_partition_id", + "data_type": "numeric", + "example_values": [ + 100972684312576, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.facet_id", + "data_type": "numeric", + "example_values": [ + 883737, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_desc", + "data_type": "string", + "example_values": [ + "Microsoft Office Click-to-Run (SxS)", + "Microsoft Network Realtime Inspection Service", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.host_count", + "data_type": "numeric", + "example_values": [ + 1, + 6 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.internal_name", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.last_seen", + "data_type": "string", + "example_values": [ + "2018-10-28T10:06:02.456Z", + "2018-10-28T10:06:42.455Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.md5", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.original_filename", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "column_name": "Signed", + "column_order": 1, + "data_path": "action_result.data.*.binary.results.*.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-07-01T02:20:02.062Z", + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.binary.start", + "data_type": "numeric", + "example_values": [ + 0, + 5 + ] + }, + { + "data_path": "action_result.data.*.binary.terms", + "data_type": "string", + "example_values": [ + "md5:13ded573464ba7f43fe640479b309e09", + "md5:9bf50324444c46997c2492d505b47f2d", + "md5:5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.total_results", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.process.all_segments", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.comprehensive_search", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.elapsed", + "data_type": "numeric", + "example_values": [ + 0.2200779914855957 + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.value", + "data_type": "numeric", + "example_values": [ + 1566 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 10128 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.name", + "data_type": "string", + "example_values": [ + "domain_controller" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.value", + "data_type": "numeric", + "example_values": [ + 10123 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "dc2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "51.2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 5185 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", + "data_type": "numeric", + "example_values": [ + 411 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.parent_name.*.name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.facets.path_full.*.name", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.facets.process_md5.*.name", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.process_name.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.name", + "data_type": "string", + "example_values": [ + "2018-02-24T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.value", + "data_type": "numeric", + "example_values": [ + 324 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.name", + "data_type": "string", + "example_values": [ + "LOCAL SERVICE" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.4" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.value", + "data_type": "numeric", + "example_values": [ + 9966 + ] + }, + { + "data_path": "action_result.data.*.process.incomplete_results", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.childproc_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.process.results.*.cmdline", + "data_type": "string", + "example_values": [ + "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.comms_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.crossproc_count", + "data_type": "numeric", + "example_values": [ + 2 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_config", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filemod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.group", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.host_type", + "data_type": "string", + "example_values": [ + "workstation" + ] + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.process.results.*.hostname", + "data_type": "string", + "example_values": [ + "win7-client1" + ] + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.process.results.*.id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.interface_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_server_update", + "data_type": "string", + "example_values": [ + "2018-03-22T09:21:32.332Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_update", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.82Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.modload_count", + "data_type": "numeric", + "example_values": [ + 43 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.netconn_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.os_type", + "data_type": "string", + "example_values": [ + "windows" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_md5", + "data_type": "string", + "example_values": [ + "000000000000000000000000000000" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.results.*.parent_name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_pid", + "data_type": "numeric", + "example_values": [ + 600 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.path", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.process_md5", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "process name", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.process_name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.process.results.*.process_pid", + "data_type": "numeric", + "example_values": [ + 1672 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.processblock_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.regmod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.segment_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.process.results.*.sensor_id", + "data_type": "numeric", + "example_values": [ + 15 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.start", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.758Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.terminated", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243-000000000001" + ] + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.process.results.*.username", + "data_type": "string", + "example_values": [ + "SYSTEM" + ] + }, + { + "data_path": "action_result.data.*.process.start", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.terms", + "data_type": "string", + "example_values": [ + "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.total_results", + "data_type": "numeric", + "example_values": [ + 32404 + ] + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "numeric", + "example_values": [ + 32404, + 1 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Displaying 10 'process' results of total 32404", + "Displaying 1 'binary' results of total 1", + "Displaying 0 'binary' results of total 1" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt file 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_2' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_2' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=hunt_file_2_callback, name=\"hunt_file_2\")\n\n return", + "callback_code": "def hunt_file_2_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('hunt_file_2_callback() called')\n \n disable_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n logoff_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n shutdown_system_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n block_hash_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n return", + "callback_start": 226, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 236, + "line_start": 201, + "message": "Configuring now", + "name": "hunt file", + "notes": "", + "number": 2, + "order": 8, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "hunt_file_2", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2944 + }, + { + "action": "get file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "file_source": "", + "get_count": "", + "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", + "offset": "", + "ph_0": "", + "sensor_id": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.parameter.file_source", + "data_type": "string", + "example_values": [ + "C:\\\\Windows\\\\CarbonBlack\\\\Sensor.LOG" + ] + }, + { + "data_path": "action_result.parameter.get_count", + "data_type": "numeric", + "example_values": [ + 1024 + ] + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "75E683BC8284D99F998500162BE4CFE2", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.offset", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.parameter.sensor_id", + "data_type": "numeric", + "example_values": [ + 27 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.file_details.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.file_details.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.file_details.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.file_details.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 511 + ] + }, + { + "data_path": "action_result.data.*.file_details.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.file_details.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 489984, + 16896 + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-02-12T10:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.endpoint", + "data_type": "string", + "example_values": [ + "WIN10-TEST-EP|28", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.file_details.event_partition_id", + "data_type": "numeric", + "example_values": [ + 99742385111040, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.file_details.facet_id", + "data_type": "numeric", + "example_values": [ + 241095, + 0 + ] + }, + { + "data_path": "action_result.data.*.file_details.file_desc", + "data_type": "string", + "example_values": [ + "WMI Provider Host", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.file_details.file_version", + "data_type": "string", + "example_values": [ + "10.0.16299.248 (WinBuild.160101.0800)", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.file_details.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.file_details.host_count", + "data_type": "numeric", + "example_values": [ + 2, + 6 + ] + }, + { + "data_path": "action_result.data.*.file_details.icon", + "data_type": "string", + "example_values": [ + "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAzoSURBVGhD1ZhXcFzlFccNPJBg8pIJY554JOGB\nzCQPhMwkDN3JJA6BkECSwYCFe5MtyepdWvW60kpa9dVKK61WWvXed9Ulq3fLEjZ2jCxjGxtcsPnn\nnKO98qp47GGIRM7M8S2r3fv/ne+U73oL/s9t0wASExPF8/JybXfub/n5+cu+2jYcwGDQy5GFT05O\nijNIUFCQ3F/PjEYjLFbr5gOw+OioCNsVRDQDDA8PIzs7+74QDDA5OYGUlBTbnXu2YQDzc58iMyMN\nJ/v7lyFYMPvs7CyuXr0KlWrperUxwJkzn6772YYB5BvyMDo6ugKAjUUNDg4KAIMwREKC2vbpkjHA\npUuX4OzsbLtzzzYMoKDAgPPnz+Py5cvQapOXISIjwmGxtAmAAuHu7iafKcYAvb292L17t+3OPdtw\ngIWFBQxRxBUIq9WyLP7ixYtYXFxERMS9FWIzmUw/DACO7vz8vAiPCA9DS3OTiFacxd+5c+eHCxAa\nGirCLW2tuHLl8grxvDIsfmZmZk2xbirA8PC4RDw8LFSE24tW/ObNm7h+/bqIt1K/D/D3t317yTYF\nQBHOvlr4lStXJNos7MaNGyJcEc+rtLqINwXA08MNNTU16wrv7OzEgQMHsGPHDhHNXllZKe7p4bFG\n6KalEEPwlGXxinAnJycRvtSBrEhKSloWHxgYSPkfYPv2PdvUGmChDHH69Oll4d3d3SJKWYXCwkLE\nxsauK55tUwHYWLRWq10jnO/zBk2lUt1XPNumA7A5OjoKhCKcU+dhxLP9zwG2bNmCRx55RI6PPvqo\nOJ+z25sCoezt+Vyj0dg+vb99JwD/qAQExycjOC4ZIWototN0SMjKQ7LeiKjUbMRn5cK8/Q1sfeyx\nJYAntmLbM8/gp9u24RfPPYdtTz+Nx+gzBYbtHad8vPaxdoXzvQfZQwOw6KDYJBEckZyBdGMJylu7\nYBmeQGP/CMrbupBf3YjMonKosw1IzMnHj378Y7z02pt470MH7Nx7CI8//ji2bt2KZwjml88/j58/\n+yyefPJJWaEdR/QIyj8pHmhYOh5LbLE9/f72UABRKVkIS0xDqsGM0uYOtI1Mo2N8FtaxU2gbnUbr\n0CRahiZQ1zuIuEw9zi0skrCf4Pevvg5dSRUyiysQk54DVXwKfCPi4BkSBbegcDgcOoafPfUUtj7x\nBN4+bhDRTbOXxRWA9dLN3h4IkKQzQEMRbSFxI/Pn0TP9KdonTsMyegqtI1MkfBLNg+M2HxMAh8NO\n+NULLyKt0CxQJS3tKG6ywFjXgtyKWqSbyqDRFyI6VUdA8bIq77oYRXiWZQ4uKVa8+lHK97MC5uoG\n9A2P4Zs7d3H7m7u4fuMmLl65hrnPFzE6fw49UwQzMonGgVHU9w2jtmcQZW2dKKhpQmF9C8otXTA3\nW2BqaKF7jcitrIOurFpWJa2wDNkl1fj1b36Lf3oUo2HmC0SYh8UVAJ/wWPFQjVZErbYHAmSbqzBw\n6iwmP1vA/MIXWLh6DV9+dQNf37pNfkuAFuneGUqb8fmz6J2cgWVoDFXtPQJQ1NRG4lsp+s0wMACt\nQHZpFTKoVrQFZqQWlmL7W3/HTr9SWM9eQ5hpSFwBCIxOQmCMBgHRict1GKZJI6BUeIerHwKgtIby\nnaI8Nkt+Cu2U+91Tcxg8fRZTZy/g7MVLWPzyGq59TVA3b8nx4uWrmDt/AYPTs2jpG6Bib4fRTrxE\n31SKlPxiqHXU76kxfBxUjp4LXyG44KS4AuAXmQjfMDV8wuIREJkA79BYHDzhiz3HPXDI3f/BADll\ntZL3HRNzsJJ4hmilIm4enoJ1YpaKeEpSyEreO3EKI7PzmDl7HmcuLODcxUUp6Llz/8Hw9ClY+gZR\nQemURymUZjRLtwrTpEOVkAqHkCoMLt6Ef24v/PU9dgAc9WS4+Idhn5MXdh0+AYejblL0XDNFveeg\nbZjBLlUl/uVpxu/eTxDxbAKgzs5HfKYBGaYKKkQuxpXOLZS9gbymewDVnX3itV19aOg5idb+IXRS\nSvWNTaJ/fAo9I+Noo1WpplUprKpHJqVQEhX0J6HVGLlyG97ZXeIKgBdFfL+LNz465IxPHN2wx8kT\n++iaAez9lQ+TxdcAcOG1UHfhPq+jgovNyBV3OeYozucM0Do8KR2HxVdYu1Ha2kmA3Hko92k+5FXW\nw0AFXEBNwVTbRN4IE50b6X4etVpegbGr38AjvUNcARDhx9yx19mLhPvggKsfDrr546hnkAh3Trbg\nffciOX/hnSgRrpgA6DmFpubRNX0aXVOz4iy6yGyCnl4FuQDjMvKoyJJowGXRADMiy1wpQ40BuJAN\nVQ3UeWrofgVSaQCq6W8Sc02Iy8qX78am67EruAJT1+/AVWsVVwD2UtrsP+FDov1w2D0AR72C4ewX\nAiefYBGd3jwLx4QWgbCPPpsAZBVVossu/9upoBmA7dT8nAC0j01RYVPBUqpUWLugL6+VtPMMiZUu\nEp6USdsL2moYimi7UQB1Rs6yhySkIZj8o8ByTH91F05JbeIKwCGK9mGPQDh6q6QOjnsHyW6gpNm6\nBuClf2tWDD05yzCVy9RtG52RCWyhIwNkZWoRGkRR2e2ABur/PAPqe4fQeHKYUm6UpvQkurkL0XlZ\nW4dM5CitbkX6uQVHIig+VZzb6OyNb9cAOHqx8HA4+6rgoYqilW2Q2cHfWQ3A37Gf3PJvWkEp7Xem\naMrSxB2YQNPAuIiobKwXZ4Cqjl7xktYOFDdaYapvRT4NsjxKHU6hUrpf09UvMJxq9ukXQh3I0SsI\nH/iWYP424JbaLq4AuAaGS7ok55noty006Q0IScygzpWxBuCNT9KXAcQZQGsoRguJru/nSTtCk3aI\n+nglkpPU4i5+4Sim/ZG5pYMGVhuMtZTzlP/6ijrq+dU0sCqgpbxPyitCAuU+A7Ap6VdHnaqThh+3\nwDN3sKILHVU3EyClC3WslIISRKToEKnNkaNzYMoagD/sy8LLb/usBOAWV987TN1lAJXt/ZTjfSiz\n9CylAonPJaFFFPUC2ucYqprouh46Gn6ZVMhptOdJyTdDk0vidQVUtAYBsE8/3gt5RySIgPPfAr45\nPeIMcDiuUYqfRUenU/ej6LPHZBjwt31qAeChxwDsfP3KexErAdTUKVh4aWs3RbmLOksHCW6HiUTz\nkhrrWilVOOL1MrV5ddIKeZtwL+rcbWJIQGRqjgDYpx8XuhdN2X+4FmKBAEILB8UZYH9UPUU7WwSr\ndYV2bsRfjuol+nxk8fbXKwBiqMWVNHdSLrPYNhTUtlKKNNtEc3usRRYVVTp1q1RjGXWaEom4OqdQ\nhHPkWHg4CQnVZAqAkn4fH3SBe0gc3FWxshu9RABxFePiDLAnvEYinpBjorZbJL+r+J8O5ohgPjKA\n/fUKgEh6cCEJ11c0Iqeco0yCzTWU21W0ESun3Cwl0WZ5QAKJjs8ukIcqwsNYOLVRVUI6AuO18I+l\n1KB+zuK9w+LgpoqBa1CUvH19TgAp9dPiDMDDLVFvopUsRhLVIj8nyeac70l103JkAPtrFs8m/3Kf\nDiMBUWm5snT8Y/xDktci2JYitMzRaXoSrado6+g7WQjRZEiPD4xLFeF+FH3viER40S7SPZTEBy+J\ndwmIxFuOufjsLqBrnxNnAJ4NGkpD5ZlcT+x8zh0ntmxUjgxgf62YAPhGqmXy8dbVJ0JND4+HD+0Q\nA+K0BJeBsGQdIqjIwpI50iSaWlwwRTtIbRMeQ29hJNwnSkPfTYAn5bs75b1rcDRO2MQ7U59fD4Bb\n60qAEhtAsXyuMg7IkQHsrxVbWodVplLzPjwenrTJcldFUxTJKQ04qr6RGhKcLHB+inC6x13Gkz73\n4KhTvov4QBYfASc/mq6+ofJOfPoW1VzZmDgL4ZccDW05lgCWnBtDMkHw1OV2y0cGsL9WbF2A1ca7\nxRMB4TTqg0WQM527kLNIN4o0pwoL52J1JVCJeiBHfUn8MZ9QOPqopPg48vxewM4A3JkSKU01VAdL\nxWui7lYqw4z3PfzqyUcGsL9W7KEAVpvDERcqUn8cdPWV/QtH97hfqIjlVHFil6iz+BD5myO0Qfvj\n/mzEli9Fn4/sXNgJVHfcivkdWkuR9wyNxl/f34kX340R4esdFftOAKvtw/3H6AXEVV5GeB9/hLbB\nvKNkd5RjEN0LxPa9mSJaWQE+57rg95FEEh+VqsO+4+54efsO+V3eOrPg9Y6KfS8Aq83h6Ans3OdI\nK3WCoDxlm8yvhm/uyRDhh+j6AG2f+fzPh/QCwO/CB1w8bb+wZJsGsNoY5oO9R/Hm7iWA3fTycoDe\nefmc02q/syd27j1i++t7tj+yTsTazwG+5u2HYhsCoBgD8H9msXB2Pue0up+98V4IXt9FO1kSrzhf\n833FNhSAH8ydx97txaxnCoTiq/9+QwG+fwP+CyGRvQpx7eyKAAAAAElFTkSuQmCC\n", + "iVBORw0KGgoAAAANSUhEUgAAACUAAAAlCAYAAADFniADAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlz\nAAAewgAAHsIBbtB1PgAAAjJJREFUWEftWEFrGkEYVQIqGtFTjrmF/IEYWLzEgOQQiBCIEPaiEATb\n9CA0eKiFlgqlBw9CI9Yl1kjjIhYPNSgpSkuN4kXPXgr+k9f5Ju7SYoNDaY2UGXh833z7vuHxdnbZ\nHYtFDkEH0un0zbIgEoncMNmXFiYIlUoFtVoNiUSCI5VK8Ui1YrHI83g8jmw2a9aoTjA4lFMfxXK5\n/EudOAaPYjKZRKFQ4DUDmqaBiQIT9Z2L6nQ6SKe72N1N4uAgg729FyaoRtjffw1V/cDrNKd4ePgW\nx8fvcXT0zqzRNZqfnn7jHOqLRutm38nJNedSjTgGzs6qs6K2t78wlc8ZOtNIOeHNNGo/5VR7yvCK\n4Wp6nXKjh9a469vYyEJRPmJt7RG83ifw+z9hc/MZVlYeY2vrGjs7X7G+fgGf7+V9omgxUZCI+dzz\n81v0+33EYjEEg0Get1otuFwulEolPldVlYny/Q1R8wWR6EymjXa7zW5XFIFAgOf1eh1OpxP5fJ7P\nw+HwYkWtrvrZbfPC4XDAZrPx3OPxwGq1wu1287ndbv+9KF2/hab9C1yxdbW5oCd75unTdX1uo8ji\nf8JpNBr81TAjKpfLoVqtotvtLhy9Xu9+UcPhEA8xJpOJFCVkvHRKyCZGkk5Jp0QdEOXJPSWdEnVA\nlCf3lHRK1AFRntxT/6dTzWYTg8EA4/F44RiNRrPf6MZJCZ2WPBTob8r8xQqFQlgWKIpydxTExucl\nw6Xged9iaT8A6ipWINQO9M4AAAAASUVORK5CYII=\n" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.file_details.internal_name", + "data_type": "string", + "example_values": [ + "Wmiprvse.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.file_details.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.file_details.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.file_details.last_seen", + "data_type": "string", + "example_values": [ + "2018-03-25T06:49:27.776Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "column_name": "MD5", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.file_details.md5", + "data_type": "string", + "example_values": [ + "75E683BC8284D99F998500162BE4CFE2", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.file_details.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\windows\\system32\\wbem\\wmiprvse.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.file_details.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 489984, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.file_details.original_filename", + "data_type": "string", + "example_values": [ + "Wmiprvse.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.file_details.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.file_details.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Windows Operating System" + ] + }, + { + "data_path": "action_result.data.*.file_details.product_version", + "data_type": "string", + "example_values": [ + "10.0.16299.248", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.file_details.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-02-15T01:48:13.517Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.file_details.timestamp", + "data_type": "string", + "example_values": [ + "2018-02-15T01:48:13.517Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.file_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file name", + "file path" + ], + "data_path": "action_result.data.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe", + "C:\\Windows\\CarbonBlack\\Sensor.LOG", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.session_id", + "data_type": "numeric", + "example_values": [ + 101 + ] + }, + { + "column_name": "Vault ID", + "column_order": 1, + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.data.*.vault_id", + "data_type": "string", + "example_values": [ + "08f57fd06bbd8063d5b828521654225952a8155e", + "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.cb_url", + "data_type": "string", + "example_values": [ + "https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2", + "https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.summary.file_type", + "data_type": "string", + "example_values": [ + "pe file" + ] + }, + { + "contains": [ + "file name", + "file path" + ], + "data_path": "action_result.summary.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe", + "C:\\Windows\\CarbonBlack\\Sensor.LOG", + "ping.exe" + ] + }, + { + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.summary.vault_id", + "data_type": "string", + "example_values": [ + "08f57fd06bbd8063d5b828521654225952a8155e", + "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "File type: pe file\nVault id: 08f57fd06bbd8063d5b828521654225952a8155e\nName: wmiprvse.exe\nCb url: https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2", + "Vault id: cefbc5c62d7e1f90d250ddcd35bc388a7b01f4d4, Name: C:\\Windows\\CarbonBlack\\Sensor.LOG", + "File type: pe file, Vault id: 41c4e1e9abe08b218f5ea60d8ae41a5f523e7534, Name: ping.exe, Cb url: https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "get file 3" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def get_file_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('get_file_3() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'get_file_3' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'get_file_3' call\n for filtered_results_item_1 in filtered_results_data_1:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'ph_0': \"\",\n 'offset': \"\",\n 'get_count': \"\",\n 'sensor_id': \"\",\n 'file_source': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"get file\", parameters=parameters, assets=['carbonblack'], name=\"get_file_3\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "e6a1a311-5337-4d44-b8d3-58d8a6cf8be1", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 263, + "line_start": 236, + "message": "Configuring now", + "name": "get file", + "notes": "", + "number": 3, + "order": 9, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 900 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "get_file_3", + "required_params": {}, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2945 + }, + { + "action": "get file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "file_source": "", + "get_count": "", + "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", + "offset": "", + "ph_0": "", + "sensor_id": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.parameter.file_source", + "data_type": "string", + "example_values": [ + "C:\\\\Windows\\\\CarbonBlack\\\\Sensor.LOG" + ] + }, + { + "data_path": "action_result.parameter.get_count", + "data_type": "numeric", + "example_values": [ + 1024 + ] + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "75E683BC8284D99F998500162BE4CFE2", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.offset", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.parameter.sensor_id", + "data_type": "numeric", + "example_values": [ + 27 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.file_details.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.file_details.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.file_details.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.file_details.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 511 + ] + }, + { + "data_path": "action_result.data.*.file_details.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.file_details.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 489984, + 16896 + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-02-12T10:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.endpoint", + "data_type": "string", + "example_values": [ + "WIN10-TEST-EP|28", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.file_details.event_partition_id", + "data_type": "numeric", + "example_values": [ + 99742385111040, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.file_details.facet_id", + "data_type": "numeric", + "example_values": [ + 241095, + 0 + ] + }, + { + "data_path": "action_result.data.*.file_details.file_desc", + "data_type": "string", + "example_values": [ + "WMI Provider Host", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.file_details.file_version", + "data_type": "string", + "example_values": [ + "10.0.16299.248 (WinBuild.160101.0800)", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.file_details.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.file_details.host_count", + "data_type": "numeric", + "example_values": [ + 2, + 6 + ] + }, + { + "data_path": "action_result.data.*.file_details.icon", + "data_type": "string", + "example_values": [ + "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAzoSURBVGhD1ZhXcFzlFccNPJBg8pIJY554JOGB\nzCQPhMwkDN3JJA6BkECSwYCFe5MtyepdWvW60kpa9dVKK61WWvXed9Ulq3fLEjZ2jCxjGxtcsPnn\nnKO98qp47GGIRM7M8S2r3fv/ne+U73oL/s9t0wASExPF8/JybXfub/n5+cu+2jYcwGDQy5GFT05O\nijNIUFCQ3F/PjEYjLFbr5gOw+OioCNsVRDQDDA8PIzs7+74QDDA5OYGUlBTbnXu2YQDzc58iMyMN\nJ/v7lyFYMPvs7CyuXr0KlWrperUxwJkzn6772YYB5BvyMDo6ugKAjUUNDg4KAIMwREKC2vbpkjHA\npUuX4OzsbLtzzzYMoKDAgPPnz+Py5cvQapOXISIjwmGxtAmAAuHu7iafKcYAvb292L17t+3OPdtw\ngIWFBQxRxBUIq9WyLP7ixYtYXFxERMS9FWIzmUw/DACO7vz8vAiPCA9DS3OTiFacxd+5c+eHCxAa\nGirCLW2tuHLl8grxvDIsfmZmZk2xbirA8PC4RDw8LFSE24tW/ObNm7h+/bqIt1K/D/D3t317yTYF\nQBHOvlr4lStXJNos7MaNGyJcEc+rtLqINwXA08MNNTU16wrv7OzEgQMHsGPHDhHNXllZKe7p4bFG\n6KalEEPwlGXxinAnJycRvtSBrEhKSloWHxgYSPkfYPv2PdvUGmChDHH69Oll4d3d3SJKWYXCwkLE\nxsauK55tUwHYWLRWq10jnO/zBk2lUt1XPNumA7A5OjoKhCKcU+dhxLP9zwG2bNmCRx55RI6PPvqo\nOJ+z25sCoezt+Vyj0dg+vb99JwD/qAQExycjOC4ZIWototN0SMjKQ7LeiKjUbMRn5cK8/Q1sfeyx\nJYAntmLbM8/gp9u24RfPPYdtTz+Nx+gzBYbtHad8vPaxdoXzvQfZQwOw6KDYJBEckZyBdGMJylu7\nYBmeQGP/CMrbupBf3YjMonKosw1IzMnHj378Y7z02pt470MH7Nx7CI8//ji2bt2KZwjml88/j58/\n+yyefPJJWaEdR/QIyj8pHmhYOh5LbLE9/f72UABRKVkIS0xDqsGM0uYOtI1Mo2N8FtaxU2gbnUbr\n0CRahiZQ1zuIuEw9zi0skrCf4Pevvg5dSRUyiysQk54DVXwKfCPi4BkSBbegcDgcOoafPfUUtj7x\nBN4+bhDRTbOXxRWA9dLN3h4IkKQzQEMRbSFxI/Pn0TP9KdonTsMyegqtI1MkfBLNg+M2HxMAh8NO\n+NULLyKt0CxQJS3tKG6ywFjXgtyKWqSbyqDRFyI6VUdA8bIq77oYRXiWZQ4uKVa8+lHK97MC5uoG\n9A2P4Zs7d3H7m7u4fuMmLl65hrnPFzE6fw49UwQzMonGgVHU9w2jtmcQZW2dKKhpQmF9C8otXTA3\nW2BqaKF7jcitrIOurFpWJa2wDNkl1fj1b36Lf3oUo2HmC0SYh8UVAJ/wWPFQjVZErbYHAmSbqzBw\n6iwmP1vA/MIXWLh6DV9+dQNf37pNfkuAFuneGUqb8fmz6J2cgWVoDFXtPQJQ1NRG4lsp+s0wMACt\nQHZpFTKoVrQFZqQWlmL7W3/HTr9SWM9eQ5hpSFwBCIxOQmCMBgHRict1GKZJI6BUeIerHwKgtIby\nnaI8Nkt+Cu2U+91Tcxg8fRZTZy/g7MVLWPzyGq59TVA3b8nx4uWrmDt/AYPTs2jpG6Bib4fRTrxE\n31SKlPxiqHXU76kxfBxUjp4LXyG44KS4AuAXmQjfMDV8wuIREJkA79BYHDzhiz3HPXDI3f/BADll\ntZL3HRNzsJJ4hmilIm4enoJ1YpaKeEpSyEreO3EKI7PzmDl7HmcuLODcxUUp6Llz/8Hw9ClY+gZR\nQemURymUZjRLtwrTpEOVkAqHkCoMLt6Ef24v/PU9dgAc9WS4+Idhn5MXdh0+AYejblL0XDNFveeg\nbZjBLlUl/uVpxu/eTxDxbAKgzs5HfKYBGaYKKkQuxpXOLZS9gbymewDVnX3itV19aOg5idb+IXRS\nSvWNTaJ/fAo9I+Noo1WpplUprKpHJqVQEhX0J6HVGLlyG97ZXeIKgBdFfL+LNz465IxPHN2wx8kT\n++iaAez9lQ+TxdcAcOG1UHfhPq+jgovNyBV3OeYozucM0Do8KR2HxVdYu1Ha2kmA3Hko92k+5FXW\nw0AFXEBNwVTbRN4IE50b6X4etVpegbGr38AjvUNcARDhx9yx19mLhPvggKsfDrr546hnkAh3Trbg\nffciOX/hnSgRrpgA6DmFpubRNX0aXVOz4iy6yGyCnl4FuQDjMvKoyJJowGXRADMiy1wpQ40BuJAN\nVQ3UeWrofgVSaQCq6W8Sc02Iy8qX78am67EruAJT1+/AVWsVVwD2UtrsP+FDov1w2D0AR72C4ewX\nAiefYBGd3jwLx4QWgbCPPpsAZBVVossu/9upoBmA7dT8nAC0j01RYVPBUqpUWLugL6+VtPMMiZUu\nEp6USdsL2moYimi7UQB1Rs6yhySkIZj8o8ByTH91F05JbeIKwCGK9mGPQDh6q6QOjnsHyW6gpNm6\nBuClf2tWDD05yzCVy9RtG52RCWyhIwNkZWoRGkRR2e2ABur/PAPqe4fQeHKYUm6UpvQkurkL0XlZ\nW4dM5CitbkX6uQVHIig+VZzb6OyNb9cAOHqx8HA4+6rgoYqilW2Q2cHfWQ3A37Gf3PJvWkEp7Xem\naMrSxB2YQNPAuIiobKwXZ4Cqjl7xktYOFDdaYapvRT4NsjxKHU6hUrpf09UvMJxq9ukXQh3I0SsI\nH/iWYP424JbaLq4AuAaGS7ok55noty006Q0IScygzpWxBuCNT9KXAcQZQGsoRguJru/nSTtCk3aI\n+nglkpPU4i5+4Sim/ZG5pYMGVhuMtZTzlP/6ijrq+dU0sCqgpbxPyitCAuU+A7Ap6VdHnaqThh+3\nwDN3sKILHVU3EyClC3WslIISRKToEKnNkaNzYMoagD/sy8LLb/usBOAWV987TN1lAJXt/ZTjfSiz\n9CylAonPJaFFFPUC2ucYqprouh46Gn6ZVMhptOdJyTdDk0vidQVUtAYBsE8/3gt5RySIgPPfAr45\nPeIMcDiuUYqfRUenU/ej6LPHZBjwt31qAeChxwDsfP3KexErAdTUKVh4aWs3RbmLOksHCW6HiUTz\nkhrrWilVOOL1MrV5ddIKeZtwL+rcbWJIQGRqjgDYpx8XuhdN2X+4FmKBAEILB8UZYH9UPUU7WwSr\ndYV2bsRfjuol+nxk8fbXKwBiqMWVNHdSLrPYNhTUtlKKNNtEc3usRRYVVTp1q1RjGXWaEom4OqdQ\nhHPkWHg4CQnVZAqAkn4fH3SBe0gc3FWxshu9RABxFePiDLAnvEYinpBjorZbJL+r+J8O5ohgPjKA\n/fUKgEh6cCEJ11c0Iqeco0yCzTWU21W0ESun3Cwl0WZ5QAKJjs8ukIcqwsNYOLVRVUI6AuO18I+l\n1KB+zuK9w+LgpoqBa1CUvH19TgAp9dPiDMDDLVFvopUsRhLVIj8nyeac70l103JkAPtrFs8m/3Kf\nDiMBUWm5snT8Y/xDktci2JYitMzRaXoSrado6+g7WQjRZEiPD4xLFeF+FH3viER40S7SPZTEBy+J\ndwmIxFuOufjsLqBrnxNnAJ4NGkpD5ZlcT+x8zh0ntmxUjgxgf62YAPhGqmXy8dbVJ0JND4+HD+0Q\nA+K0BJeBsGQdIqjIwpI50iSaWlwwRTtIbRMeQ29hJNwnSkPfTYAn5bs75b1rcDRO2MQ7U59fD4Bb\n60qAEhtAsXyuMg7IkQHsrxVbWodVplLzPjwenrTJcldFUxTJKQ04qr6RGhKcLHB+inC6x13Gkz73\n4KhTvov4QBYfASc/mq6+ofJOfPoW1VzZmDgL4ZccDW05lgCWnBtDMkHw1OV2y0cGsL9WbF2A1ca7\nxRMB4TTqg0WQM527kLNIN4o0pwoL52J1JVCJeiBHfUn8MZ9QOPqopPg48vxewM4A3JkSKU01VAdL\nxWui7lYqw4z3PfzqyUcGsL9W7KEAVpvDERcqUn8cdPWV/QtH97hfqIjlVHFil6iz+BD5myO0Qfvj\n/mzEli9Fn4/sXNgJVHfcivkdWkuR9wyNxl/f34kX340R4esdFftOAKvtw/3H6AXEVV5GeB9/hLbB\nvKNkd5RjEN0LxPa9mSJaWQE+57rg95FEEh+VqsO+4+54efsO+V3eOrPg9Y6KfS8Aq83h6Ans3OdI\nK3WCoDxlm8yvhm/uyRDhh+j6AG2f+fzPh/QCwO/CB1w8bb+wZJsGsNoY5oO9R/Hm7iWA3fTycoDe\nefmc02q/syd27j1i++t7tj+yTsTazwG+5u2HYhsCoBgD8H9msXB2Pue0up+98V4IXt9FO1kSrzhf\n833FNhSAH8ydx97txaxnCoTiq/9+QwG+fwP+CyGRvQpx7eyKAAAAAElFTkSuQmCC\n", + "iVBORw0KGgoAAAANSUhEUgAAACUAAAAlCAYAAADFniADAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlz\nAAAewgAAHsIBbtB1PgAAAjJJREFUWEftWEFrGkEYVQIqGtFTjrmF/IEYWLzEgOQQiBCIEPaiEATb\n9CA0eKiFlgqlBw9CI9Yl1kjjIhYPNSgpSkuN4kXPXgr+k9f5Ju7SYoNDaY2UGXh833z7vuHxdnbZ\nHYtFDkEH0un0zbIgEoncMNmXFiYIlUoFtVoNiUSCI5VK8Ui1YrHI83g8jmw2a9aoTjA4lFMfxXK5\n/EudOAaPYjKZRKFQ4DUDmqaBiQIT9Z2L6nQ6SKe72N1N4uAgg729FyaoRtjffw1V/cDrNKd4ePgW\nx8fvcXT0zqzRNZqfnn7jHOqLRutm38nJNedSjTgGzs6qs6K2t78wlc8ZOtNIOeHNNGo/5VR7yvCK\n4Wp6nXKjh9a469vYyEJRPmJt7RG83ifw+z9hc/MZVlYeY2vrGjs7X7G+fgGf7+V9omgxUZCI+dzz\n81v0+33EYjEEg0Get1otuFwulEolPldVlYny/Q1R8wWR6EymjXa7zW5XFIFAgOf1eh1OpxP5fJ7P\nw+HwYkWtrvrZbfPC4XDAZrPx3OPxwGq1wu1287ndbv+9KF2/hab9C1yxdbW5oCd75unTdX1uo8ji\nf8JpNBr81TAjKpfLoVqtotvtLhy9Xu9+UcPhEA8xJpOJFCVkvHRKyCZGkk5Jp0QdEOXJPSWdEnVA\nlCf3lHRK1AFRntxT/6dTzWYTg8EA4/F44RiNRrPf6MZJCZ2WPBTob8r8xQqFQlgWKIpydxTExucl\nw6Xged9iaT8A6ipWINQO9M4AAAAASUVORK5CYII=\n" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.file_details.internal_name", + "data_type": "string", + "example_values": [ + "Wmiprvse.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.file_details.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.file_details.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.file_details.last_seen", + "data_type": "string", + "example_values": [ + "2018-03-25T06:49:27.776Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "column_name": "MD5", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.file_details.md5", + "data_type": "string", + "example_values": [ + "75E683BC8284D99F998500162BE4CFE2", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.file_details.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\windows\\system32\\wbem\\wmiprvse.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.file_details.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 489984, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.file_details.original_filename", + "data_type": "string", + "example_values": [ + "Wmiprvse.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.file_details.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.file_details.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Windows Operating System" + ] + }, + { + "data_path": "action_result.data.*.file_details.product_version", + "data_type": "string", + "example_values": [ + "10.0.16299.248", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.file_details.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-02-15T01:48:13.517Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.file_details.timestamp", + "data_type": "string", + "example_values": [ + "2018-02-15T01:48:13.517Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.file_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file name", + "file path" + ], + "data_path": "action_result.data.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe", + "C:\\Windows\\CarbonBlack\\Sensor.LOG", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.session_id", + "data_type": "numeric", + "example_values": [ + 101 + ] + }, + { + "column_name": "Vault ID", + "column_order": 1, + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.data.*.vault_id", + "data_type": "string", + "example_values": [ + "08f57fd06bbd8063d5b828521654225952a8155e", + "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.cb_url", + "data_type": "string", + "example_values": [ + "https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2", + "https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.summary.file_type", + "data_type": "string", + "example_values": [ + "pe file" + ] + }, + { + "contains": [ + "file name", + "file path" + ], + "data_path": "action_result.summary.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe", + "C:\\Windows\\CarbonBlack\\Sensor.LOG", + "ping.exe" + ] + }, + { + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.summary.vault_id", + "data_type": "string", + "example_values": [ + "08f57fd06bbd8063d5b828521654225952a8155e", + "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "File type: pe file\nVault id: 08f57fd06bbd8063d5b828521654225952a8155e\nName: wmiprvse.exe\nCb url: https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2", + "Vault id: cefbc5c62d7e1f90d250ddcd35bc388a7b01f4d4, Name: C:\\Windows\\CarbonBlack\\Sensor.LOG", + "File type: pe file, Vault id: 41c4e1e9abe08b218f5ea60d8ae41a5f523e7534, Name: ping.exe, Cb url: https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "get file 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def get_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('get_file_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'get_file_2' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'get_file_2' call\n for filtered_results_item_1 in filtered_results_data_1:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'ph_0': \"\",\n 'offset': \"\",\n 'get_count': \"\",\n 'sensor_id': \"\",\n 'file_source': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"get file\", parameters=parameters, assets=['carbonblack'], name=\"get_file_2\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "91866693-2720-43a1-a437-f65f19382b9a", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 290, + "line_start": 263, + "message": "Configuring now", + "name": "get file", + "notes": "", + "number": 2, + "order": 10, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 200 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "get_file_2", + "required_params": {}, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2947 + }, + { + "action": "create ticket", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "description": "block_hash_2:action_result.message", + "fields": "block_hash_2:action_result.message", + "short_description": "block_hash_2:action_result.message" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "description": "block_hash_2:action_result.message", + "fields": "block_hash_2:action_result.message", + "short_description": "block_hash_2:action_result.message", + "table": "", + "vault_id": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "servicenow", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.short_description", + "data_type": "string" + }, + { + "contains": [ + "servicenow table" + ], + "data_path": "action_result.parameter.table", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.fields", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.description", + "data_type": "string" + }, + { + "contains": [ + "servicenow ticket id" + ], + "data_path": "action_result.summary.created_ticket_id", + "data_type": "string" + }, + { + "contains": [ + "vault id" + ], + "data_path": "action_result.parameter.vault_id", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_updated_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_updated_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.escalation", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.watch_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.follow_up", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.made_sla", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.delivery_task", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sla_due", + "data_type": "string" + }, + { + "column_name": "Number", + "column_order": 0, + "data_path": "action_result.data.*.number", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.caller_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.correlation_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_mod_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.notify", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.resolved_by", + "data_type": "string" + }, + { + "column_name": "Closed On", + "column_order": 6, + "data_path": "action_result.data.*.closed_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_tags", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.cmdb_ci", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.subcategory", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.category", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.close_notes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.expected_start", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.knowledge", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.opened_by.link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.opened_by.value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.impact", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.calendar_stc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.caused_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.comments", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.problem_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.activity_due", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.state", + "data_type": "string" + }, + { + "column_name": "ID", + "column_order": 4, + "contains": [ + "servicenow ticket id" + ], + "data_path": "action_result.data.*.sys_id", + "data_type": "string" + }, + { + "column_name": "Opened On", + "column_order": 5, + "data_path": "action_result.data.*.opened_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.child_incidents", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_notes", + "data_type": "string" + }, + { + "column_name": "Short Description", + "column_order": 0, + "data_path": "action_result.data.*.short_description", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.comments_and_work_notes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.time_worked", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_created_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.upon_reject", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.reassignment_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_stc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.due_date", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_class_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.delivery_plan", + "data_type": "string" + }, + { + "column_name": "Description", + "column_order": 1, + "data_path": "action_result.data.*.description", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.parent", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_duration", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.rfc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.company", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.assigned_to", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval_history", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.user_input", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_start", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain.link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain.value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.resolved_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.calendar_duration", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.group_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.active", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.parent_incident", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain_path", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.closed_by", + "data_type": "string" + }, + { + "column_name": "Severity", + "column_order": 2, + "data_path": "action_result.data.*.severity", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.upon_approval", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.incident_state", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.reopen_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.contact_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_end", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_notes_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_created_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.location", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.correlation_display", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.close_code", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.assignment_group", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval_set", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.order", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.urgency", + "data_type": "string" + }, + { + "column_name": "Priority", + "column_order": 2, + "data_path": "action_result.data.*.priority", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.hold_reason", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_service", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_tags", + "data_type": "string" + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.attachment_details.*.file_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.compressed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.size_bytes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.table_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.image_width", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.content_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.image_height", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.table_sys_id", + "data_type": "string" + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.attachment_details.*.download_link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_mod_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_created_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_created_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_updated_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_updated_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.size_compressed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.average_image_color", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.additional_assignee_list", + "data_type": "string" + }, + { + "data_path": "action_result.summary.attachment_id", + "data_type": "string" + }, + { + "data_path": "action_result.summary.attachment_added", + "data_type": "boolean" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "ticketing" + } + ], + "attrs": { + ".action": { + "text": "create ticket 3" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Utilities" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "# read-only block view not available", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": false, + "connection_name": "block hash 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "def create_ticket_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'create_ticket_2' call\n\n file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash', \n 'file_reputation_1:filtered-action_result.summary.positives'])\n blocked_hashes = set(phantom.collect2(datapath='block_hash_2:action_result.parameter.hash'))\n detected_users = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.username'))\n detected_systems = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.hostname'))\n \n title = \"Virus Detected on {0} devices\".format(len(detected_systems))\n \n description = \"Hashes sumbitted with detections:\\n{0}\\n\\n\".format(\", \".join([\"{0} ({1})\".format(*fr) for fr in file_reputation]))\n description += \"File was found on {0} devices:\\n{1}\\n\\n\".format(len(detected_systems), ', '.join(detected_systems))\n description += \"This impacts at least {0} users:\\n{1}\\n\\n\".format(len(detected_users), ', '.join(detected_users))\n if len(blocked_hashes):\n description += \"{0} hashes were submitted for blocking:\\n{1}\\n\\n\".format(len(blocked_hashes), \", \".join(blocked_hashes))\n\n parameters = []\n \n # build parameters list for 'create_ticket_2' call\n parameters.append({\n 'short_description': title,\n 'description': description,\n 'fields': \"\",\n })\n\n if parameters:\n phantom.act(\"create ticket\", parameters=parameters, assets=['servicenow'], name=\"create_ticket_3\", parent_action=action) \n else:\n phantom.error(\"'create_ticket_3' will not be executed due to lack of parameters\")\n \n return", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": true, + "has_custom_block": true, + "has_custom_callback": false, + "has_custom_join": false, + "id": "72f13962-4d43-44be-9710-d2ed60cbbf00", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 326, + "line_start": 290, + "message": "Configuring now", + "name": "create ticket", + "notes": "", + "number": 3, + "order": 11, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1220, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "create_ticket_3", + "required_params": {}, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Utilities", + "type": "coa.Action", + "warn": false, + "z": 2948 + }, + { + "action": "disable user", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "username": "hunt_file_2:action_result.data.*.process.results.*.username" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "username": "hunt_file_2:action_result.data.*.process.results.*.username" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "domainctrl1", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "column_name": "Username", + "column_order": 0, + "contains": [ + "user name", + "ldap distinguished name" + ], + "data_path": "action_result.parameter.username", + "data_type": "string", + "example_values": [ + "test_user3" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "User state changed" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "directory service" + } + ], + "attrs": { + ".action": { + "text": "disable user" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def disable_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('disable_user_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'disable_user_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.username', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'disable_user_1' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'username': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"disable user\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"disable_user_1\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 349, + "line_start": 326, + "message": "Configuring now", + "name": "disable user", + "notes": "", + "number": 1, + "order": 12, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 480 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "disable_user_1", + "required_params": { + "username": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2949 + }, + { + "action": "hunt file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "binary" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "binary" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7", + "13ded573464ba7f43fe640479b309e09", + "9bf50324444c46997c2492d505b47f2d", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.range", + "data_type": "string", + "example_values": [ + "0-10", + "0-2", + "5-8" + ] + }, + { + "contains": [ + "carbon black query type" + ], + "data_path": "action_result.parameter.type", + "data_type": "string", + "example_values": [ + "process", + "binary" + ] + }, + { + "data_path": "action_result.data.*.binary.elapsed", + "data_type": "numeric", + "example_values": [ + 0.1120398044586182, + 0.04952096939086914, + 0.1234798431396484, + 0.05507302284240723, + 0.05384993553161621 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", + "data_type": "string", + "example_values": [ + "2018-10-01T00:00:00Z", + "2015-01-01T00:00:00Z", + "2013-11-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.name", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "CB-TEST-02", + "WIN7-CLIENT1", + "ACCOUNTING-PC" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "16.7" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "C:\\Windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "50.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", + "data_type": "string", + "example_values": [ + "2018-10-19T00:00:00Z", + "2018-09-29T00:00:00Z", + "2018-10-02T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.highlights.*.ids", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.highlights.*.name", + "data_type": "string", + "example_values": [ + "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", + "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", + "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 510, + 511 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_issuer", + "data_type": "string", + "example_values": [ + "Microsoft Code Signing PCA" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Corp." + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-10-14T20:23:00Z", + "2015-01-30T19:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_subject", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.endpoint", + "data_type": "string", + "example_values": [ + "CB-TEST-02|27", + "WIN7-CLIENT1|15", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.event_partition_id", + "data_type": "numeric", + "example_values": [ + 100972684312576, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.facet_id", + "data_type": "numeric", + "example_values": [ + 883737, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_desc", + "data_type": "string", + "example_values": [ + "Microsoft Office Click-to-Run (SxS)", + "Microsoft Network Realtime Inspection Service", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.host_count", + "data_type": "numeric", + "example_values": [ + 1, + 6 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.internal_name", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.last_seen", + "data_type": "string", + "example_values": [ + "2018-10-28T10:06:02.456Z", + "2018-10-28T10:06:42.455Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.md5", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.original_filename", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "column_name": "Signed", + "column_order": 1, + "data_path": "action_result.data.*.binary.results.*.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-07-01T02:20:02.062Z", + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.binary.start", + "data_type": "numeric", + "example_values": [ + 0, + 5 + ] + }, + { + "data_path": "action_result.data.*.binary.terms", + "data_type": "string", + "example_values": [ + "md5:13ded573464ba7f43fe640479b309e09", + "md5:9bf50324444c46997c2492d505b47f2d", + "md5:5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.total_results", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.process.all_segments", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.comprehensive_search", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.elapsed", + "data_type": "numeric", + "example_values": [ + 0.2200779914855957 + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.value", + "data_type": "numeric", + "example_values": [ + 1566 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 10128 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.name", + "data_type": "string", + "example_values": [ + "domain_controller" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.value", + "data_type": "numeric", + "example_values": [ + 10123 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "dc2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "51.2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 5185 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", + "data_type": "numeric", + "example_values": [ + 411 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.parent_name.*.name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.facets.path_full.*.name", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.facets.process_md5.*.name", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.process_name.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.name", + "data_type": "string", + "example_values": [ + "2018-02-24T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.value", + "data_type": "numeric", + "example_values": [ + 324 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.name", + "data_type": "string", + "example_values": [ + "LOCAL SERVICE" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.4" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.value", + "data_type": "numeric", + "example_values": [ + 9966 + ] + }, + { + "data_path": "action_result.data.*.process.incomplete_results", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.childproc_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.process.results.*.cmdline", + "data_type": "string", + "example_values": [ + "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.comms_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.crossproc_count", + "data_type": "numeric", + "example_values": [ + 2 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_config", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filemod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.group", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.host_type", + "data_type": "string", + "example_values": [ + "workstation" + ] + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.process.results.*.hostname", + "data_type": "string", + "example_values": [ + "win7-client1" + ] + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.process.results.*.id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.interface_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_server_update", + "data_type": "string", + "example_values": [ + "2018-03-22T09:21:32.332Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_update", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.82Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.modload_count", + "data_type": "numeric", + "example_values": [ + 43 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.netconn_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.os_type", + "data_type": "string", + "example_values": [ + "windows" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_md5", + "data_type": "string", + "example_values": [ + "000000000000000000000000000000" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.results.*.parent_name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_pid", + "data_type": "numeric", + "example_values": [ + 600 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.path", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.process_md5", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "process name", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.process_name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.process.results.*.process_pid", + "data_type": "numeric", + "example_values": [ + 1672 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.processblock_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.regmod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.segment_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.process.results.*.sensor_id", + "data_type": "numeric", + "example_values": [ + 15 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.start", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.758Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.terminated", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243-000000000001" + ] + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.process.results.*.username", + "data_type": "string", + "example_values": [ + "SYSTEM" + ] + }, + { + "data_path": "action_result.data.*.process.start", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.terms", + "data_type": "string", + "example_values": [ + "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.total_results", + "data_type": "numeric", + "example_values": [ + 32404 + ] + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "numeric", + "example_values": [ + 32404, + 1 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Displaying 10 'process' results of total 32404", + "Displaying 1 'binary' results of total 1", + "Displaying 0 'binary' results of total 1" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt file 1" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_1' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_1' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"binary\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=block_hash_2, name=\"hunt_file_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 398, + "line_start": 373, + "message": "Configuring now", + "name": "hunt file", + "notes": "", + "number": 1, + "order": 14, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "hunt_file_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2955 + }, + { + "action": "block hash", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "comment": "", + "hash": "hunt_file_1:artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "comment": "", + "hash": "hunt_file_1:artifact:*.cef.fileHash" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "data_path": "action_result.parameter.comment", + "data_type": "string", + "example_values": [ + "Sample comment" + ] + }, + { + "column_name": "Hash", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "180469AE0B239E31DB4C65F02FD70BC1" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Block hash action succeeded. It might take some time for blacklisting to take effect." + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "block hash 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_hash_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'block_hash_2' call\n inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:artifact:*.cef.fileHash', 'hunt_file_1:artifact:*.id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'block_hash_2' call\n for inputs_item_1 in inputs_data_1:\n if inputs_item_1[0]:\n parameters.append({\n 'hash': inputs_item_1[0],\n 'comment': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': inputs_item_1[1]},\n })\n\n phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], callback=filter_3, name=\"block_hash_2\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 1", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 422, + "line_start": 398, + "message": "Configuring now", + "name": "block hash", + "notes": "", + "number": 2, + "order": 15, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "block_hash_2", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": true, + "show_delay": false, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2956 + }, + { + "action": "file reputation", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "file reputation", + "active": true, + "app_name": "VirusTotal", + "app_version": "1.2.40", + "appid": "", + "asset_name": "virustotal", + "config_type": "asset", + "count": 0, + "fields": { + "hash": "artifact:*.cef.fileHash" + }, + "has_app": true, + "id": 142, + "loaded": false, + "missing": false, + "name": "virustotal", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "sha256", + "sha1", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.data.*.md5", + "data_type": "string", + "example_values": [ + "494303294715f5ffad7ad3f43b73b00b" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.permalink", + "data_type": "string", + "example_values": [ + "https://www.test.com/file/27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7/analysis/1548112684/" + ] + }, + { + "data_path": "action_result.data.*.positives", + "data_type": "numeric", + "example_values": [ + 64 + ] + }, + { + "contains": [ + "sha1" + ], + "data_path": "action_result.data.*.resource", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "data_path": "action_result.data.*.response_code", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.scan_date", + "data_type": "string", + "example_values": [ + "2019-01-21 23:18:04" + ] + }, + { + "contains": [ + "virustotal scan id" + ], + "data_path": "action_result.data.*.scan_id", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684" + ] + }, + { + "data_path": "action_result.data.*.scans.*.detected", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.scans.*.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.*.update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.ALYac.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ALYac.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ALYac.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.ALYac.version", + "data_type": "string", + "example_values": [ + "1.1.1.5" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.result", + "data_type": "string", + "example_values": [ + "Win32:Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.version", + "data_type": "string", + "example_values": [ + "18.4.3895.0" + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b (v)" + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.update", + "data_type": "string", + "example_values": [ + "20180925" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.AVware.version", + "data_type": "string", + "example_values": [ + "1.6.0.52" + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.result", + "data_type": "string", + "example_values": [ + "suspicious" + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.update", + "data_type": "string", + "example_values": [ + "20190119" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Acronis.version", + "data_type": "string", + "example_values": [ + "1.0.1.37" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.version", + "data_type": "string", + "example_values": [ + "3.0.5.370" + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.AegisLab.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.version", + "data_type": "string", + "example_values": [ + "4.2" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.result", + "data_type": "string", + "example_values": [ + "Win32/Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.version", + "data_type": "string", + "example_values": [ + "3.14.1.22785" + ] + }, + { + "data_path": "action_result.data.*.scans.Alibaba.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Alibaba.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Alibaba.update", + "data_type": "string", + "example_values": [ + "20180921" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Alibaba.version", + "data_type": "string", + "example_values": [ + "0.1.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.result", + "data_type": "string", + "example_values": [ + "Virus/Win32.Parite.c" + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Antiy-AVL.version", + "data_type": "string", + "example_values": [ + "3.0.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.version", + "data_type": "string", + "example_values": [ + "1.0.0.837" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.version", + "data_type": "string", + "example_values": [ + "190121-00" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.result", + "data_type": "string", + "example_values": [ + "Win32:Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.version", + "data_type": "string", + "example_values": [ + "18.4.3895.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.result", + "data_type": "string", + "example_values": [ + "W32/Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Avira.version", + "data_type": "string", + "example_values": [ + "8.3.3.8" + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Babable.update", + "data_type": "string", + "example_values": [ + "20180918" + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.version", + "data_type": "string", + "example_values": [ + "9107201" + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.result", + "data_type": "string", + "example_values": [ + "Win32.Virus.Parite.d" + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Baidu.version", + "data_type": "string", + "example_values": [ + "1.0.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.version", + "data_type": "string", + "example_values": [ + "7.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.result", + "data_type": "string", + "example_values": [ + "W32.Pinfi.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.version", + "data_type": "string", + "example_values": [ + "1.3.0.9899" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.result", + "data_type": "string", + "example_values": [ + "W32.Perite.A" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.version", + "data_type": "string", + "example_values": [ + "14.00" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b!O" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.version", + "data_type": "string", + "example_values": [ + "1.1.0.977" + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.result", + "data_type": "string", + "example_values": [ + "Heuristics.W32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.ClamAV.version", + "data_type": "string", + "example_values": [ + "0.101.1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.result", + "data_type": "string", + "example_values": [ + "Malware@#1b1651nqd7ivb" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.version", + "data_type": "string", + "example_values": [ + "30310" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.result", + "data_type": "string", + "example_values": [ + "malicious_confidence_100% (W)" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.update", + "data_type": "string", + "example_values": [ + "20181023" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.result", + "data_type": "string", + "example_values": [ + "malicious.94715f" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.update", + "data_type": "string", + "example_values": [ + "20190109" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.version", + "data_type": "string", + "example_values": [ + "1.2.27" + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.result", + "data_type": "string", + "example_values": [ + "Unsafe" + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Cylance.version", + "data_type": "string", + "example_values": [ + "2.3.1.101" + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.result", + "data_type": "string", + "example_values": [ + "W32/Virut.E.gen!Eldorado" + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Cyren.version", + "data_type": "string", + "example_values": [ + "6.2.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.result", + "data_type": "string", + "example_values": [ + "Trojan.DownLoader20.25948" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.version", + "data_type": "string", + "example_values": [ + "7.0.34.11020" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.result", + "data_type": "string", + "example_values": [ + "Win32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.version", + "data_type": "string", + "example_values": [ + "18744" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B (B)" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.version", + "data_type": "string", + "example_values": [ + "2018.4.0.1029" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.result", + "data_type": "string", + "example_values": [ + "malicious (high confidence)" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.update", + "data_type": "string", + "example_values": [ + "20181108" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.version", + "data_type": "string", + "example_values": [ + "3.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.result", + "data_type": "string", + "example_values": [ + "W32/Virut.E.gen!Eldorado" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.F-Prot.version", + "data_type": "string", + "example_values": [ + "4.7.1.166" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.version", + "data_type": "string", + "example_values": [ + "11.0.19100.45" + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.result", + "data_type": "string", + "example_values": [ + "W32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Fortinet.version", + "data_type": "string", + "example_values": [ + "5.4.247.0" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.GData.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.version", + "data_type": "string", + "example_values": [ + "A:25.20275B:25.14197" + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Virut" + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Ikarus.version", + "data_type": "string", + "example_values": [ + "0.1.5.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.result", + "data_type": "string", + "example_values": [ + "heuristic" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.update", + "data_type": "string", + "example_values": [ + "20181128" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.version", + "data_type": "string", + "example_values": [ + "6.3.6.26157" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.result", + "data_type": "string", + "example_values": [ + "Win32/Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.version", + "data_type": "string", + "example_values": [ + "16.0.100" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.result", + "data_type": "string", + "example_values": [ + "Virus ( 00001b711 )" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.version", + "data_type": "string", + "example_values": [ + "11.24.29740" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.result", + "data_type": "string", + "example_values": [ + "Virus ( 00001b711 )" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.version", + "data_type": "string", + "example_values": [ + "11.24.29740" + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Kaspersky.version", + "data_type": "string", + "example_values": [ + "15.0.1.13" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b.5756" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.version", + "data_type": "string", + "example_values": [ + "2013.8.14.323" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.result", + "data_type": "string", + "example_values": [ + "malware (ai score=100)" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.version", + "data_type": "string", + "example_values": [ + "2018.9.12.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.result", + "data_type": "string", + "example_values": [ + "Trojan.Agent.QQ" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.version", + "data_type": "string", + "example_values": [ + "2.1.1.1115" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.result", + "data_type": "string", + "example_values": [ + "BehavesLike.Win32.Pate.hh" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.version", + "data_type": "string", + "example_values": [ + "v2017.3010" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.result", + "data_type": "string", + "example_values": [ + "W32/Pate.b" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.version", + "data_type": "string", + "example_values": [ + "6.0.6.653" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.version", + "data_type": "string", + "example_values": [ + "14.0.297.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.result", + "data_type": "string", + "example_values": [ + "Virus:Win32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.version", + "data_type": "string", + "example_values": [ + "1.1.15500.2" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.bgvo" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.version", + "data_type": "string", + "example_values": [ + "1.0.134.24576" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.result", + "data_type": "string", + "example_values": [ + "generic.ml" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.result", + "data_type": "string", + "example_values": [ + "W32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Panda.version", + "data_type": "string", + "example_values": [ + "4.6.4.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.H" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.version", + "data_type": "string", + "example_values": [ + "1.0.0.1120" + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.result", + "data_type": "string", + "example_values": [ + "Virus.Parite!1.9B80 (CLOUD)" + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Rising.version", + "data_type": "string", + "example_values": [ + "25.0.0.24" + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.update", + "data_type": "string", + "example_values": [ + "20190116" + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.version", + "data_type": "string", + "example_values": [ + "5.6.0.1032" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.result", + "data_type": "string", + "example_values": [ + "static engine - malicious" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.version", + "data_type": "string", + "example_values": [ + "1.0.21.268" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.result", + "data_type": "string", + "example_values": [ + "W32/Parite-B" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.version", + "data_type": "string", + "example_values": [ + "4.98.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.result", + "data_type": "string", + "example_values": [ + "Trojan.Gen.6" + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Symantec.version", + "data_type": "string", + "example_values": [ + "1.8.0.0" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.result", + "data_type": "string", + "example_values": [ + "Virus/W32.Parite.C" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.version", + "data_type": "string", + "example_values": [ + "2019-01-21.02" + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Dropper.c" + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Tencent.version", + "data_type": "string", + "example_values": [ + "1.0.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.result", + "data_type": "string", + "example_values": [ + "W32/Pate.B" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.version", + "data_type": "string", + "example_values": [ + "6.8.0.5.3962" + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.result", + "data_type": "string", + "example_values": [ + "Win32/Pinfi.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.TotalDefense.version", + "data_type": "string", + "example_values": [ + "37.1.62.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.result", + "data_type": "string", + "example_values": [ + "malicious.high.ml.score" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.update", + "data_type": "string", + "example_values": [ + "20190103" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.version", + "data_type": "string", + "example_values": [ + "3.0.34.707" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.result", + "data_type": "string", + "example_values": [ + "PE_PARITE.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.version", + "data_type": "string", + "example_values": [ + "10.0.0.1040" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.result", + "data_type": "string", + "example_values": [ + "PE_PARITE.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.version", + "data_type": "string", + "example_values": [ + "10.0.0.1040" + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Trustlook.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.version", + "data_type": "string", + "example_values": [ + "3.35.1" + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b (v)" + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.VIPRE.version", + "data_type": "string", + "example_values": [ + "None" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.A" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.version", + "data_type": "string", + "example_values": [ + "2014.3.20.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Webroot.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.version", + "data_type": "string", + "example_values": [ + "1.0.0.403" + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.update", + "data_type": "string", + "example_values": [ + "20190120" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Yandex.version", + "data_type": "string", + "example_values": [ + "5.5.1.3" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.result", + "data_type": "string", + "example_values": [ + "Virus.Parite.Win32.9" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.version", + "data_type": "string", + "example_values": [ + "2.0.0.3733" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.eGambit.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.version", + "data_type": "string", + "example_values": [ + "v4.3.5" + ] + }, + { + "contains": [ + "hash", + "sha1" + ], + "data_path": "action_result.data.*.sha1", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "contains": [ + "hash", + "sha256" + ], + "data_path": "action_result.data.*.sha256", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7" + ] + }, + { + "data_path": "action_result.data.*.total", + "data_type": "numeric", + "example_values": [ + 72 + ] + }, + { + "data_path": "action_result.data.*.verbose_msg", + "data_type": "string", + "example_values": [ + "Scan finished, information embedded" + ] + }, + { + "data_path": "action_result.summary.positives", + "data_type": "numeric", + "example_values": [ + 64 + ] + }, + { + "data_path": "action_result.summary.total_scans", + "data_type": "numeric", + "example_values": [ + 72 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Positives: 64, Total scans: 72" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_positives", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "parameters": { + "hash": { + "contains": [ + "hash", + "sha256", + "sha1", + "md5" + ], + "data_type": "string", + "default": null, + "description": "File hash to query", + "key": "hash", + "order": 0, + "primary": true, + "required": true + } + }, + "product_name": "VirusTotal", + "product_vendor": "VirusTotal", + "targets": "34", + "type": "" + } + ], + "attrs": { + ".action": { + "text": "file reputation" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('file_reputation_1() called')\n\n # collect data for 'file_reputation_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'file_reputation_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'hash': container_item[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n phantom.act(action=\"file reputation\", parameters=parameters, assets=['virustotal'], callback=filter_1, name=\"file_reputation_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 443, + "line_start": 422, + "message": "Configuring now", + "name": "file reputation", + "notes": "", + "number": 1, + "order": 16, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 220, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "file_reputation_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2957 + }, + { + "action": "block hash", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "comment": "", + "hash": "hunt_file_2:artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "comment": "", + "hash": "hunt_file_2:artifact:*.cef.fileHash" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "data_path": "action_result.parameter.comment", + "data_type": "string", + "example_values": [ + "Sample comment" + ] + }, + { + "column_name": "Hash", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "180469AE0B239E31DB4C65F02FD70BC1" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Block hash action succeeded. It might take some time for blacklisting to take effect." + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "block hash 3" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def block_hash_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_hash_3() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'block_hash_3' call\n inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:artifact:*.cef.fileHash', 'hunt_file_2:artifact:*.id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'block_hash_3' call\n for inputs_item_1 in inputs_data_1:\n if inputs_item_1[0]:\n parameters.append({\n 'hash': inputs_item_1[0],\n 'comment': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': inputs_item_1[1]},\n })\n\n phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], callback=join_filter_2, name=\"block_hash_3\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 373, + "line_start": 349, + "message": "Configuring now", + "name": "block hash", + "notes": "", + "number": 3, + "order": 13, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "block_hash_3", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2958 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 2 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 10],\n ],\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n create_ticket_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": false, + "connection_name": "logoff user, shutdown system, disable user, block hash 3", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "hasElse": false, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "inPorts": [ + "in" + ], + "join_code": "def join_filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('join_filter_2() called')\n\n # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n if phantom.completed(action_names=['logoff_user_1', 'shutdown_system_1', 'disable_user_1', 'block_hash_3']):\n \n # call connected block \"filter_2\"\n filter_2(container=container, handle=handle)\n \n return", + "join_optional": [], + "join_start": 132, + "line_end": 143, + "line_start": 114, + "name": "filter", + "notes": "", + "number": 2, + "order": 5, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": ">", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1080, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "filter_2", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2959 + } + ] + }, + "notes": "" + }, + "python_version": "3", + "schema": 4, + "version": "4.10.0.40961" + }, + "create_time": "2021-01-21T21:31:52.515480+00:00", + "draft_mode": false, + "labels": [ + "events" + ], + "tags": [], + "misc": { + "apps_list": [ + "LDAP", + "ServiceNow", + "Carbon Black Response", + "VirusTotal" + ] + } +} \ No newline at end of file diff --git a/playbooks/malware_hunt_and_contain.png b/playbooks/malware_hunt_and_contain.png new file mode 100644 index 0000000000..784fcde3ab Binary files /dev/null and b/playbooks/malware_hunt_and_contain.png differ diff --git a/playbooks/malware_hunt_and_contain.py b/playbooks/malware_hunt_and_contain.py new file mode 100644 index 0000000000..eb7e2f484f --- /dev/null +++ b/playbooks/malware_hunt_and_contain.py @@ -0,0 +1,456 @@ +""" +This playbook investigates and remediates malware infections on the endpoint. +""" + +import phantom.rules as phantom +import json +from datetime import datetime, timedelta +############################## +# Start - Global Code Block + +"""Malicous file detected on endpoint""" + +# End - Global Code block +############################## + +def on_start(container): + phantom.debug('on_start() called') + + # call 'file_reputation_1' block + file_reputation_1(container=container) + + return + +def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_3() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">", 5], + ["file_reputation_1:action_result.summary.positives", "<=", 10], + ], + logical_operator='and', + name="filter_3:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + create_ticket_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def shutdown_system_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('shutdown_system_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'shutdown_system_1' call + results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'shutdown_system_1' call + for results_item_1 in results_data_1: + parameters.append({ + 'ph': "", + 'message': "", + 'wait_time': "", + 'ip_hostname': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="shutdown system", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name="shutdown_system_1", parent_action=action) + + return + +def create_ticket_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'create_ticket_2' call + + disabled_users = set(phantom.collect2(datapath='disable_user_1:action_result.parameter.username')) + blocked_hashes = set(phantom.collect2(datapath='block_hash_3:action_result.parameter.hash')) + loggedoff_users = set(phantom.collect2(datapath='logoff_user_1:action_result.parameter.username')) + shutdown_systems = set(phantom.collect2(datapath='shutdown_system_1:action_result.parameter.ip_hostname')) + file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash', + 'file_reputation_1:filtered-action_result.summary.positives']) + detected_users = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.username')) + detected_systems = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.hostname')) + + title = "Virus Detected on {0} devices".format(len(detected_systems)) + + description = "Hashes sumbitted with detections:\n{0}\n\n".format(", ".join(["{0} ({1})".format(*fr) for fr in file_reputation])) + description += "File was found on {0} devices:\n{1}\n\n".format(len(detected_systems), ', '.join(detected_systems)) + description += "This impacts at least {0} users:\n{1}\n\n".format(len(detected_users), ', '.join(detected_users)) + if len(blocked_hashes): + description += "{0} hashes were submitted for blocking:\n{1}\n\n".format(len(blocked_hashes), ", ".join(blocked_hashes)) + if len(loggedoff_users): + description += "{0} users were forced to logoff:\n{1}\n\n".format(len(loggedoff_users), ", ".join(loggedoff_users)) + if len(disabled_users): + description += "{0} user accounts were disabled:\n{1}\n\n".format(len(disabled_users), ", ".join(disabled_users)) + if len(shutdown_systems): + description += "{0} systems were shutdown:\n{1}\n\n".format(len(shutdown_systems), ", ".join(shutdown_systems)) + + parameters = [] + + # build parameters list for 'create_ticket_2' call + parameters.append({ + 'short_description': title, + 'description': description, + 'fields': "", + }) + + if parameters: + phantom.act("create ticket", parameters=parameters, assets=['servicenow'], name="create_ticket_2", parent_action=action) + else: + phantom.error("'create_ticket_2' will not be executed due to lack of parameters") + + return + +def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_2() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">", 10], + ], + name="filter_2:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + create_ticket_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def join_filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None): + phantom.debug('join_filter_2() called') + + # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed + if phantom.completed(action_names=['logoff_user_1', 'shutdown_system_1', 'disable_user_1', 'block_hash_3']): + + # call connected block "filter_2" + filter_2(container=container, handle=handle) + + return + +def logoff_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('logoff_user_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'logoff_user_1' call + results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'logoff_user_1' call + for results_item_1 in results_data_1: + parameters.append({ + 'username': "", + 'ip_hostname': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="logoff user", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name="logoff_user_1", parent_action=action) + + return + +def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_1() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">", 5], + ["file_reputation_1:action_result.summary.positives", "<=", 10], + ], + logical_operator='and', + name="filter_1:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + get_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + # collect filtered artifact ids for 'if' condition 2 + matched_artifacts_2, matched_results_2 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">", 10], + ], + name="filter_1:condition_2") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_2 or matched_results_2: + hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2) + get_file_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2) + + return + +def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('hunt_file_2() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'hunt_file_2' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'hunt_file_2' call + for filtered_results_item_1 in filtered_results_data_1: + if filtered_results_item_1[0]: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'type': "", + 'range': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=hunt_file_2_callback, name="hunt_file_2") + + return + +def hunt_file_2_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None): + phantom.debug('hunt_file_2_callback() called') + + disable_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) + logoff_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) + shutdown_system_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) + block_hash_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) + + return + +def get_file_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('get_file_3() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'get_file_3' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'get_file_3' call + for filtered_results_item_1 in filtered_results_data_1: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'ph_0': "", + 'offset': "", + 'get_count': "", + 'sensor_id': "", + 'file_source': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="get file", parameters=parameters, assets=['carbonblack'], name="get_file_3") + + return + +def get_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('get_file_2() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'get_file_2' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'get_file_2' call + for filtered_results_item_1 in filtered_results_data_1: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'ph_0': "", + 'offset': "", + 'get_count': "", + 'sensor_id': "", + 'file_source': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="get file", parameters=parameters, assets=['carbonblack'], name="get_file_2") + + return + +def create_ticket_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'create_ticket_2' call + + file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash', + 'file_reputation_1:filtered-action_result.summary.positives']) + blocked_hashes = set(phantom.collect2(datapath='block_hash_2:action_result.parameter.hash')) + detected_users = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.username')) + detected_systems = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.hostname')) + + title = "Virus Detected on {0} devices".format(len(detected_systems)) + + description = "Hashes sumbitted with detections:\n{0}\n\n".format(", ".join(["{0} ({1})".format(*fr) for fr in file_reputation])) + description += "File was found on {0} devices:\n{1}\n\n".format(len(detected_systems), ', '.join(detected_systems)) + description += "This impacts at least {0} users:\n{1}\n\n".format(len(detected_users), ', '.join(detected_users)) + if len(blocked_hashes): + description += "{0} hashes were submitted for blocking:\n{1}\n\n".format(len(blocked_hashes), ", ".join(blocked_hashes)) + + parameters = [] + + # build parameters list for 'create_ticket_2' call + parameters.append({ + 'short_description': title, + 'description': description, + 'fields': "", + }) + + if parameters: + phantom.act("create ticket", parameters=parameters, assets=['servicenow'], name="create_ticket_3", parent_action=action) + else: + phantom.error("'create_ticket_3' will not be executed due to lack of parameters") + + return + +def disable_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('disable_user_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'disable_user_1' call + results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.username', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'disable_user_1' call + for results_item_1 in results_data_1: + if results_item_1[0]: + parameters.append({ + 'username': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="disable user", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name="disable_user_1", parent_action=action) + + return + +def block_hash_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_hash_3() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'block_hash_3' call + inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:artifact:*.cef.fileHash', 'hunt_file_2:artifact:*.id'], action_results=results) + + parameters = [] + + # build parameters list for 'block_hash_3' call + for inputs_item_1 in inputs_data_1: + if inputs_item_1[0]: + parameters.append({ + 'hash': inputs_item_1[0], + 'comment': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': inputs_item_1[1]}, + }) + + phantom.act(action="block hash", parameters=parameters, assets=['carbonblack'], callback=join_filter_2, name="block_hash_3", parent_action=action) + + return + +def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('hunt_file_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'hunt_file_1' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'hunt_file_1' call + for filtered_results_item_1 in filtered_results_data_1: + if filtered_results_item_1[0]: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'type': "binary", + 'range': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=block_hash_2, name="hunt_file_1") + + return + +def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_hash_2() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'block_hash_2' call + inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:artifact:*.cef.fileHash', 'hunt_file_1:artifact:*.id'], action_results=results) + + parameters = [] + + # build parameters list for 'block_hash_2' call + for inputs_item_1 in inputs_data_1: + if inputs_item_1[0]: + parameters.append({ + 'hash': inputs_item_1[0], + 'comment': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': inputs_item_1[1]}, + }) + + phantom.act(action="block hash", parameters=parameters, assets=['carbonblack'], callback=filter_3, name="block_hash_2", parent_action=action) + + return + +def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('file_reputation_1() called') + + # collect data for 'file_reputation_1' call + container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id']) + + parameters = [] + + # build parameters list for 'file_reputation_1' call + for container_item in container_data: + if container_item[0]: + parameters.append({ + 'hash': container_item[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': container_item[1]}, + }) + + phantom.act(action="file reputation", parameters=parameters, assets=['virustotal'], callback=filter_1, name="file_reputation_1") + + return + +def on_finish(container, summary): + phantom.debug('on_finish() called') + # This function is called after all actions are completed. + # summary of all the action and/or all details of actions + # can be collected here. + + # summary_json = phantom.get_summary() + # if 'result' in summary_json: + # for action_result in summary_json['result']: + # if 'action_run_id' in action_result: + # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False) + # phantom.debug(action_results) + + return \ No newline at end of file diff --git a/playbooks/malware_hunt_and_contain.yml b/playbooks/malware_hunt_and_contain.yml new file mode 100644 index 0000000000..fda6970320 --- /dev/null +++ b/playbooks/malware_hunt_and_contain.yml @@ -0,0 +1,22 @@ +name: Malware Hunt and Contain +id: fb3edc76-ff2b-43c0-5f6f-63da4483fd63 +version: 1 +date: '2021-01-21' +author: Philip Royer, Splunk +type: Response +description: This playbook investigates and remediates malware infections on the endpoint. +playbook: malware_hunt_and_contain +how_to_implement: "Be sure to update asset naming to reflect the asset names configured in your environment." +references: [] +app_list: +- "LDAP" +- "ServiceNow" +- "CarbonBlack Response" +- "VirusTotal" +tags: + platform_tags: + - Response + playbook_fields: + - fileHash + product: + - Splunk SOAR \ No newline at end of file diff --git a/tests/endpoint/linux_file_creation_in_init_boot_directory.test.yml b/tests/endpoint/linux_file_creation_in_init_boot_directory.test.yml new file mode 100644 index 0000000000..c974589469 --- /dev/null +++ b/tests/endpoint/linux_file_creation_in_init_boot_directory.test.yml @@ -0,0 +1,12 @@ +name: Linux File Creation In Init Boot Directory Unit Test +tests: +- name: Linux File Creation In Init Boot Directory + file: endpoint/linux_file_creation_in_init_boot_directory.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-30d' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux diff --git a/tests/endpoint/linux_file_creation_in_profile_directory.test.yml b/tests/endpoint/linux_file_creation_in_profile_directory.test.yml new file mode 100644 index 0000000000..deb43e7aef --- /dev/null +++ b/tests/endpoint/linux_file_creation_in_profile_directory.test.yml @@ -0,0 +1,12 @@ +name: Linux File Creation In Profile Directory Unit Test +tests: +- name: Linux File Creation In Profile Directory + file: endpoint/linux_file_creation_in_profile_directory.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_service_file_created_in_systemd_directory.test.yml b/tests/endpoint/linux_service_file_created_in_systemd_directory.test.yml new file mode 100644 index 0000000000..a0077344c5 --- /dev/null +++ b/tests/endpoint/linux_service_file_created_in_systemd_directory.test.yml @@ -0,0 +1,12 @@ +name: Linux Service File Created In Systemd Directory Unit Test +tests: +- name: Linux Service File Created In Systemd Directory + file: endpoint/linux_service_file_created_in_systemd_directory.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_service_restarted.test.yml b/tests/endpoint/linux_service_restarted.test.yml new file mode 100644 index 0000000000..4820bcc88a --- /dev/null +++ b/tests/endpoint/linux_service_restarted.test.yml @@ -0,0 +1,12 @@ +name: Linux Service Restarted Unit Test +tests: +- name: Linux Service Restarted + file: endpoint/linux_service_restarted.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_service_started_or_enabled.test.yml b/tests/endpoint/linux_service_started_or_enabled.test.yml new file mode 100644 index 0000000000..f37ad6c647 --- /dev/null +++ b/tests/endpoint/linux_service_started_or_enabled.test.yml @@ -0,0 +1,12 @@ +name: Linux Service Started Or Enabled Unit Test +tests: +- name: Linux Service Started Or Enabled + file: endpoint/linux_service_started_or_enabled.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_setuid_using_chmod_utility.test.yml b/tests/endpoint/linux_setuid_using_chmod_utility.test.yml new file mode 100644 index 0000000000..31051cbd83 --- /dev/null +++ b/tests/endpoint/linux_setuid_using_chmod_utility.test.yml @@ -0,0 +1,12 @@ +name: Linux Setuid Using Chmod Utility Unit Test +tests: +- name: Linux Setuid Using Chmod Utility + file: endpoint/linux_setuid_using_chmod_utility.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_setuid_using_setcap_utility.test.yml b/tests/endpoint/linux_setuid_using_setcap_utility.test.yml new file mode 100644 index 0000000000..2742ee77cd --- /dev/null +++ b/tests/endpoint/linux_setuid_using_setcap_utility.test.yml @@ -0,0 +1,12 @@ +name: Linux Setuid Using Setcap Utility Unit Test +tests: +- name: Linux Setuid Using Setcap Utility + file: endpoint/linux_setuid_using_setcap_utility.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_setcap/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml b/tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml new file mode 100644 index 0000000000..c06a3b15a4 --- /dev/null +++ b/tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml @@ -0,0 +1,12 @@ +name: MSI Module Loaded by Non-System Binary Unit Test +tests: +- name: MSI Module Loaded by Non-System Binary + file: endpoint/msi_module_loaded_by_non_system_binary.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/msi_module_load/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_dism_remove_defender.test.yml b/tests/endpoint/windows_dism_remove_defender.test.yml new file mode 100644 index 0000000000..9f090a3664 --- /dev/null +++ b/tests/endpoint/windows_dism_remove_defender.test.yml @@ -0,0 +1,12 @@ +name: Windows DISM Remove Defender Unit Test +tests: +- name: Windows DISM Remove Defender + file: endpoint/windows_dism_remove_defender.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_dism.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml b/tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml new file mode 100644 index 0000000000..849361ab9d --- /dev/null +++ b/tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml @@ -0,0 +1,12 @@ +name: Windows Raccine Scheduled Task Deletion Unit Test +tests: +- name: Windows Raccine Scheduled Task Deletion + file: endpoint/windows_raccine_scheduled_task_deletion.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_raccine.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file