diff --git a/bin/jinja2_templates/doc_detections.j2 b/bin/jinja2_templates/doc_detections.j2 index 6f81151276..c271e9b7a1 100644 --- a/bin/jinja2_templates/doc_detections.j2 +++ b/bin/jinja2_templates/doc_detections.j2 @@ -31,7 +31,7 @@ tags: {% if detection.experimental is sameas true -%} ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. {% endif %} [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index ef48bc9c3b..6f2e31b762 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -67,6 +67,7 @@ tags: mitre_attack_id: - T1505 - T1505.003 + - T1190 observable: - name: user type: User diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index 5bcc54809b..24b5b9fdf8 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -8,18 +8,19 @@ datamodel: - Endpoint description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed - and registered. With that, registering or loading dynwrapx.dll to a host highly - suspect. Why is it needed? In most malicious instances, During triage, review parallel - processes and pivot on the process_guid. Review the registry for any suspicious - modifications meant to load dynwrapx.dll. Identify any suspicious module loads of - dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. + and registered. With that, registering or loading dynwrapx.dll to a host is highly + suspicious. In most instances when it is used maliciously, the best way to triage + is to review parallel processes and pivot on the process_guid. Review the registry + for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious + module loads of dynwrapx.dll. This detection will return and identify the processes + that invoke vbs/wscript/cscript. search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName = "dynwrapx.dll" OR Product = "DynamicWrapperX") | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `loading_of_dynwrapx_module_filter`' how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from + on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml new file mode 100644 index 0000000000..cebbcc8ebe --- /dev/null +++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml @@ -0,0 +1,79 @@ +name: MSI Module Loaded by Non-System Binary +id: ccb98a66-5851-11ec-b91c-acde48001122 +version: 1 +date: '2021-12-08' +author: Michael Haag, Splunk +type: Hunting +datamodel: [] +description: 'The following hunting analytic identifies `msi.dll` being loaded by a binary not located in `system32`, `syswow64`, `winsxs` or `windows` paths. This behavior is most recently related to InstallerFileTakeOver, or CVE-2021-41379, and DLL side-loading. + CVE-2021-41379 requires a binary to be dropped and `msi.dll` to be loaded by it. To Successful exploitation of this issue happens in four parts \ + + 1. Generation of an MSI that will trigger bad behavior. \ + + 1. Preparing a directory for MSI installation. \ + + 1. Inducing an error state. \ + + 1. Racing to introduce a junction and a symlink to trick msiexec.exe to modify the attacker specified file. \ + + In addition, `msi.dll` has been abused in DLL side-loading attacks by being loaded by non-system binaries.' +search: '`sysmon` EventCode=7 ImageLoaded="*\\msi.dll" NOT (Image IN ("*\\System32\\*","*\\syswow64\\*","*\\windows\\*", "*\\winsxs\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime + by Image ImageLoaded process_name Computer EventCode ProcessId + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `msi_module_loaded_by_non_system_binary_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and imageloaded executions from your endpoints. If you + are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: It is possible some Administrative utilities will load msi.dll outside of normal system paths, filter as needed. +references: + - https://attackerkb.com/topics/7LstI2clmF/cve-2021-41379/rapid7-analysis + - https://github.com/klinix5/InstallerFileTakeOver + - https://github.com/mandiant/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/msi.dll%20Hijack%20(Methodology).ioc +cve: + - CVE-2021-41379 +tags: + analytic_story: + - Windows Privilege Escalation + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1574.002 + - T1574 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - ImageLoaded + - process_name + - Computer + - EventCode + - ProcessId + security_domain: endpoint + impact: 80 + confidence: 70 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The following module $ImageLoaded$ was loaded by $Image$ outside of the normal system paths on endpoint $Computer$, potentally related to DLL side-loading. + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: ImageLoaded + type: Other + role: + - Other + - name: process_name + type: Process + role: + - Child Process + \ No newline at end of file diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml index 64116e3eaf..86c5a204c8 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/endpoint/possible_browser_pass_view_parameter.yml @@ -6,15 +6,13 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic will detect a suspicious process contains a commandline - parameter related to web browser credential dumper. This technique was used by Remcos - RAT malware where it use the techique of Nirsoft webbrowserpassview.exe application - to dump web browser credentials. Remcos use the "/stext" commandline to dump the - credential in text format. This Hunting query is good indicator to look further - for possible remcos infection within the network or possible compromised host. Since - the detections is only base on the parameter command and the possible path where - it will drop the text credential information, It may catch normal tools that having - same command and behavior. +description: This analytic will detect if a suspicious process contains a commandline + parameter related to a web browser credential dumper. This technique is used by Remcos RAT + malware which uses the Nirsoft webbrowserpassview.exe application to dump web browser + credentials. Remcos uses the "/stext" command line to dump the credentials in text format. + This Hunting query is a good indicator of hosts suffering from possible Remcos RAT infection. + Since the hunting query is based on the parameter command and the possible path where it will + save the text credential information, it may catch normal tools that are using the same command and behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*/stext *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*", diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index 13d606a8f9..40e55b9dc5 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -28,8 +28,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. known_false_positives: network admin can resize the shadowstorage for valid purposes. references: -- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html + - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html + - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md + - https://redcanary.com/blog/blackbyte-ransomware/ + - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-resize-shadowstorage tags: analytic_story: - Clop Ransomware diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml index c068e541e1..8d6eac69a1 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -6,24 +6,22 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious process having a dns query on - known abuse text paste web services, or VoIP, instant messaging and digital distribution - platform to download some files. This technique is abused by adversaries, malware - attacker and red team to download a malicious file on the target host. This is a - good TTP indicator for possible initial access technique. Noise and false positive - can be seen if the following instant messaging is allowed or common application - in corporate network. +description: This analytic detects a suspicious process making a DNS query via known, abused + text-paste web services, VoIP, instant messaging, and digital distribution platforms used + to download external files. This technique is abused by adversaries, malware actors, and + red teams to download a malicious file on the target host. This is a good TTP indicator + for possible initial access techniques. A user will experience false positives if the + following instant messaging is allowed or common applications like telegram or discord + are allowed in the corporate network. search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegram*", "*t.me*") process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe", "cscript.exe") | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`' -how_to_implement: his detection relies on sysmon logs with the Event ID 7, Driver - loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll - is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query. - We suggest to run this detection at least once a day over the last 14 days. +how_to_implement: This detection relies on sysmon logs with the Event ID 22, + DNS Query. We suggest you run this detection at least once a day over the last 14 days. known_false_positives: Noise and false positive can be seen if the following instant - messaging is allowed to use within corporate network. filter is needed. + messaging is allowed to use within corporate network. In this case, a filter is needed. references: - https://urlhaus.abuse.ch/url/1798923/ tags: diff --git a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml index 8c2ceb7026..a3e1ced592 100644 --- a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml +++ b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml @@ -6,12 +6,16 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic is to detect a suspicious dxdiag.exe process commandline - can collect system info of the target host. This technique was seen in remcos, adversaries - and other malware to collect information as part of recon or collection phase of - attack. Even this behavior is rarely seen in a corporate network this commandline - can be used by network administrator to audit host machine specification. Better - to check what it did after it pipes out the result to a file for further processing. +description: This analytic is to detect a suspicious dxdiag.exe process + command-line execution. Dxdiag is used to collect the system info of + the target host. This technique has been used by Remcos RATS, various + actors, and other malware to collect information as part of the recon + or collection phase of an attack. This behavior should rarely be seen + in a corporate network, but this command line can be used by a network + administrator to audit host machine specifications. Thus in some rare + cases, this detection will contain false positives in its results. To + triage further, analyze what commands were passed after it pipes out + the result to a file for further processing. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_dxdiag` AND Processes.process = "* /t *" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process @@ -23,8 +27,8 @@ how_to_implement: To successfully implement this search you need to be ingesting your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: this commandline can be used by network administrator to audit - host machine specification.filter is needed. +known_false_positives: This commandline can be used by a network administrator to audit + host machine specifications. Thus, a filter is needed. references: - https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ tags: diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml new file mode 100644 index 0000000000..17df9c7817 --- /dev/null +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -0,0 +1,81 @@ +name: Windows DISM Remove Defender +id: 8567da9e-47f0-11ec-99a9-acde48001122 +version: 1 +date: '2021-11-17' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the use of the Windows Disk Image Utility, + `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable + Defender before completing their objective. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dism.exe + (Processes.process="*/online*" AND Processes.process="*/disable-feature*" AND Processes.process="*Windows-Defender*" + AND Processes.process="*/remove*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_dism_remove_defender_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Some legitimate administrative tools leverage `dism.exe` to + manipulate packages and features of the operating system. Filter as needed. +references: +- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: access + impact: 80 + confidence: 100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to disable Windows Defender. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + automated_detection_testing: passed diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml new file mode 100644 index 0000000000..623a9a5afb --- /dev/null +++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml @@ -0,0 +1,81 @@ +name: Windows Raccine Scheduled Task Deletion +id: c9f010da-57ab-11ec-82bd-acde48001122 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the Raccine Rules Updater scheduled + task being deleted. Adversaries may attempt to remove this task in order to prevent + the update of Raccine. Raccine is a "ransomware vaccine" created by security researcher + Florian Roth, designed to intercept and prevent precursors and active ransomware + behavior. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe + Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited, however filter as needed. +references: +- https://redcanary.com/blog/blackbyte-ransomware/ +- https://github.com/Neo23x0/Raccine +tags: + analytic_story: + - Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + automated_detection_testing: passed diff --git a/detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml b/detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml new file mode 100644 index 0000000000..c41f9440b6 --- /dev/null +++ b/detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml @@ -0,0 +1,100 @@ +name: Microsoft Exchange Mailbox Replication service writing Active Server Pages +id: 985f322c-57a5-11ec-b9ac-acde48001122 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following query identifies suspicious .aspx created in 3 paths identified + by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM + group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, + `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. The analytic is limited to process name MSExchangeMailboxReplication.exe, which typically does not write .aspx files to disk. + Upon triage, the suspicious + .aspx file will likely look obvious on the surface. inspect the contents for script + code inside. Identify additional log sources, IIS included, to review source and + other potential exploitation. It is often the case that a particular threat is only + applicable to a specific subset of systems in your environment. Typically analytics + to detect those threats are written without the benefit of being able to only target + those systems as well. Writing analytics against all systems when those behaviors + are limited to identifiable subsets of those systems is suboptimal. Consider the + case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, + a hunter can limit their analytics to systems that have been identified as Exchange + servers. A hunter may start with the theory that the exchange server is communicating + with new systems that it has not previously. If this theory is run against all publicly + facing systems, the amount of noise it will generate will likely render this theory + untenable. However, using the asset information to limit this analytic to just the + Exchange servers will reduce the noise allowing the hunter to focus only on the + systems where this behavioral change is relevant.' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=MSExchangeMailboxReplication.exe by _time span=1h Processes.process_id Processes.process_name Processes.process_guid + Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| + tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", + "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time + file_name file_path process_name process_path process process_guid] | dedup file_create_time + | table dest file_create_time, file_name, file_path, process_name | `microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` + node. +known_false_positives: The query is structured in a way that `action` (read, create) + is not defined. Review the results of this query, filter, and tune as necessary. + It may be necessary to generate this query specific to your endpoint product. +references: + - https://redcanary.com/blog/blackbyte-ransomware/ +tags: + analytic_story: + - ProxyShell + - Ransomware + confidence: 90 + context: + - Source:Endpoint + - Stage:Exploitation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: A file - $file_name$ was written to disk that is related to IIS exploitation + related to ProxyShell. Review further file modifications on endpoint + $dest$ by user $user$. + mitre_attack_id: + - T1505 + - T1505.003 + - T1190 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: file_name + type: File Name + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_path + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.file_hash + - Filesystem.user + - Filesystem.process_guid + - Processes.process_name + - Processes.process_id + - Processes.process_name + - Processes.process_guid + risk_score: 81 + security_domain: endpoint + + \ No newline at end of file diff --git a/docs/_data/navigation.yml b/docs/_data/navigation.yml index 0fe74c1bec..7808f8c6c0 100644 --- a/docs/_data/navigation.yml +++ b/docs/_data/navigation.yml @@ -85,6 +85,8 @@ stories: url: /stories/cloud_security/ - title: Malware url: /stories/malware/ + - title: Privilege Escalation + url: /stories/privilege_escalation/ - title: Vulnerability url: /stories/vulnerability/ playbooks: diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index 49496d4d0a..816596c7b9 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -589,6 +589,7 @@ sidebar: | [Start Up During Safe Mode Boot](/endpoint/start_up_during_safe_mode_boot/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Sunburst Correlation DLL and Network Event](/endpoint/sunburst_correlation_dll_and_network_event/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | TTP | | [Supernova Webshell](/web/supernova_webshell/) | [Web Shell](/tags/#web-shell) | TTP | +| [Suspicious Computer Account Name Change](/endpoint/suspicious_computer_account_name_change/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP | | [Suspicious Copy on System32](/endpoint/suspicious_copy_on_system32/) | [Rename System Utilities](/tags/#rename-system-utilities), [Masquerading](/tags/#masquerading) | TTP | | [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [Suspicious DLLHost no Command Line Arguments](/endpoint/suspicious_dllhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | @@ -599,6 +600,7 @@ sidebar: | [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [Suspicious Image Creation In Appdata Folder](/endpoint/suspicious_image_creation_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | | [Suspicious Java Classes]() | None | Anomaly | +| [Suspicious Kerberos Service Ticket Request](/endpoint/suspicious_kerberos_service_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP | | [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | TTP | | [Suspicious MSBuild Spawn](/endpoint/suspicious_msbuild_spawn/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild) | TTP | | [Suspicious PlistBuddy Usage](/endpoint/suspicious_plistbuddy_usage/) | [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | @@ -615,6 +617,7 @@ sidebar: | [Suspicious SQLite3 LSQuarantine Behavior](/endpoint/suspicious_sqlite3_lsquarantine_behavior/) | [Data Staged](/tags/#data-staged) | TTP | | [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly | | [Suspicious SearchProtocolHost no Command Line Arguments](/endpoint/suspicious_searchprotocolhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | +| [Suspicious Ticket Granting Ticket Request](/endpoint/suspicious_ticket_granting_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | Hunting | | [Suspicious WAV file in Appdata Folder](/endpoint/suspicious_wav_file_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | | [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | | [Suspicious microsoft workflow compiler usage](/endpoint/suspicious_microsoft_workflow_compiler_usage/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | TTP | diff --git a/docs/_pages/playbooks.md b/docs/_pages/playbooks.md index d0354aa223..eb535f5e60 100644 --- a/docs/_pages/playbooks.md +++ b/docs/_pages/playbooks.md @@ -11,8 +11,10 @@ sidebar: | Name | Detections | Type | | --------| ---------- | ----------- | | [Active Directory Reset password](/playbooks/active_directory_reset_password/)| None | Response | +| [Block Indicators](/playbooks/block_indicators/)| None | Response | | [Crowdstrike Malware Triage](/playbooks/crowdstrike_malware_triage/)| None | Response | | [Delete Detected Files](/playbooks/delete_detected_files/)|[Executable File Written in Administrative SMB Share](/endpoint/executable_file_written_in_administrative_smb_share/)| Response | +| [Email Notification for Malware](/playbooks/email_notification_for_malware/)| None | Response | | [Internal Host SSH Investigate](/playbooks/internal_host_ssh_investigate/)| None | Investigation | | [Internal Host SSH Log4j Investigate](/playbooks/internal_host_ssh_log4j_investigate/)| None | Investigation | | [Internal Host SSH Log4j Response](/playbooks/internal_host_ssh_log4j_response/)| None | Response | @@ -22,6 +24,7 @@ sidebar: | [Log4j Investigate](/playbooks/log4j_investigate/)|[Curl Download and Bash Execution](/endpoint/curl_download_and_bash_execution/)[Wget Download and Bash Execution](/endpoint/wget_download_and_bash_execution/)[Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/)[Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/)[Outbound Network Connection from Java Using Default Ports](/endpoint/outbound_network_connection_from_java_using_default_ports/)[Log4Shell JNDI Payload Injection Attempt](/web/log4shell_jndi_payload_injection_attempt/)[Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/)[Detect Outbound LDAP Traffic](/network/detect_outbound_ldap_traffic/)| Investigate | | [Log4j Respond](/playbooks/log4j_respond/)|[Curl Download and Bash Execution](/endpoint/curl_download_and_bash_execution/)[Wget Download and Bash Execution](/endpoint/wget_download_and_bash_execution/)[Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/)[Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/)[Outbound Network Connection from Java Using Default Ports](/endpoint/outbound_network_connection_from_java_using_default_ports/)[Log4Shell JNDI Payload Injection Attempt](/web/log4shell_jndi_payload_injection_attempt/)[Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/)[Detect Outbound LDAP Traffic](/network/detect_outbound_ldap_traffic/)| Response | | [Log4j Splunk Investigation](/playbooks/log4j_splunk_investigation/)| None | Investigation | +| [Malware Hunt and Contain](/playbooks/malware_hunt_and_contain/)| None | Response | | [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter](/endpoint/conti_common_exec_parameter/)| Response | | [Risk Notable Block Indicators](/playbooks/risk_notable_block_indicators/)| None | Response | | [Risk Notable Enrich](/playbooks/risk_notable_enrich/)| None | Investigation | diff --git a/docs/_pages/privilege_escalation.md b/docs/_pages/privilege_escalation.md index 60bde4562d..234c9e8c36 100644 --- a/docs/_pages/privilege_escalation.md +++ b/docs/_pages/privilege_escalation.md @@ -3,7 +3,11 @@ title: Privilege Escalation layout: tag author_profile: false taxonomy: Privilege Escalation -permalink: /detections/privilege_escalation/ +permalink: /stories/privilege_escalation/ sidebar: - nav: "detections" ---- \ No newline at end of file + nav: "stories" +--- + +| Name | Technique | Tactic | +| ----------- | ----------- |--------------| +| [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | [Defense Evasion](/tags/#defense-evasion) | \ No newline at end of file diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index 118f12121b..b3dfe3c717 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -116,4 +116,5 @@ sidebar: | [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | | [Windows Privilege Escalation](windows_privilege_escalation) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) | | [Windows Service Abuse](windows_service_abuse) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | -| [XMRig](xmrig) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | \ No newline at end of file +| [XMRig](xmrig) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | +| [sAMAccountName Spoofing and Domain Controller Impersonation](samaccountname_spoofing_and_domain_controller_impersonation) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | [Defense Evasion](/tags/#defense-evasion) | \ No newline at end of file diff --git a/docs/_playbooks/block_indicators.md b/docs/_playbooks/block_indicators.md new file mode 100644 index 0000000000..0e781251b7 --- /dev/null +++ b/docs/_playbooks/block_indicators.md @@ -0,0 +1,46 @@ +--- +title: "Block Indicators" +last_modified_at: 2021-01-21 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - Palo Alto Networks Firewall + - CarbonBlack Response + - OpenDNS Umbrella +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [Palo Alto Networks Firewall](https://splunkbase.splunk.com/apps/#/search/Palo Alto Networks Firewall/product/soar), [CarbonBlack Response](https://splunkbase.splunk.com/apps/#/search/CarbonBlack Response/product/soar), [OpenDNS Umbrella](https://splunkbase.splunk.com/apps/#/search/OpenDNS Umbrella/product/soar) +- **Last Updated**: 2021-01-21 +- **Author**: Philip Royer, Splunk +- **ID**: fc0edc76-ff2b-48b0-5f6f-63da6783fd63 + +#### Associated Detections + + +#### How To Implement +This playbook uses the following custom lists: ip_address_blocklist, domain_blocklist, filehash_blocklist. This playbook provides an easy, automated, and straightforward solution to maintaining up-to-date IP address, file, and domain blocklists. The playbook looks for any of the required CEF fields within the container. The CEF value is then cross-referenced with their respective Custom Lists. IP addresses are blocked on a Firewall, while domains are blocked using a blocklist service. The blocking of these two will prevent access to the IOCs. Finally, file hashes are blocked using an endpoint protection service, which will prevent the process from running on affected endpoints within a network. After the IOCs are blocked using various apps, they are added to their respective custom lists as to maintain a running blocklist record. + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/block_indicators.png) + +#### Required field +* destinationDnsDomain +* destinationAddress +* fileHash + + +#### Reference + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/block_indicators.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/delete_detected_files.md b/docs/_playbooks/delete_detected_files.md index 8cfcdde7fa..cdfc5924d6 100644 --- a/docs/_playbooks/delete_detected_files.md +++ b/docs/_playbooks/delete_detected_files.md @@ -719,6 +719,9 @@ This playbook acts upon events where a file has been determined to be malicious + + + diff --git a/docs/_playbooks/email_notification_for_malware.md b/docs/_playbooks/email_notification_for_malware.md new file mode 100644 index 0000000000..ebd1df6037 --- /dev/null +++ b/docs/_playbooks/email_notification_for_malware.md @@ -0,0 +1,46 @@ +--- +title: "Email Notification for Malware" +last_modified_at: 2021-01-19 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - VirusTotal + - WildFire + - CarbonBlack Response + - SMTP +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [VirusTotal](https://splunkbase.splunk.com/apps/#/search/VirusTotal/product/soar), [WildFire](https://splunkbase.splunk.com/apps/#/search/WildFire/product/soar), [CarbonBlack Response](https://splunkbase.splunk.com/apps/#/search/CarbonBlack Response/product/soar), [SMTP](https://splunkbase.splunk.com/apps/#/search/SMTP/product/soar) +- **Last Updated**: 2021-01-19 +- **Author**: Philip Royer, Splunk +- **ID**: fb3edc76-ff2b-48b0-5f6f-63da6483fd63 + +#### Associated Detections + + +#### How To Implement +Be sure to update asset naming to reflect the asset names configured in your environment. + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/email_notification_for_malware.png) + +#### Required field +* fileHash +* vaultId + + +#### Reference + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/email_notification_for_malware.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/log4j_investigate.md b/docs/_playbooks/log4j_investigate.md index dfffa5f799..a6b8404eb9 100644 --- a/docs/_playbooks/log4j_investigate.md +++ b/docs/_playbooks/log4j_investigate.md @@ -1369,6 +1369,12 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + + + + @@ -3162,6 +3168,12 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + + + + @@ -3952,6 +3964,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + @@ -4574,6 +4589,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + @@ -5273,6 +5291,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + @@ -5753,6 +5774,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + @@ -6301,6 +6325,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can + + + diff --git a/docs/_playbooks/log4j_respond.md b/docs/_playbooks/log4j_respond.md index d54e6d630a..e481f99c95 100644 --- a/docs/_playbooks/log4j_respond.md +++ b/docs/_playbooks/log4j_respond.md @@ -1369,6 +1369,12 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + + + + @@ -3162,6 +3168,12 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + + + + @@ -3952,6 +3964,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + @@ -4574,6 +4589,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + @@ -5273,6 +5291,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + @@ -5753,6 +5774,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + @@ -6301,6 +6325,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a + + + diff --git a/docs/_playbooks/malware_hunt_and_contain.md b/docs/_playbooks/malware_hunt_and_contain.md new file mode 100644 index 0000000000..affcc75d0e --- /dev/null +++ b/docs/_playbooks/malware_hunt_and_contain.md @@ -0,0 +1,45 @@ +--- +title: "Malware Hunt and Contain" +last_modified_at: 2021-01-21 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - LDAP + - ServiceNow + - CarbonBlack Response + - VirusTotal +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook investigates and remediates malware infections on the endpoint. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [LDAP](https://splunkbase.splunk.com/apps/#/search/LDAP/product/soar), [ServiceNow](https://splunkbase.splunk.com/apps/#/search/ServiceNow/product/soar), [CarbonBlack Response](https://splunkbase.splunk.com/apps/#/search/CarbonBlack Response/product/soar), [VirusTotal](https://splunkbase.splunk.com/apps/#/search/VirusTotal/product/soar) +- **Last Updated**: 2021-01-21 +- **Author**: Philip Royer, Splunk +- **ID**: fb3edc76-ff2b-43c0-5f6f-63da4483fd63 + +#### Associated Detections + + +#### How To Implement +Be sure to update asset naming to reflect the asset names configured in your environment. + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/malware_hunt_and_contain.png) + +#### Required field +* fileHash + + +#### Reference + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/malware_hunt_and_contain.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/ransomware_investigate_and_contain.md b/docs/_playbooks/ransomware_investigate_and_contain.md index 0299c811e8..bdea3a0823 100644 --- a/docs/_playbooks/ransomware_investigate_and_contain.md +++ b/docs/_playbooks/ransomware_investigate_and_contain.md @@ -723,6 +723,9 @@ This playbook investigates and contains ransomware detected on endpoints. + + + diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index fdf9fa20c5..e764528022 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md index 546b572f60..4b1d45805d 100644 --- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md +++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index e12d68de5b..98bb689ec4 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index ab0ecc5637..a3fa6ef07a 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md index bcf8aaaa8c..73b559cdc7 100644 --- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md +++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 8fad54eb25..8899aeda49 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index 4ad2e5b52c..abed4f537e 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index 84e6a6e56c..21106203ab 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md index 656f58f772..fa905cff49 100644 --- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md +++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index 27c4ea999a..09dc3ce7c3 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md index 16f6591cd9..5d22e8600c 100644 --- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md +++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index 74be8d82f7..abed6c2a30 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index 3c89f71481..88fc78ffb0 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index abe9c62ba4..2a41671e6e 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index c04d5022e3..4a13cb8743 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md index 305b0d96c0..b04d22b896 100644 --- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md +++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 57e387f1b3..c27131ec6a 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md index 8eb6dcb7b4..5c1c79a22a 100644 --- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md +++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index a3a7ff4fe0..d36385034a 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index 93b66ac79b..d87eabc15e 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index e45ef8fd13..ec3d1540dd 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index 2324a3c081..aa4c2545d7 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md index c3a899224e..6010dd78b3 100644 --- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md +++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index 5497d10313..293057b6dc 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index 52e81731e8..9f200d7288 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md index b2b1612b06..4f92e207a9 100644 --- a/docs/_posts/2020-03-16-spike_in_file_writes.md +++ b/docs/_posts/2020-03-16-spike_in_file_writes.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index 648c5ac70a..a95ffd32d0 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index 342fdf976a..4a01d6ad31 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index e9f3b6a2de..4cff77757a 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md index 21755982a6..058d1e5dd2 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index c47e24c064..aa48878684 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md index aea0b66924..e410b32710 100644 --- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md +++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index 34dfdef967..29b6e7695d 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index fad1b4da69..4243de923a 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index 6cec018769..6b57e1ce33 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index efe6426756..624c2d8604 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md index 587c321922..806cae541f 100644 --- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md +++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md index a3971be906..e8872dea56 100644 --- a/docs/_posts/2020-07-21-excessive_dns_failures.md +++ b/docs/_posts/2020-07-21-excessive_dns_failures.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index f59439128a..6697097663 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md index 0df2e3e9a4..39b435b5c4 100644 --- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md +++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index 125925f8ea..e777a22344 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md index 76df51567f..c5149bfbd1 100644 --- a/docs/_posts/2020-07-21-okta_account_lockout_events.md +++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index f86000429d..7b6ba38e2d 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index b398487cf2..2b11dab2f3 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index 59b32e13bd..7e3331fa29 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index 011f47bf11..254dd5dbe6 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md index adc98ba3e1..a4a8b0c526 100644 --- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md +++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index 6d7527892e..48c07da8a6 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md index 05f075aa32..319f266239 100644 --- a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md +++ b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md index 46c91e5864..76f7a54e6b 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md index abb6589d8a..16c6922284 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index 657c0693e1..24ded7a654 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index 4bde5a0a93..838528a2a2 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md index ac098cfc58..01fafd1994 100644 --- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md +++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md index de3b6f6ff7..20e9574cf7 100644 --- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md index ec5164abee..757bd609ee 100644 --- a/docs/_posts/2020-07-27-aws_detect_role_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md index 251c22c45c..a2fb8275c0 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md index e725754cc4..9691fa9609 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index 6b5f9a566d..0efdd8f5bb 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md index 88ae2f4a2f..857e9c0cae 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md index 66e0cb61d7..0659c04bd2 100644 --- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md +++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md index f0740c07c0..c6c44c174b 100644 --- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md +++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md index 09b0d44813..aabb178903 100644 --- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md +++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md index 6ca47d8477..febc2c7941 100644 --- a/docs/_posts/2020-08-11-detect_arp_poisoning.md +++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md index 898b1cb5bc..ced5f95abd 100644 --- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md +++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md index 0cf62cb13a..0e8a26cbc6 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md @@ -25,7 +25,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md index 00e0f786ad..27938a0379 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md @@ -25,7 +25,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md index cd75dc755b..bf41d76542 100644 --- a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md +++ b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md index c69b147120..821224f83e 100644 --- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md +++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md index 17ff1b5612..cc58a00d98 100644 --- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md +++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md index 0c0afb318c..ccf3405111 100644 --- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md +++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md @@ -18,7 +18,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md index fb54f9013b..558b8295ef 100644 --- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md +++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md index 0cf36a0a0d..6ccc7e0c57 100644 --- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md +++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md index 6486c00bc7..08099e1d3c 100644 --- a/docs/_posts/2020-10-28-detect_port_security_violation.md +++ b/docs/_posts/2020-10-28-detect_port_security_violation.md @@ -23,7 +23,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index 2cc469a351..28c41121b8 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md index 4dd1b87f8a..6830c99a27 100644 --- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md +++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md @@ -21,7 +21,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index 84fc83f605..d80392e8c0 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md index 72570dc4fa..04c0c6f028 100644 --- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md +++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md index dbadb9f1d6..6ea9194963 100644 --- a/docs/_posts/2021-01-06-supernova_webshell.md +++ b/docs/_posts/2021-01-06-supernova_webshell.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md index 112b57d434..99cff9d716 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md @@ -13,7 +13,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md index b447f0ff1b..e652e13a6f 100644 --- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md +++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md index b91ddbe8de..05cdbd8a88 100644 --- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md +++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md index 332ddfc58c..88b4e9883e 100644 --- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md +++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index ed5ee31894..f204dc8f9a 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index 2c97d73e16..4a129773da 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md index 4a5e3f7198..bf387af096 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index 22dfe0d5f6..56ec8ce0e8 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -16,7 +16,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-03-01-any_powershell_downloadfile.md b/docs/_posts/2021-03-01-any_powershell_downloadfile.md index 5af1e40a1a..612df1337e 100644 --- a/docs/_posts/2021-03-01-any_powershell_downloadfile.md +++ b/docs/_posts/2021-03-01-any_powershell_downloadfile.md @@ -97,7 +97,7 @@ False positives may be present and filtering will need to occur by parent proces | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index 50038aa3aa..93e02ebeed 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index 1f3b635fde..34197f534e 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -14,7 +14,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 1eb10f9491..b14393b1f9 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index 2ce86bfe2a..4408e2f45b 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md index 714b87b24c..c42bfcd7cd 100644 --- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md +++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md index 277f4092b4..058e672ada 100644 --- a/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md +++ b/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md @@ -98,7 +98,7 @@ Legitimate process can have this combination of command-line options, but it' | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md index 96af2320bc..ece38cfeb0 100644 --- a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md +++ b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md index d6165d454a..9610e848a8 100644 --- a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md +++ b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md @@ -15,7 +15,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md index 5a5c0b0274..8af72e4340 100644 --- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md +++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md @@ -25,7 +25,7 @@ tags: #### Description -DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, registering or loading dynwrapx.dll to a host highly suspect. Why is it needed? In most malicious instances, During triage, review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. +DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, registering or loading dynwrapx.dll to a host is highly suspicious. In most instances when it is used maliciously, the best way to triage is to review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This detection will return and identify the processes that invoke vbs/wscript/cscript. - **Type**: TTP - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud @@ -58,7 +58,7 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win #### How To Implement -To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. #### Required field * _time diff --git a/docs/_posts/2021-11-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2021-11-18-suspicious_process_dns_query_known_abuse_web_services.md index 449de0ca88..4a1007c03f 100644 --- a/docs/_posts/2021-11-18-suspicious_process_dns_query_known_abuse_web_services.md +++ b/docs/_posts/2021-11-18-suspicious_process_dns_query_known_abuse_web_services.md @@ -23,7 +23,7 @@ tags: #### Description -This analytic is to detect a suspicious process having a dns query on known abuse text paste web services, or VoIP, instant messaging and digital distribution platform to download some files. This technique is abused by adversaries, malware attacker and red team to download a malicious file on the target host. This is a good TTP indicator for possible initial access technique. Noise and false positive can be seen if the following instant messaging is allowed or common application in corporate network. +This analytic detects a suspicious process making a DNS query via known, abused text-paste web services, VoIP, instant messaging, and digital distribution platforms used to download external files. This technique is abused by adversaries, malware actors, and red teams to download a malicious file on the target host. This is a good TTP indicator for possible initial access techniques. A user will experience false positives if the following instant messaging is allowed or common applications like telegram or discord are allowed in the corporate network. - **Type**: TTP - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud @@ -56,7 +56,7 @@ This analytic is to detect a suspicious process having a dns query on known abus #### How To Implement -his detection relies on sysmon logs with the Event ID 7, Driver loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query. We suggest to run this detection at least once a day over the last 14 days. +This detection relies on sysmon logs with the Event ID 22, DNS Query. We suggest you run this detection at least once a day over the last 14 days. #### Required field * _time @@ -73,7 +73,7 @@ his detection relies on sysmon logs with the Event ID 7, Driver loaded. Please t #### Known False Positives -Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. filter is needed. +Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed. #### RBA diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md index 2f58ddb93b..4c8de317fe 100644 --- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md +++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md @@ -21,7 +21,7 @@ tags: #### Description -This analytic is to detect a suspicious dxdiag.exe process commandline can collect system info of the target host. This technique was seen in remcos, adversaries and other malware to collect information as part of recon or collection phase of attack. Even this behavior is rarely seen in a corporate network this commandline can be used by network administrator to audit host machine specification. Better to check what it did after it pipes out the result to a file for further processing. +This analytic is to detect a suspicious dxdiag.exe process command-line execution. Dxdiag is used to collect the system info of the target host. This technique has been used by Remcos RATS, various actors, and other malware to collect information as part of the recon or collection phase of an attack. This behavior should rarely be seen in a corporate network, but this command line can be used by a network administrator to audit host machine specifications. Thus in some rare cases, this detection will contain false positives in its results. To triage further, analyze what commands were passed after it pipes out the result to a file for further processing. - **Type**: Hunting - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud @@ -75,7 +75,7 @@ To successfully implement this search you need to be ingesting information on pr #### Known False Positives -this commandline can be used by network administrator to audit host machine specification.filter is needed. +This commandline can be used by a network administrator to audit host machine specifications. Thus, a filter is needed. #### RBA diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md index f1c868f3ab..07637bd0aa 100644 --- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md +++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md @@ -23,7 +23,7 @@ tags: #### Description -This analytic will detect a suspicious process contains a commandline parameter related to web browser credential dumper. This technique was used by Remcos RAT malware where it use the techique of Nirsoft webbrowserpassview.exe application to dump web browser credentials. Remcos use the "/stext" commandline to dump the credential in text format. This Hunting query is good indicator to look further for possible remcos infection within the network or possible compromised host. Since the detections is only base on the parameter command and the possible path where it will drop the text credential information, It may catch normal tools that having same command and behavior. +This analytic will detect if a suspicious process contains a commandline parameter related to a web browser credential dumper. This technique is used by Remcos RAT malware which uses the Nirsoft webbrowserpassview.exe application to dump web browser credentials. Remcos uses the "/stext" command line to dump the credentials in text format. This Hunting query is a good indicator of hosts suffering from possible Remcos RAT infection. Since the hunting query is based on the parameter command and the possible path where it will save the text credential information, it may catch normal tools that are using the same command and behavior. - **Type**: Hunting - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud diff --git a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md index 220322b755..d37e705f32 100644 --- a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md @@ -22,7 +22,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md index 5979cf17df..379c80715c 100644 --- a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md @@ -20,7 +20,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md index e5ad7cad7b..9c198f7cd6 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md +++ b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md index 68d8b11af7..e75547efe1 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md +++ b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md @@ -19,7 +19,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md index 2428fde8c9..977af1e228 100644 --- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md +++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md @@ -92,7 +92,7 @@ False positives should be limited, however filtering may be required. | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md index 76f3fe49d6..a32955e614 100644 --- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md +++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md @@ -92,7 +92,7 @@ False positives should be limited, however filtering may be required. | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-cmd_carry_out_string_command_parameter.md b/docs/_posts/2021-12-13-cmd_carry_out_string_command_parameter.md index 38a0bc3e33..29f3d586dd 100644 --- a/docs/_posts/2021-12-13-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2021-12-13-cmd_carry_out_string_command_parameter.md @@ -94,7 +94,7 @@ False positives may be high based on legitimate scripted code in any environment | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md index 90dc422735..345cff8038 100644 --- a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md +++ b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md @@ -89,7 +89,7 @@ Unknown at this moment. Outbound LDAP traffic should not be allowed outbound thr | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md index 817a87316a..d567c1cb8b 100644 --- a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md +++ b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md @@ -86,7 +86,7 @@ Filtering may be required in some instances, filter as needed. | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index 671785d68d..4f14ea95b4 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} @@ -93,7 +93,7 @@ Filtering may be required on internal developer build systems or classify assets | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md index 7e4615d7d1..a5c516bf66 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md @@ -97,7 +97,7 @@ If there is a vulnerablility scannner looking for log4shells this will trigger, | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md index 1f9dadbed2..3e585f0ac3 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md @@ -103,7 +103,7 @@ If there is a vulnerablility scannner looking for log4shells this will trigger, | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md index 34e66801b5..a4da3cde5b 100644 --- a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md +++ b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md @@ -40,10 +40,16 @@ A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that #### Search ``` - `sysmon` EventCode=3 (process_name=java OR process_name=java.exe) (DestinationPort=389 OR DestinationPort=1389 OR DestinationPort = 1099 ) -| rename Computer as dest -| stats count min(_time) as firstTime max(_time) as lastTime by dest, process_name, DestinationPort + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR Processes.process_name=javaw.exe) by _time Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where (Ports.dest_port= 389 OR Ports.dest_port= 636 OR Ports.dest_port = 1389 OR Ports.dest_port = 1099 ) by Ports.process_guid Ports.dest Ports.dest_port +| `drop_dm_object_name(Ports)` +| rename dest as connection_to_CNC] +| table _time dest parent_process_name process_name process_path process connection_to_CNC dest_port | `outbound_network_connection_from_java_using_default_ports_filter` ``` @@ -56,12 +62,15 @@ To successfully implement this search you need to be ingesting information on pr #### Required field * _time -* process_name -* EventID -* CommandLine -* Computer -* DestinationPort -* DestinationIp +* Processes.process_guid +* Processes.process_name +* Processes.dest +* Processes.process_path +* Processes.process +* Processes.parent_process_name +* Ports.process_guid +* Ports.dest +* Ports.dest_port #### Kill Chain Phase @@ -84,7 +93,7 @@ Legitimate Java applications may use perform outbound connections to these ports | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | @@ -99,7 +108,7 @@ Legitimate Java applications may use perform outbound connections to these ports Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) -* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/linux-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/linux-sysmon.log) +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log) diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index 5a5e26df94..b443e3945b 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -17,7 +17,7 @@ tags: --- ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION -We have not been able to test, simulate or build datasets for it, use at your own risk! +We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported. [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} @@ -93,7 +93,7 @@ Filtering may be required on internal developer build systems or classify assets | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-14-hunting_for_log4shell.md b/docs/_posts/2021-12-14-hunting_for_log4shell.md index 01c4e9145c..b51cfa3f8c 100644 --- a/docs/_posts/2021-12-14-hunting_for_log4shell.md +++ b/docs/_posts/2021-12-14-hunting_for_log4shell.md @@ -201,7 +201,7 @@ It is highly possible you will find false positives, however, the base score is | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. In previous releases (>2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or it can be mitigated in prior releases (<2.10) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). | None | +| [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | diff --git a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md new file mode 100644 index 0000000000..c50ba0c257 --- /dev/null +++ b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md @@ -0,0 +1,117 @@ +--- +title: "Suspicious Computer Account Name Change" +excerpt: "Valid Accounts, Domain Accounts" +categories: + - Endpoint +last_modified_at: 2021-12-20 +toc: true +toc_label: "" +tags: + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Domain Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - CVE-2021-42287 + - CVE-2021-42278 + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries need to create a new computer account name and rename it to match the name of a domain controller account without the ending '$'. In Windows Active Directory environments, computer account names always end with `$`. This analytic leverages Event Id 4781, `The name of an account was changed`, to identify a computer account rename event with a suspicious name that does not terminate with `$`. This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-12-20 +- **Author**: Mauricio Velazco, Splunk +- **ID**: 35a61ed8-61c4-11ec-bc1e-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +#### Search + +``` +`wineventlog_security` EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$" +| table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name +| `suspicious_computer_account_name_change_filter` +``` + +#### Associated Analytic Story +* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation) + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. + +#### Required field +* _time +* EventCode +* ComputerName +* Account_Name +* Old_Account_Name +* New_Account_Name + + +#### Kill Chain Phase +* Privilege Escalation + + +#### Known False Positives +Renaming a computer account name to a name that not end with '$' is highly unsual and may not have any legitimate scenarios. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 70.0 | 100 | 70 | A computer account $Old_Account_Name$ was renamed with a suspicious computer name | + + + +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-42287](https://nvd.nist.gov/vuln/detail/CVE-2021-42287) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291. | 6.5 | +| [CVE-2021-42278](https://nvd.nist.gov/vuln/detail/CVE-2021-42278) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291. | 6.5 | + + + +#### Reference + +* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_computer_account_name_change.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md new file mode 100644 index 0000000000..c67b4e4ab7 --- /dev/null +++ b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md @@ -0,0 +1,120 @@ +--- +title: "Suspicious Kerberos Service Ticket Request" +excerpt: "Valid Accounts, Domain Accounts" +categories: + - Endpoint +last_modified_at: 2021-12-20 +toc: true +toc_label: "" +tags: + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Domain Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - CVE-2021-42287 + - CVE-2021-42278 + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries will request and obtain a Kerberos Service Ticket (TGS) with a domain controller computer account as the Service Name. This Service Ticket can be then used to take control of the domain controller on the final part of the attack. This analytic leverages Event Id 4769, `A Kerberos service ticket was requested`, to identify an unusual TGS request where the Account_Name requesting the ticket matches the Service_Name field. This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-12-20 +- **Author**: Mauricio Velazco, Splunk +- **ID**: 8b1297bc-6204-11ec-b7c4-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +#### Search + +``` + `wineventlog_security` EventCode=4769 +| eval isSuspicious = if(lower(Service_Name) = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) +| where isSuspicious = 1 +| table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious +| `suspicious_kerberos_service_ticket_request_filter` +``` + +#### Associated Analytic Story +* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation) + + +#### How To Implement +To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. + +#### Required field +* _time +* EventCode +* Service_Name +* Account_Name +* Client_Address +* Failure_Code + + +#### Kill Chain Phase +* Privilege Escalation + + +#### Known False Positives +We have tested this detection logic with ~2 million 4769 events and did not identify false positives. However, they may be possible in certain environments. Filter as needed. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 60.0 | 100 | 60 | A suspicious Kerberos Service Ticket was requested by $Account_Name$ | + + + +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-42287](https://nvd.nist.gov/vuln/detail/CVE-2021-42287) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291. | 6.5 | +| [CVE-2021-42278](https://nvd.nist.gov/vuln/detail/CVE-2021-42278) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291. | 6.5 | + + + +#### Reference + +* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287) +* [https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_kerberos_service_ticket_request.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md new file mode 100644 index 0000000000..d6d6c3df82 --- /dev/null +++ b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md @@ -0,0 +1,111 @@ +--- +title: "Suspicious Ticket Granting Ticket Request" +excerpt: "Valid Accounts, Domain Accounts" +categories: + - Endpoint +last_modified_at: 2021-12-21 +toc: true +toc_label: "" +tags: + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Domain Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries will need to request a Kerberos Ticket Granting Ticket (TGT) on behalf of the newly created and renamed computer account. The TGT request will be preceded by a computer account name event. This analytic leverages Event Id 4781, `The name of an account was changed` and event Id 4768 `A Kerberos authentication ticket (TGT) was requested` to correlate a sequence of events where the new computer account on event id 4781 matches the request account on event id 4768. This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation. + +- **Type**: Hunting +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-12-21 +- **Author**: Mauricio Velazco, Splunk +- **ID**: d77d349e-6269-11ec-9cfe-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +#### Search + +``` + `wineventlog_security` (EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$") OR (EventCode=4768 Account_Name!="*$") +| eval RenamedComputerAccount = coalesce(New_Account_Name, mvindex(Account_Name,0)) +| transaction RenamedComputerAccount startswith=(EventCode=4781) endswith=(EventCode=4768) +| eval short_lived=case((duration<2),"TRUE") +| search short_lived = TRUE +| table _time, ComputerName, EventCode, Account_Name,RenamedComputerAccount, short_lived +|`suspicious_ticket_granting_ticket_request_filter` +``` + +#### Associated Analytic Story +* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation) + + +#### How To Implement +To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. + +#### Required field +* _time +* EventCode +* Old_Account_Name +* New_Account_Name +* Account_Name +* ComputerName + + +#### Kill Chain Phase +* Privilege Escalation + + +#### Known False Positives +A computer account name change event inmediately followed by a kerberos TGT request with matching fields is unsual. However, legitimate behavior may trigger it. Filter as needed. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 60.0 | 100 | 60 | A suspicious TGT was requested was requested | + + + + +#### Reference + +* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_ticket_granting_ticket_request.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_stories/samaccountname_spoofing_and_domain_controller_impersonation.md b/docs/_stories/samaccountname_spoofing_and_domain_controller_impersonation.md new file mode 100644 index 0000000000..f0f76e3896 --- /dev/null +++ b/docs/_stories/samaccountname_spoofing_and_domain_controller_impersonation.md @@ -0,0 +1,45 @@ +--- +title: "sAMAccountName Spoofing and Domain Controller Impersonation" +last_modified_at: 2021-12-20 +toc: true +toc_label: "" +tags: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +Monitor for activities and techniques associated with the exploitation of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) vulnerabilities. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-12-20 +- **Author**: Mauricio Velazco, Splunk +- **ID**: 0244fdee-61be-11ec-900e-acde48001122 + +#### Narrative + +On November 9, 2021, Microsoft released patches to address two vulnerabilities that affect Windows Active Directory networks, sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287). On December 10, 2021, security researchers Charlie Clark and Andrew Schwartz released a blog post where they shared how to weaponise these vulnerabilities in a target network an the initial detection opportunities. When successfully exploited, CVE-2021-42278 and CVE-2021-42287 allow an adversary, who has stolen the credentials of a low priviled domain user, to obtain a Kerberos Service ticket for a Domain Controller computer account. The only requirement is to have network connectivity to a domain controller. This attack vector effectivelly allows attackers to escalate their privileges in an Active Directory from a regular domain user account and take control of a domain controller. While patches have been released to address these vulnerabilities, deploying detection controls for this attack may help help defenders identify attackers attempting exploitation. + +#### Detections + +| Name | Technique | Type | +| ----------- | ----------- |--------------| +| [Suspicious Computer Account Name Change](/endpoint/suspicious_computer_account_name_change/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP | +| [Suspicious Kerberos Service Ticket Request](/endpoint/suspicious_kerberos_service_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP | +| [Suspicious Ticket Granting Ticket Request](/endpoint/suspicious_ticket_granting_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | Hunting | + +#### Reference + +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287) +* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/stories/samaccountname_spoofing_and_domain_controller_impersonation.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/index.markdown b/docs/index.markdown index 94ea7dcdae..1f87d60eab 100644 --- a/docs/index.markdown +++ b/docs/index.markdown @@ -9,26 +9,26 @@ header: actions: - label: "Download" url: "https://splunkbase.splunk.com/app/3449/" -excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **696** detections for Splunk." +excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **699** detections for Splunk." feature_row: - image_path: /static/feature_detection.png alt: "customizable" title: "Detections" - excerpt: "See all **696** Splunk Analytics built to find evil 😈." + excerpt: "See all **699** Splunk Analytics built to find evil 😈." url: "/detections" btn_class: "btn--primary" btn_label: "Explore" - image_path: /static/feature_stories.png alt: "fully responsive" title: "Analytic Stories" - excerpt: "See all **107** use cases, 📦 of detections built to address a threat." + excerpt: "See all **108** use cases, 📦 of detections built to address a threat." url: "/stories" btn_class: "btn--primary" btn_label: "Explore" - image_path: /static/feature_playbooks.png alt: "100% free" title: "Playbooks" - excerpt: "See all **23** sets of steps 🐾 to automatically response to a threat." + excerpt: "See all **26** sets of steps 🐾 to automatically response to a threat." url: "/playbooks" btn_class: "btn--primary" btn_label: "Explore" diff --git a/playbooks/block_indicators.json b/playbooks/block_indicators.json new file mode 100644 index 0000000000..db7387542f --- /dev/null +++ b/playbooks/block_indicators.json @@ -0,0 +1,3808 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Use Cases", + "misc": { "apps_list": ["Palo Alto Networks Firewall", "Carbon Black Response", "OpenDNS Umbrella", "Phantom"] }, + "coa": { + "data": { + "clean": true, + "code_block": "", + "description": "This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists.", + "hash": "753b457bfed5fa341dd36803c11b681681df46f6", + "joint": { + "cells": [ + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "70140aee-e625-43c7-bf11-da4d1bc729c1", + "router": { + "name": "metro" + }, + "source": { + "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "81b07a3a-01ac-4d3a-b254-9cb7a3e97392", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 27 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "8f7b00cd-6206-4e1f-a1fd-c17ca7df99d1", + "router": { + "name": "metro" + }, + "source": { + "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "d230871e-ee71-44a6-af7f-fb4f2f584da4", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 43 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d333fcd2-eb73-4914-8e92-ad8551a6b068", + "router": { + "name": "metro" + }, + "source": { + "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "ea4b2594-8ef5-42a4-8285-125126536531", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 66 + }, + { + "0": "S", + "1": "T", + "2": "A", + "3": "R", + "4": "T", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "ref-x": 33, + "ref-y": 8, + "text": "START" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "ref-x": 13, + "xlink:href": "/inc/coa/img/block_icon_start.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'filter_1' block\n filter_1(container=container)\n\n # call 'filter_2' block\n filter_2(container=container)\n\n # call 'filter_3' block\n filter_3(container=container)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a", + "inPorts": [], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 22, + "line_start": 8, + "name": "", + "notes": "", + "number": 0, + "order": 1, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 180, + "y": 40 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "START", + "type": "coa.StartEnd", + "warn": false, + "z": 95 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "f157b9dd-877a-4fbe-94c7-7709af7c1ceb", + "router": { + "name": "metro" + }, + "source": { + "id": "81b07a3a-01ac-4d3a-b254-9cb7a3e97392", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "9537d314-97d6-484b-ae20-3d9564bab6d6", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 160 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "98116e8f-35f5-4a4d-b09d-f2f254b3f36a", + "router": { + "name": "metro" + }, + "source": { + "id": "9537d314-97d6-484b-ae20-3d9564bab6d6", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7a912b77-6a81-421d-b6f5-d865b3fffd73", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 177 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ea7e5f03-8b63-43f5-a2cb-1adf63b89c88", + "router": { + "name": "metro" + }, + "source": { + "id": "7a912b77-6a81-421d-b6f5-d865b3fffd73", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "08306503-f5d1-4cd0-b32b-90a7670ff1ca", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 190 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "429dcfde-c34b-40f8-9b0b-9614e6f0cb75", + "router": { + "name": "metro" + }, + "source": { + "id": "08306503-f5d1-4cd0-b32b-90a7670ff1ca", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 250 + }, + { + "0": "E", + "1": "N", + "2": "D", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".title": { + "text": "END" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_end.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "add to IP blocklist, add to domain blocklist, add to hash blocklist", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef", + "inPorts": [ + "in" + ], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 297, + "line_start": 284, + "name": "", + "notes": "", + "number": 0, + "order": 14, + "outPorts": [], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1080, + "y": 40 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "END", + "type": "coa.StartEnd", + "warn": false, + "z": 264 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "f19bbeed-6445-4a8c-bc7c-a2171961cf69", + "router": { + "name": "metro" + }, + "source": { + "id": "d230871e-ee71-44a6-af7f-fb4f2f584da4", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7862d46c-23ea-4cda-9ef9-db171fd5ac93", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 277 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "8b252e02-8361-4d12-8663-61c2e8965ed9", + "router": { + "name": "metro" + }, + "source": { + "id": "7862d46c-23ea-4cda-9ef9-db171fd5ac93", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "6ad60d9d-90e4-4515-9931-05f31cc5f87a", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 286 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "fddf6767-1020-4c4e-9178-5bdcc37ef938", + "router": { + "name": "metro" + }, + "source": { + "id": "ea4b2594-8ef5-42a4-8285-125126536531", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "25ad9a87-018a-440b-a48d-3a0bd95226f6", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 288 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ea23ca12-a7c3-40e3-b38c-67a92493b1b8", + "router": { + "name": "metro" + }, + "source": { + "id": "25ad9a87-018a-440b-a48d-3a0bd95226f6", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "45d563b4-3a4a-4cc8-bf1f-dfe4de434928", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 293 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "778389f4-851e-4b64-b5c1-e567e1277660", + "router": { + "name": "metro" + }, + "source": { + "id": "6ad60d9d-90e4-4515-9931-05f31cc5f87a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "1924c418-d049-478e-8cfd-ec94eb22f7c6", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 295 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "a111892b-a198-4573-9271-5f68da45f08d", + "router": { + "name": "metro" + }, + "source": { + "id": "1924c418-d049-478e-8cfd-ec94eb22f7c6", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 297 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "c17d4063-43db-4dc2-9ec2-b9c554f1a1f8", + "router": { + "name": "metro" + }, + "source": { + "id": "45d563b4-3a4a-4cc8-bf1f-dfe4de434928", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "dced0e6a-538a-4d02-800a-5e5c0caf92f7", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 301 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "0b7d5584-b8cd-47e6-8f0b-455358f4b318", + "router": { + "name": "metro" + }, + "source": { + "id": "dced0e6a-538a-4d02-800a-5e5c0caf92f7", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 303 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 1 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.destinationAddress\", \"!=\", \"\"],\n ],\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "81b07a3a-01ac-4d3a-b254-9cb7a3e97392", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 264, + "line_start": 247, + "name": "filter", + "notes": "Filtering on artifacts that have the destinationAddress CEF value populated.", + "number": 1, + "order": 12, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "artifact:*.cef.destinationAddress", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 320, + "y": 20 + }, + "previous_function": "", + "previous_name": "filter_1", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 404 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 3 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.fileHash\", \"!=\", \"\"],\n ],\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_6(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "ea4b2594-8ef5-42a4-8285-125126536531", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 123, + "line_start": 106, + "name": "filter", + "notes": "Filtering on artifacts that have the destinationDnsDomain CEF value populated.", + "number": 3, + "order": 6, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "artifact:*.cef.fileHash", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 320, + "y": 300 + }, + "previous_function": "", + "previous_name": "filter_3", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 412 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 2 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.destinationDnsDomain\", \"!=\", \"\"],\n ],\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_5(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "d230871e-ee71-44a6-af7f-fb4f2f584da4", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 106, + "line_start": 89, + "name": "filter", + "notes": "Filtering on artifacts that have the destinationDnsDomain CEF value populated.", + "number": 2, + "order": 5, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "artifact:*.cef.destinationDnsDomain", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 320, + "y": 160 + }, + "previous_function": "", + "previous_name": "filter_2", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 416 + }, + { + "action": "add listitem", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "create": "True", + "list": "custom_list:domain_blocklist", + "new_row": "block_domain_1:action_result.parameter.domain" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "add listitem", + "actions": [ + "no op", + "update list", + "get action result", + "create container", + "import container", + "export container", + "deflate item", + "add artifact", + "find listitem", + "add listitem", + "find artifacts", + "update artifact tags", + "add note", + "update artifact", + "test connectivity" + ], + "active": true, + "app_name": "Phantom", + "app_version": "3.0.2", + "appid": "deb82aa9-22cc-4675-9cf1-534b8d006eb7", + "asset_name": "phantom", + "config_type": "asset", + "count": 0, + "fields": { + "create": "True", + "list": "custom_list:domain_blocklist", + "new_row": "block_domain_1:action_result.parameter.domain" + }, + "has_app": true, + "id": 16, + "loaded": false, + "missing": false, + "name": "phantom", + "output": [ + { + "column_name": "Status", + "column_order": 0, + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "data_path": "action_result.parameter.create", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.parameter.list", + "data_type": "string", + "example_values": [ + "demo_list" + ] + }, + { + "contains": [ + "*" + ], + "data_path": "action_result.parameter.new_row", + "data_type": "string", + "example_values": [ + "[\"value1\",\"value2\",\"value3\"]" + ] + }, + { + "data_path": "action_result.data.*.failed", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.success", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.server", + "data_type": "string", + "example_values": [ + "https://10.1.1.10" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Server: https://10.1.1.10" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "parameters": { + "create": { + "data_type": "boolean", + "default": false, + "description": "Create list if it does not exist (default: false)", + "key": "create", + "order": 2, + "required": false + }, + "list": { + "data_type": "string", + "default": null, + "description": "Name or ID of a custom list", + "key": "list", + "order": 0, + "required": true + }, + "new_row": { + "contains": [ + "*" + ], + "data_type": "string", + "default": null, + "description": "New Row (string or JSON list)", + "key": "new_row", + "order": 1, + "primary": true, + "required": true + } + }, + "product_name": "Phantom", + "product_vendor": "Phantom", + "targets": "16", + "type": "information" + } + ], + "attrs": { + ".action": { + "text": "add to domain blocklist" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Generic" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def add_to_domain_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_to_domain_blocklist() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'add_to_domain_blocklist' call\n results_data_1 = phantom.collect2(container=container, datapath=['block_domain_1:action_result.parameter.domain', 'block_domain_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'add_to_domain_blocklist' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'list': \"custom_list:domain_blocklist\",\n 'create': True,\n 'new_row': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"add listitem\", parameters=parameters, assets=['phantom'], name=\"add_to_domain_blocklist\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": true, + "connection_name": "block domain", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "add to domain blocklist", + "delay": 0, + "description": "The domain is added to the custom list 'domain_blocklist' in order to prevent the Playbook from attempting to block a domain that has already been blocked.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "1924c418-d049-478e-8cfd-ec94eb22f7c6", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 219, + "line_start": 194, + "message": "Configuring now", + "name": "add listitem", + "notes": "The domain is added to the custom list 'domain_blocklist' in order to prevent the Playbook from attempting to block a domain that has already been blocked.", + "number": 2, + "order": 10, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 160 + }, + "previous_function": "", + "previous_name": "add_to_domain_blocklist", + "required_params": { + "list": true, + "new_row": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Generic", + "type": "coa.Action", + "warn": false, + "z": 421 + }, + { + "action": "block hash", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "comment": "", + "hash": "filtered-data:filter_6:condition_1:artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "comment": "", + "hash": "filtered-data:filter_6:condition_1:artifact:*.cef.fileHash" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "data_path": "action_result.parameter.comment", + "data_type": "string", + "example_values": [ + "Sample comment" + ] + }, + { + "column_name": "Hash", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "180469AE0B239E31DB4C65F02FD70BC1" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Block hash action succeeded. It might take some time for blacklisting to take effect." + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "block hash" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_hash_2() called')\n\n # collect data for 'block_hash_2' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_6:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_6:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'block_hash_2' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'hash': filtered_artifacts_item_1[0],\n 'comment': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], callback=add_to_hash_blocklist, name=\"block_hash_2\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "45d563b4-3a4a-4cc8-bf1f-dfe4de434928", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 67, + "line_start": 45, + "message": "Configuring now", + "name": "block hash", + "notes": "Blocks the hash utilizing the CarbonBlack Response endpoint technology app, preventing the process from running on endpoints utilizing CarbonBlack Response.", + "number": 2, + "order": 3, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 300 + }, + "previous_function": "", + "previous_name": "block_hash_2", + "required_params": { + "hash": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 423 + }, + { + "action": "block domain", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "disable_safeguards": "", + "domain": "filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "disable_safeguards": "", + "domain": "filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "opendns_umbrella", + "output": [ + { + "column_name": "Status", + "column_order": 1, + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.disable_safeguards", + "data_type": "boolean" + }, + { + "column_name": "Domain", + "column_order": 0, + "contains": [ + "domain" + ], + "data_path": "action_result.parameter.domain", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "column_name": "ID", + "column_order": 2, + "data_path": "action_result.data.*.id", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "block domain" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def block_domain_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_domain_1() called')\n\n # collect data for 'block_domain_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain', 'filtered-data:filter_5:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'block_domain_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'domain': filtered_artifacts_item_1[0],\n 'disable_safeguards': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"block domain\", parameters=parameters, assets=['opendns_umbrella'], callback=add_to_domain_blocklist, name=\"block_domain_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "6ad60d9d-90e4-4515-9931-05f31cc5f87a", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 89, + "line_start": 67, + "message": "Configuring now", + "name": "block domain", + "notes": "Blocks a domain utilizing the OpenDNS Umbrella app, preventing endpoints from accessing the domain from within the network.", + "number": 1, + "order": 4, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 160 + }, + "previous_function": "", + "previous_name": "block_domain_1", + "required_params": { + "domain": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 424 + }, + { + "action": "block ip", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "ip": "filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress", + "is_source_address": "", + "vsys": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "ip": "filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress", + "is_source_address": "", + "vsys": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "pan", + "output": [ + { + "column_name": "IP", + "column_order": 0, + "contains": [ + "ip" + ], + "data_path": "action_result.parameter.ip", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.vsys", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.is_source_address", + "data_type": "boolean" + }, + { + "column_name": "Status", + "column_order": 1, + "data_path": "action_result.status", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 2, + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "firewall" + } + ], + "attrs": { + ".action": { + "text": "block ip" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def block_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_ip_1() called')\n\n # collect data for 'block_ip_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress', 'filtered-data:filter_4:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'block_ip_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'ip': filtered_artifacts_item_1[0],\n 'vsys': \"\",\n 'is_source_address': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"block ip\", parameters=parameters, assets=['pan'], callback=add_to_IP_blocklist, name=\"block_ip_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "7a912b77-6a81-421d-b6f5-d865b3fffd73", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 45, + "line_start": 22, + "message": "Configuring now", + "name": "block ip", + "notes": "Blocks the IP as a destination address, utilizing the Palo Alto Networks Firewall app to prevent further access to the IP address as a destination.", + "number": 1, + "order": 2, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 20 + }, + "previous_function": "", + "previous_name": "block_ip_1", + "required_params": { + "ip": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 425 + }, + { + "action": "add listitem", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "create": "True", + "list": "custom_list:filehash_blocklist", + "new_row": "block_hash_2:action_result.parameter.hash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "add listitem", + "actions": [ + "no op", + "update list", + "get action result", + "create container", + "import container", + "export container", + "deflate item", + "add artifact", + "find listitem", + "add listitem", + "find artifacts", + "update artifact tags", + "add note", + "update artifact", + "test connectivity" + ], + "active": true, + "app_name": "Phantom", + "app_version": "3.0.2", + "appid": "deb82aa9-22cc-4675-9cf1-534b8d006eb7", + "asset_name": "phantom", + "config_type": "asset", + "count": 0, + "fields": { + "create": "True", + "list": "custom_list:filehash_blocklist", + "new_row": "block_hash_2:action_result.parameter.hash" + }, + "has_app": true, + "id": 16, + "loaded": false, + "missing": false, + "name": "phantom", + "output": [ + { + "column_name": "Status", + "column_order": 0, + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "data_path": "action_result.parameter.create", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.parameter.list", + "data_type": "string", + "example_values": [ + "demo_list" + ] + }, + { + "contains": [ + "*" + ], + "data_path": "action_result.parameter.new_row", + "data_type": "string", + "example_values": [ + "[\"value1\",\"value2\",\"value3\"]" + ] + }, + { + "data_path": "action_result.data.*.failed", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.success", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.server", + "data_type": "string", + "example_values": [ + "https://10.1.1.10" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Server: https://10.1.1.10" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "parameters": { + "create": { + "data_type": "boolean", + "default": false, + "description": "Create list if it does not exist (default: false)", + "key": "create", + "order": 2, + "required": false + }, + "list": { + "data_type": "string", + "default": null, + "description": "Name or ID of a custom list", + "key": "list", + "order": 0, + "required": true + }, + "new_row": { + "contains": [ + "*" + ], + "data_type": "string", + "default": null, + "description": "New Row (string or JSON list)", + "key": "new_row", + "order": 1, + "primary": true, + "required": true + } + }, + "product_name": "Phantom", + "product_vendor": "Phantom", + "targets": "16", + "type": "information" + } + ], + "attrs": { + ".action": { + "text": "add to hash blocklist" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Generic" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def add_to_hash_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_to_hash_blocklist() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'add_to_hash_blocklist' call\n results_data_1 = phantom.collect2(container=container, datapath=['block_hash_2:action_result.parameter.hash', 'block_hash_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'add_to_hash_blocklist' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'list': \"custom_list:filehash_blocklist\",\n 'create': True,\n 'new_row': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"add listitem\", parameters=parameters, assets=['phantom'], name=\"add_to_hash_blocklist\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": true, + "connection_name": "block hash", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "add to hash blocklist", + "delay": 0, + "description": "The file hash is added to the custom list 'filehash_blocklist' in order to prevent the Playbook from attempting to block a file hash that has already been blocked.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "dced0e6a-538a-4d02-800a-5e5c0caf92f7", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 191, + "line_start": 166, + "message": "Configuring now", + "name": "add listitem", + "notes": "The file hash is added to the custom list 'filehash_blocklist' in order to prevent the Playbook from attempting to block a file hash that has already been blocked.", + "number": 3, + "order": 9, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 300 + }, + "previous_function": "", + "previous_name": "add_to_hash_blocklist", + "required_params": { + "list": true, + "new_row": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Generic", + "type": "coa.Action", + "warn": false, + "z": 426 + }, + { + "action": "add listitem", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "create": "True", + "list": "custom_list:ip_address_blocklist", + "new_row": "block_ip_1:action_result.parameter.ip" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "add listitem", + "actions": [ + "no op", + "update list", + "get action result", + "create container", + "import container", + "export container", + "deflate item", + "add artifact", + "find listitem", + "add listitem", + "find artifacts", + "update artifact tags", + "add note", + "update artifact", + "test connectivity" + ], + "active": true, + "app_name": "Phantom", + "app_version": "3.0.2", + "appid": "deb82aa9-22cc-4675-9cf1-534b8d006eb7", + "asset_name": "phantom", + "config_type": "asset", + "count": 0, + "fields": { + "create": "True", + "list": "custom_list:ip_address_blocklist", + "new_row": "block_ip_1:action_result.parameter.ip" + }, + "has_app": true, + "id": 16, + "loaded": false, + "missing": false, + "name": "phantom", + "output": [ + { + "column_name": "Status", + "column_order": 0, + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "data_path": "action_result.parameter.create", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.parameter.list", + "data_type": "string", + "example_values": [ + "demo_list" + ] + }, + { + "contains": [ + "*" + ], + "data_path": "action_result.parameter.new_row", + "data_type": "string", + "example_values": [ + "[\"value1\",\"value2\",\"value3\"]" + ] + }, + { + "data_path": "action_result.data.*.failed", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.success", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.server", + "data_type": "string", + "example_values": [ + "https://10.1.1.10" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Server: https://10.1.1.10" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "parameters": { + "create": { + "data_type": "boolean", + "default": false, + "description": "Create list if it does not exist (default: false)", + "key": "create", + "order": 2, + "required": false + }, + "list": { + "data_type": "string", + "default": null, + "description": "Name or ID of a custom list", + "key": "list", + "order": 0, + "required": true + }, + "new_row": { + "contains": [ + "*" + ], + "data_type": "string", + "default": null, + "description": "New Row (string or JSON list)", + "key": "new_row", + "order": 1, + "primary": true, + "required": true + } + }, + "product_name": "Phantom", + "product_vendor": "Phantom", + "targets": "16", + "type": "information" + } + ], + "attrs": { + ".action": { + "text": "add to IP blocklist" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88, + "opacity": 1, + "stroke": "#E6984E" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Generic" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#E6984E" + }, + "text.icon": { + "fill": "#E6984E" + } + }, + "block_code": "def add_to_IP_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_to_IP_blocklist() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'add_to_IP_blocklist' call\n results_data_1 = phantom.collect2(container=container, datapath=['block_ip_1:action_result.parameter.ip', 'block_ip_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'add_to_IP_blocklist' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'list': \"custom_list:ip_address_blocklist\",\n 'create': True,\n 'new_row': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"add listitem\", parameters=parameters, assets=['phantom'], name=\"add_to_IP_blocklist\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": true, + "connection_name": "block ip", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "add to IP blocklist", + "delay": 0, + "description": "The IP address is added to the custom list 'ip_address_blocklist' in order to prevent the Playbook from attempting to block an IP address that has already been blocked.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "08306503-f5d1-4cd0-b32b-90a7670ff1ca", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 247, + "line_start": 222, + "message": "Configuring now", + "name": "add listitem", + "notes": "The IP address is added to the custom list 'ip_address_blocklist' in order to prevent the Playbook from attempting to block an IP address that has already been blocked.", + "number": 1, + "order": 11, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 20 + }, + "previous_function": "", + "previous_name": "add_to_IP_blocklist", + "required_params": { + "list": true, + "new_row": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Generic", + "type": "coa.Action", + "warn": false, + "z": 430 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 6 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_6(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_6() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"filtered-data:filter_3:condition_1:artifact:*.cef.fileHash\", \"in\", \"custom_list:filehash_blocklist\"],\n ],\n name=\"filter_6:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n block_hash_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "Checking to see if this filehash is in the custom list called \"filehash_blocklist\"", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "25ad9a87-018a-440b-a48d-3a0bd95226f6", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 163, + "line_start": 146, + "name": "filter", + "notes": "Checking to see if this filehash is in the custom list called \"filehash_blocklist\"", + "number": 6, + "order": 8, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "in", + "data_type": "", + "param": "filtered-data:filter_3:condition_1:artifact:*.cef.fileHash", + "value": "custom_list:filehash_blocklist" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 460, + "y": 300 + }, + "previous_function": "", + "previous_name": "filter_6", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 432 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 5 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_5() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"filtered-data:filter_2:condition_1:artifact:*.cef.destinationDnsDomain\", \"in\", \"custom_list:domain_blocklist\"],\n ],\n name=\"filter_5:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n block_domain_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "Checking to see if this domain address is in the custom list called \"domain_blocklist\"", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "7862d46c-23ea-4cda-9ef9-db171fd5ac93", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 143, + "line_start": 126, + "name": "filter", + "notes": "Checking to see if this domain address is in the custom list called \"domain_blocklist\"", + "number": 5, + "order": 7, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "in", + "data_type": "", + "param": "filtered-data:filter_2:condition_1:artifact:*.cef.destinationDnsDomain", + "value": "custom_list:domain_blocklist" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 460, + "y": 160 + }, + "previous_function": "", + "previous_name": "filter_5", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 433 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 4 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_4() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress\", \"not in\", \"custom_list:ip_address_blocklist\"],\n ],\n name=\"filter_4:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n block_ip_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "Checking to see if this IP address is in the custom list called \"ip_address_blocklist\"", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "9537d314-97d6-484b-ae20-3d9564bab6d6", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 284, + "line_start": 267, + "name": "filter", + "notes": "Checking to see if this IP address is in the custom list called \"ip_address_blocklist\"", + "number": 4, + "order": 13, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "not in", + "data_type": "", + "param": "filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress", + "value": "custom_list:ip_address_blocklist" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 460, + "y": 20 + }, + "previous_function": "", + "previous_name": "filter_4", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 434 + } + ] + }, + "notes": "This playbook uses the following Apps: \n\n- Palo Alto Networks Firewall (PAN)\n- CarbonBlack Response\n- OpenDNS Umbrella\n\nThis playbook uses the following custom list:\n\n- ip_address_blocklist\n- domain_blocklist\n- filehash_blocklist\n\nThis playbook provides an easy, automated, and straightforward solution to maintaining up-to-date IP address, file, and domain blocklists. The process is:\n\nEach Artifact within an event is checked for the presence of the following CEF fields:\nDestinationDnsDomain - Domains\nDestinationAddress - IP addresses\nFileHash - Files\nThe CEF value is then cross-referenced with their respective Custom Lists.\nIP addresses are blocked on a Firewall, while domains are blocked using a blocklist service. The blocking of these two will prevent access to the IOCs. Finally, file hashes are blocked using an endpoint protection service, which will prevent the process from running on affected endpoints within a network.\nAfter the IOCs are blocked using various apps, they are added to their respective custom lists as to maintain a running blocklist record." + }, + "python_version": "3", + "schema": 4, + "version": "4.10.0.40961" + }, + "create_time": "2021-01-21T21:26:58.710395+00:00", + "draft_mode": false, + "labels": [ + "events" + ], + "tags": [] +} diff --git a/playbooks/block_indicators.png b/playbooks/block_indicators.png new file mode 100644 index 0000000000..60fb2e8638 Binary files /dev/null and b/playbooks/block_indicators.png differ diff --git a/playbooks/block_indicators.py b/playbooks/block_indicators.py new file mode 100644 index 0000000000..55297ef4b2 --- /dev/null +++ b/playbooks/block_indicators.py @@ -0,0 +1,297 @@ +""" +This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists. +""" + +import phantom.rules as phantom +import json +from datetime import datetime, timedelta +def on_start(container): + phantom.debug('on_start() called') + + # call 'filter_1' block + filter_1(container=container) + + # call 'filter_2' block + filter_2(container=container) + + # call 'filter_3' block + filter_3(container=container) + + return + +def block_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_ip_1() called') + + # collect data for 'block_ip_1' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress', 'filtered-data:filter_4:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'block_ip_1' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'ip': filtered_artifacts_item_1[0], + 'vsys': "", + 'is_source_address': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="block ip", parameters=parameters, assets=['pan'], callback=add_to_IP_blocklist, name="block_ip_1") + + return + +def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_hash_2() called') + + # collect data for 'block_hash_2' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_6:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_6:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'block_hash_2' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'hash': filtered_artifacts_item_1[0], + 'comment': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="block hash", parameters=parameters, assets=['carbonblack'], callback=add_to_hash_blocklist, name="block_hash_2") + + return + +def block_domain_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_domain_1() called') + + # collect data for 'block_domain_1' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain', 'filtered-data:filter_5:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'block_domain_1' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'domain': filtered_artifacts_item_1[0], + 'disable_safeguards': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="block domain", parameters=parameters, assets=['opendns_umbrella'], callback=add_to_domain_blocklist, name="block_domain_1") + + return + +def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_2() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["artifact:*.cef.destinationDnsDomain", "!=", ""], + ], + name="filter_2:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + filter_5(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_3() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["artifact:*.cef.fileHash", "!=", ""], + ], + name="filter_3:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + filter_6(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Checking to see if this domain address is in the custom list called "domain_blocklist" +""" +def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_5() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["filtered-data:filter_2:condition_1:artifact:*.cef.destinationDnsDomain", "in", "custom_list:domain_blocklist"], + ], + name="filter_5:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + block_domain_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Checking to see if this filehash is in the custom list called "filehash_blocklist" +""" +def filter_6(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_6() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["filtered-data:filter_3:condition_1:artifact:*.cef.fileHash", "in", "custom_list:filehash_blocklist"], + ], + name="filter_6:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + block_hash_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +The file hash is added to the custom list 'filehash_blocklist' in order to prevent the Playbook from attempting to block a file hash that has already been blocked. +""" +def add_to_hash_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('add_to_hash_blocklist() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'add_to_hash_blocklist' call + results_data_1 = phantom.collect2(container=container, datapath=['block_hash_2:action_result.parameter.hash', 'block_hash_2:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'add_to_hash_blocklist' call + for results_item_1 in results_data_1: + if results_item_1[0]: + parameters.append({ + 'list': "custom_list:filehash_blocklist", + 'create': True, + 'new_row': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="add listitem", parameters=parameters, assets=['phantom'], name="add_to_hash_blocklist", parent_action=action) + + return + +""" +The domain is added to the custom list 'domain_blocklist' in order to prevent the Playbook from attempting to block a domain that has already been blocked. +""" +def add_to_domain_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('add_to_domain_blocklist() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'add_to_domain_blocklist' call + results_data_1 = phantom.collect2(container=container, datapath=['block_domain_1:action_result.parameter.domain', 'block_domain_1:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'add_to_domain_blocklist' call + for results_item_1 in results_data_1: + if results_item_1[0]: + parameters.append({ + 'list': "custom_list:domain_blocklist", + 'create': True, + 'new_row': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="add listitem", parameters=parameters, assets=['phantom'], name="add_to_domain_blocklist", parent_action=action) + + return + +""" +The IP address is added to the custom list 'ip_address_blocklist' in order to prevent the Playbook from attempting to block an IP address that has already been blocked. +""" +def add_to_IP_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('add_to_IP_blocklist() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'add_to_IP_blocklist' call + results_data_1 = phantom.collect2(container=container, datapath=['block_ip_1:action_result.parameter.ip', 'block_ip_1:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'add_to_IP_blocklist' call + for results_item_1 in results_data_1: + if results_item_1[0]: + parameters.append({ + 'list': "custom_list:ip_address_blocklist", + 'create': True, + 'new_row': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="add listitem", parameters=parameters, assets=['phantom'], name="add_to_IP_blocklist", parent_action=action) + + return + +def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_1() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["artifact:*.cef.destinationAddress", "!=", ""], + ], + name="filter_1:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Checking to see if this IP address is in the custom list called "ip_address_blocklist" +""" +def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_4() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress", "not in", "custom_list:ip_address_blocklist"], + ], + name="filter_4:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + block_ip_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def on_finish(container, summary): + phantom.debug('on_finish() called') + # This function is called after all actions are completed. + # summary of all the action and/or all details of actions + # can be collected here. + + # summary_json = phantom.get_summary() + # if 'result' in summary_json: + # for action_result in summary_json['result']: + # if 'action_run_id' in action_result: + # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False) + # phantom.debug(action_results) + + return \ No newline at end of file diff --git a/playbooks/block_indicators.yml b/playbooks/block_indicators.yml new file mode 100644 index 0000000000..9caf9a527c --- /dev/null +++ b/playbooks/block_indicators.yml @@ -0,0 +1,23 @@ +name: Block Indicators +id: fc0edc76-ff2b-48b0-5f6f-63da6783fd63 +version: 1 +date: '2021-01-21' +author: Philip Royer, Splunk +type: Response +description: This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists. +playbook: block_indicators +how_to_implement: "This playbook uses the following custom lists: ip_address_blocklist, domain_blocklist, filehash_blocklist. This playbook provides an easy, automated, and straightforward solution to maintaining up-to-date IP address, file, and domain blocklists. The playbook looks for any of the required CEF fields within the container. The CEF value is then cross-referenced with their respective Custom Lists. IP addresses are blocked on a Firewall, while domains are blocked using a blocklist service. The blocking of these two will prevent access to the IOCs. Finally, file hashes are blocked using an endpoint protection service, which will prevent the process from running on affected endpoints within a network. After the IOCs are blocked using various apps, they are added to their respective custom lists as to maintain a running blocklist record." +references: [] +app_list: +- "Palo Alto Networks Firewall" +- "CarbonBlack Response" +- "OpenDNS Umbrella" +tags: + platform_tags: + - Response + playbook_fields: + - destinationDnsDomain + - destinationAddress + - fileHash + product: + - Splunk SOAR \ No newline at end of file diff --git a/playbooks/email_notification_for_malware.json b/playbooks/email_notification_for_malware.json new file mode 100644 index 0000000000..24f8c4685e --- /dev/null +++ b/playbooks/email_notification_for_malware.json @@ -0,0 +1,8672 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Use Cases", + "coa": { + "data": { + "clean": true, + "code_block": "", + "description": "This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal \"file reputation\" and PAN WildFire \"detonate file\" are used to determine if a file is malware, and CarbonBlack Response \"hunt file\" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.", + "hash": "cd4b30ce1b1555275490936455ad489a860c1c98", + "joint": { + "cells": [ + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "b019e440-ef29-4772-bda2-a9386a65fccb", + "router": { + "name": "metro" + }, + "source": { + "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f86960a4-1d0d-4f37-924c-8640149388a8", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 32 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "eaa4fc01-be31-4366-b66d-7aaaa8cd5967", + "router": { + "name": "metro" + }, + "source": { + "id": "12461935-1aee-4aec-878c-0e2fb1742912", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 171 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "74fcb7c5-ea09-4556-90ce-c60cf8681d04", + "router": { + "name": "metro" + }, + "source": { + "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "cff987f2-2566-44d5-a694-26087dc2a0a2", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 767 + }, + { + "0": "S", + "1": "T", + "2": "A", + "3": "R", + "4": "T", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "ref-x": 33, + "ref-y": 8, + "text": "START" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "ref-x": 13, + "xlink:href": "/inc/coa/img/block_icon_start.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'filter_1' block\n filter_1(container=container)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "4f900fb0-068e-4214-8caa-1b065f7f9bfa", + "inPorts": [], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 16, + "line_start": 8, + "name": "", + "notes": "", + "number": 0, + "order": 1, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": -120, + "y": 120 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "START", + "type": "coa.StartEnd", + "warn": false, + "z": 1394 + }, + { + "0": "E", + "1": "N", + "2": "D", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".title": { + "text": "END" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_end.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "send email", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "cff987f2-2566-44d5-a694-26087dc2a0a2", + "inPorts": [ + "in" + ], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 338, + "line_start": 325, + "name": "", + "notes": "", + "number": 0, + "order": 13, + "outPorts": [], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1880, + "y": 120 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "END", + "type": "coa.StartEnd", + "warn": false, + "z": 1571 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "1af67ff6-453c-46aa-87e1-3731e1a659a5", + "router": { + "name": "metro" + }, + "source": { + "id": "4f900fb0-068e-4214-8caa-1b065f7f9bfa", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899", + "port": "in", + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1682 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d4f646d5-8ec0-41ef-8519-cd07b8de14f3", + "router": { + "name": "metro" + }, + "source": { + "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "35f205e2-949e-463e-9057-658f597b1dc9", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1834 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ef8c12b6-f42d-459c-a8b1-b04690b626ee", + "router": { + "name": "metro" + }, + "source": { + "id": "f86960a4-1d0d-4f37-924c-8640149388a8", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1951 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "0b2d5872-1c82-438a-bf42-2ffefc4b4bb1", + "router": { + "name": "metro" + }, + "source": { + "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1954 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ca25cb81-1e40-4c53-a811-3fd0be926cca", + "router": { + "name": "metro" + }, + "source": { + "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", + "port": "out-2", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "34337267-8e89-4ddf-a601-9040234d2744", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1960 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d3d6a860-6f58-4b63-86d5-8c1a7da31e5a", + "router": { + "name": "metro" + }, + "source": { + "id": "34337267-8e89-4ddf-a601-9040234d2744", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1967 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "50e35606-e056-445a-b71e-84a1d6026b43", + "router": { + "name": "metro" + }, + "source": { + "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "12461935-1aee-4aec-878c-0e2fb1742912", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1969 + }, + { + "action": "file reputation", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:initial_artifact_filter:condition_1:artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "VirusTotal", + "app_version": "1.2.37", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_1:condition_1:artifact:*.cef.fileHash" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "virustotal", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "sha256", + "sha1", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.data.*.md5", + "data_type": "string", + "example_values": [ + "494303294715f5ffad7ad3f43b73b00b" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.permalink", + "data_type": "string", + "example_values": [ + "https://www.test.com/file/27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7/analysis/1548112684/" + ] + }, + { + "data_path": "action_result.data.*.positives", + "data_type": "numeric", + "example_values": [ + 64 + ] + }, + { + "contains": [ + "sha1" + ], + "data_path": "action_result.data.*.resource", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "data_path": "action_result.data.*.response_code", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.scan_date", + "data_type": "string", + "example_values": [ + "2019-01-21 23:18:04" + ] + }, + { + "contains": [ + "virustotal scan id" + ], + "data_path": "action_result.data.*.scan_id", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684" + ] + }, + { + "data_path": "action_result.data.*.scans.*.detected", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.scans.*.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.*.update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.ALYac.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ALYac.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ALYac.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.ALYac.version", + "data_type": "string", + "example_values": [ + "1.1.1.5" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.result", + "data_type": "string", + "example_values": [ + "Win32:Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.version", + "data_type": "string", + "example_values": [ + "18.4.3895.0" + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b (v)" + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.update", + "data_type": "string", + "example_values": [ + "20180925" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.AVware.version", + "data_type": "string", + "example_values": [ + "1.6.0.52" + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.result", + "data_type": "string", + "example_values": [ + "suspicious" + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.update", + "data_type": "string", + "example_values": [ + "20190119" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Acronis.version", + "data_type": "string", + "example_values": [ + "1.0.1.37" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.version", + "data_type": "string", + "example_values": [ + "3.0.5.370" + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.AegisLab.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.version", + "data_type": "string", + "example_values": [ + "4.2" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.result", + "data_type": "string", + "example_values": [ + "Win32/Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.version", + "data_type": "string", + "example_values": [ + "3.14.1.22785" + ] + }, + { + "data_path": "action_result.data.*.scans.Alibaba.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Alibaba.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Alibaba.update", + "data_type": "string", + "example_values": [ + "20180921" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Alibaba.version", + "data_type": "string", + "example_values": [ + "0.1.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.result", + "data_type": "string", + "example_values": [ + "Virus/Win32.Parite.c" + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Antiy-AVL.version", + "data_type": "string", + "example_values": [ + "3.0.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.version", + "data_type": "string", + "example_values": [ + "1.0.0.837" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.version", + "data_type": "string", + "example_values": [ + "190121-00" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.result", + "data_type": "string", + "example_values": [ + "Win32:Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.version", + "data_type": "string", + "example_values": [ + "18.4.3895.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.result", + "data_type": "string", + "example_values": [ + "W32/Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Avira.version", + "data_type": "string", + "example_values": [ + "8.3.3.8" + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Babable.update", + "data_type": "string", + "example_values": [ + "20180918" + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.version", + "data_type": "string", + "example_values": [ + "9107201" + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.result", + "data_type": "string", + "example_values": [ + "Win32.Virus.Parite.d" + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Baidu.version", + "data_type": "string", + "example_values": [ + "1.0.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.version", + "data_type": "string", + "example_values": [ + "7.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.result", + "data_type": "string", + "example_values": [ + "W32.Pinfi.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.version", + "data_type": "string", + "example_values": [ + "1.3.0.9899" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.result", + "data_type": "string", + "example_values": [ + "W32.Perite.A" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.version", + "data_type": "string", + "example_values": [ + "14.00" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b!O" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.version", + "data_type": "string", + "example_values": [ + "1.1.0.977" + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.result", + "data_type": "string", + "example_values": [ + "Heuristics.W32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.ClamAV.version", + "data_type": "string", + "example_values": [ + "0.101.1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.result", + "data_type": "string", + "example_values": [ + "Malware@#1b1651nqd7ivb" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.version", + "data_type": "string", + "example_values": [ + "30310" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.result", + "data_type": "string", + "example_values": [ + "malicious_confidence_100% (W)" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.update", + "data_type": "string", + "example_values": [ + "20181023" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.result", + "data_type": "string", + "example_values": [ + "malicious.94715f" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.update", + "data_type": "string", + "example_values": [ + "20190109" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.version", + "data_type": "string", + "example_values": [ + "1.2.27" + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.result", + "data_type": "string", + "example_values": [ + "Unsafe" + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Cylance.version", + "data_type": "string", + "example_values": [ + "2.3.1.101" + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.result", + "data_type": "string", + "example_values": [ + "W32/Virut.E.gen!Eldorado" + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Cyren.version", + "data_type": "string", + "example_values": [ + "6.2.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.result", + "data_type": "string", + "example_values": [ + "Trojan.DownLoader20.25948" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.version", + "data_type": "string", + "example_values": [ + "7.0.34.11020" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.result", + "data_type": "string", + "example_values": [ + "Win32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.version", + "data_type": "string", + "example_values": [ + "18744" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B (B)" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.version", + "data_type": "string", + "example_values": [ + "2018.4.0.1029" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.result", + "data_type": "string", + "example_values": [ + "malicious (high confidence)" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.update", + "data_type": "string", + "example_values": [ + "20181108" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.version", + "data_type": "string", + "example_values": [ + "3.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.result", + "data_type": "string", + "example_values": [ + "W32/Virut.E.gen!Eldorado" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.F-Prot.version", + "data_type": "string", + "example_values": [ + "4.7.1.166" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.version", + "data_type": "string", + "example_values": [ + "11.0.19100.45" + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.result", + "data_type": "string", + "example_values": [ + "W32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Fortinet.version", + "data_type": "string", + "example_values": [ + "5.4.247.0" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.GData.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.version", + "data_type": "string", + "example_values": [ + "A:25.20275B:25.14197" + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Virut" + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Ikarus.version", + "data_type": "string", + "example_values": [ + "0.1.5.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.result", + "data_type": "string", + "example_values": [ + "heuristic" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.update", + "data_type": "string", + "example_values": [ + "20181128" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.version", + "data_type": "string", + "example_values": [ + "6.3.6.26157" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.result", + "data_type": "string", + "example_values": [ + "Win32/Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.version", + "data_type": "string", + "example_values": [ + "16.0.100" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.result", + "data_type": "string", + "example_values": [ + "Virus ( 00001b711 )" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.version", + "data_type": "string", + "example_values": [ + "11.24.29740" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.result", + "data_type": "string", + "example_values": [ + "Virus ( 00001b711 )" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.version", + "data_type": "string", + "example_values": [ + "11.24.29740" + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Kaspersky.version", + "data_type": "string", + "example_values": [ + "15.0.1.13" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b.5756" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.version", + "data_type": "string", + "example_values": [ + "2013.8.14.323" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.result", + "data_type": "string", + "example_values": [ + "malware (ai score=100)" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.version", + "data_type": "string", + "example_values": [ + "2018.9.12.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.result", + "data_type": "string", + "example_values": [ + "Trojan.Agent.QQ" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.version", + "data_type": "string", + "example_values": [ + "2.1.1.1115" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.result", + "data_type": "string", + "example_values": [ + "BehavesLike.Win32.Pate.hh" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.version", + "data_type": "string", + "example_values": [ + "v2017.3010" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.result", + "data_type": "string", + "example_values": [ + "W32/Pate.b" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.version", + "data_type": "string", + "example_values": [ + "6.0.6.653" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.version", + "data_type": "string", + "example_values": [ + "14.0.297.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.result", + "data_type": "string", + "example_values": [ + "Virus:Win32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.version", + "data_type": "string", + "example_values": [ + "1.1.15500.2" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.bgvo" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.version", + "data_type": "string", + "example_values": [ + "1.0.134.24576" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.result", + "data_type": "string", + "example_values": [ + "generic.ml" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.result", + "data_type": "string", + "example_values": [ + "W32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Panda.version", + "data_type": "string", + "example_values": [ + "4.6.4.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.H" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.version", + "data_type": "string", + "example_values": [ + "1.0.0.1120" + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.result", + "data_type": "string", + "example_values": [ + "Virus.Parite!1.9B80 (CLOUD)" + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Rising.version", + "data_type": "string", + "example_values": [ + "25.0.0.24" + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.update", + "data_type": "string", + "example_values": [ + "20190116" + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.version", + "data_type": "string", + "example_values": [ + "5.6.0.1032" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.result", + "data_type": "string", + "example_values": [ + "static engine - malicious" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.version", + "data_type": "string", + "example_values": [ + "1.0.21.268" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.result", + "data_type": "string", + "example_values": [ + "W32/Parite-B" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.version", + "data_type": "string", + "example_values": [ + "4.98.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.result", + "data_type": "string", + "example_values": [ + "Trojan.Gen.6" + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Symantec.version", + "data_type": "string", + "example_values": [ + "1.8.0.0" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.result", + "data_type": "string", + "example_values": [ + "Virus/W32.Parite.C" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.version", + "data_type": "string", + "example_values": [ + "2019-01-21.02" + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Dropper.c" + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Tencent.version", + "data_type": "string", + "example_values": [ + "1.0.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.result", + "data_type": "string", + "example_values": [ + "W32/Pate.B" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.version", + "data_type": "string", + "example_values": [ + "6.8.0.5.3962" + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.result", + "data_type": "string", + "example_values": [ + "Win32/Pinfi.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.TotalDefense.version", + "data_type": "string", + "example_values": [ + "37.1.62.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.result", + "data_type": "string", + "example_values": [ + "malicious.high.ml.score" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.update", + "data_type": "string", + "example_values": [ + "20190103" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.version", + "data_type": "string", + "example_values": [ + "3.0.34.707" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.result", + "data_type": "string", + "example_values": [ + "PE_PARITE.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.version", + "data_type": "string", + "example_values": [ + "10.0.0.1040" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.result", + "data_type": "string", + "example_values": [ + "PE_PARITE.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.version", + "data_type": "string", + "example_values": [ + "10.0.0.1040" + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Trustlook.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.version", + "data_type": "string", + "example_values": [ + "3.35.1" + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b (v)" + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.VIPRE.version", + "data_type": "string", + "example_values": [ + "None" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.A" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.version", + "data_type": "string", + "example_values": [ + "2014.3.20.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Webroot.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.version", + "data_type": "string", + "example_values": [ + "1.0.0.403" + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.update", + "data_type": "string", + "example_values": [ + "20190120" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Yandex.version", + "data_type": "string", + "example_values": [ + "5.5.1.3" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.result", + "data_type": "string", + "example_values": [ + "Virus.Parite.Win32.9" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.version", + "data_type": "string", + "example_values": [ + "2.0.0.3733" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.eGambit.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.version", + "data_type": "string", + "example_values": [ + "v4.3.5" + ] + }, + { + "contains": [ + "hash", + "sha1" + ], + "data_path": "action_result.data.*.sha1", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "contains": [ + "hash", + "sha256" + ], + "data_path": "action_result.data.*.sha256", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7" + ] + }, + { + "data_path": "action_result.data.*.total", + "data_type": "numeric", + "example_values": [ + 72 + ] + }, + { + "data_path": "action_result.data.*.verbose_msg", + "data_type": "string", + "example_values": [ + "Scan finished, information embedded" + ] + }, + { + "data_path": "action_result.summary.positives", + "data_type": "numeric", + "example_values": [ + 64 + ] + }, + { + "data_path": "action_result.summary.total_scans", + "data_type": "numeric", + "example_values": [ + 72 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Positives: 64, Total scans: 72" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_positives", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "VirusTotal", + "product_vendor": "VirusTotal", + "type": "" + } + ], + "attrs": { + ".action": { + "text": "file reputation" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('file_reputation_1() called')\n\n # collect data for 'file_reputation_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_1:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'file_reputation_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'hash': filtered_artifacts_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"file reputation\", parameters=parameters, assets=['virustotal'], callback=filter_2, name=\"file_reputation_1\")\n\n return", + "callback_code": "", + "callback_start": 55, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "f86960a4-1d0d-4f37-924c-8640149388a8", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 40, + "line_start": 19, + "message": "Configuring now", + "name": "file reputation", + "notes": "Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware.", + "number": 1, + "order": 2, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 160, + "y": 100 + }, + "previous_function": "", + "previous_name": "file_reputation_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 1981 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 5 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_5() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"detonate_file_1:action_result.summary.malware\", \"==\", \"yes\"],\n ],\n name=\"filter_5:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "detonate file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 5", + "description": "Only hunt files that are considered malware per the sandbox (malware == yes).", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 110, + "line_start": 92, + "name": "filter", + "notes": "Only hunt files that are considered malware per the sandbox (malware == yes).", + "number": 5, + "order": 5, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "==", + "data_type": "", + "param": "detonate_file_1:action_result.summary.malware", + "value": "yes" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1020, + "y": 240 + }, + "previous_function": "", + "previous_name": "filter_5", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2020 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 3 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash\", \"==\", \"artifact:*.cef.fileHash\"],\n ],\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 3", + "description": "Match hashes with less than 10 positives to artifacts to identify filtered_artifacts.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "34337267-8e89-4ddf-a601-9040234d2744", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 131, + "line_start": 113, + "name": "filter", + "notes": "Match hashes with less than 10 positives to artifacts to identify filtered_artifacts.", + "number": 3, + "order": 6, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "==", + "data_type": "", + "param": "filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash", + "value": "artifact:*.cef.fileHash" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 500, + "y": 240 + }, + "previous_function": "", + "previous_name": "filter_3", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2022 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 2 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + ".outPorts>.port-1": { + "port": { + "id": "out-2", + "type": "out" + }, + "ref-x": 41, + "ref-y": 82 + }, + ".outPorts>.port-1>.port-body": { + "port": { + "id": "out-2", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">=\", 10],\n ],\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n # collect filtered artifact ids for 'if' condition 2\n matched_artifacts_2, matched_results_2 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \"<\", 10],\n ],\n name=\"filter_2:condition_2\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_2 or matched_results_2:\n filter_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 2", + "description": "If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 165, + "line_start": 134, + "name": "filter", + "notes": "If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first.", + "number": 2, + "order": 7, + "outPorts": [ + "out-1", + "out-2" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": ">=", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + }, + { + "conditions": [ + { + "comparison": "<", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 400, + "y": 100 + }, + "previous_function": "", + "previous_name": "filter_2", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2023 + }, + { + "action": "hunt file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_9:condition_1:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "Carbon Black Response", + "app_version": "1.2.80", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7", + "13ded573464ba7f43fe640479b309e09", + "9bf50324444c46997c2492d505b47f2d", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.range", + "data_type": "string", + "example_values": [ + "0-10", + "0-2", + "5-8" + ] + }, + { + "contains": [ + "carbon black query type" + ], + "data_path": "action_result.parameter.type", + "data_type": "string", + "example_values": [ + "process", + "binary" + ] + }, + { + "data_path": "action_result.data.*.binary.elapsed", + "data_type": "numeric", + "example_values": [ + 0.1120398044586182, + 0.04952096939086914, + 0.1234798431396484, + 0.05507302284240723, + 0.05384993553161621 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", + "data_type": "string", + "example_values": [ + "2018-10-01T00:00:00Z", + "2015-01-01T00:00:00Z", + "2013-11-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.name", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "CB-TEST-02", + "WIN7-CLIENT1", + "ACCOUNTING-PC" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "16.7" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "C:\\Windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "50.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", + "data_type": "string", + "example_values": [ + "2018-10-19T00:00:00Z", + "2018-09-29T00:00:00Z", + "2018-10-02T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.highlights.*.ids", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.highlights.*.name", + "data_type": "string", + "example_values": [ + "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", + "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", + "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 510, + 511 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_issuer", + "data_type": "string", + "example_values": [ + "Microsoft Code Signing PCA" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Corp." + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-10-14T20:23:00Z", + "2015-01-30T19:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_subject", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.endpoint", + "data_type": "string", + "example_values": [ + "CB-TEST-02|27", + "WIN7-CLIENT1|15", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.event_partition_id", + "data_type": "numeric", + "example_values": [ + 100972684312576, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.facet_id", + "data_type": "numeric", + "example_values": [ + 883737, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_desc", + "data_type": "string", + "example_values": [ + "Microsoft Office Click-to-Run (SxS)", + "Microsoft Network Realtime Inspection Service", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.host_count", + "data_type": "numeric", + "example_values": [ + 1, + 6 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.internal_name", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.last_seen", + "data_type": "string", + "example_values": [ + "2018-10-28T10:06:02.456Z", + "2018-10-28T10:06:42.455Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.md5", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.original_filename", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "column_name": "Signed", + "column_order": 1, + "data_path": "action_result.data.*.binary.results.*.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-07-01T02:20:02.062Z", + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.binary.start", + "data_type": "numeric", + "example_values": [ + 0, + 5 + ] + }, + { + "data_path": "action_result.data.*.binary.terms", + "data_type": "string", + "example_values": [ + "md5:13ded573464ba7f43fe640479b309e09", + "md5:9bf50324444c46997c2492d505b47f2d", + "md5:5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.total_results", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.process.all_segments", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.comprehensive_search", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.elapsed", + "data_type": "numeric", + "example_values": [ + 0.2200779914855957 + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.value", + "data_type": "numeric", + "example_values": [ + 1566 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 10128 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.name", + "data_type": "string", + "example_values": [ + "domain_controller" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.value", + "data_type": "numeric", + "example_values": [ + 10123 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "dc2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "51.2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 5185 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", + "data_type": "numeric", + "example_values": [ + 411 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.parent_name.*.name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.facets.path_full.*.name", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.facets.process_md5.*.name", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.process_name.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.name", + "data_type": "string", + "example_values": [ + "2018-02-24T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.value", + "data_type": "numeric", + "example_values": [ + 324 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.name", + "data_type": "string", + "example_values": [ + "LOCAL SERVICE" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.4" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.value", + "data_type": "numeric", + "example_values": [ + 9966 + ] + }, + { + "data_path": "action_result.data.*.process.incomplete_results", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.childproc_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.process.results.*.cmdline", + "data_type": "string", + "example_values": [ + "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.comms_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.crossproc_count", + "data_type": "numeric", + "example_values": [ + 2 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_config", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filemod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.group", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.host_type", + "data_type": "string", + "example_values": [ + "workstation" + ] + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.process.results.*.hostname", + "data_type": "string", + "example_values": [ + "win7-client1" + ] + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.process.results.*.id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.interface_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_server_update", + "data_type": "string", + "example_values": [ + "2018-03-22T09:21:32.332Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_update", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.82Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.modload_count", + "data_type": "numeric", + "example_values": [ + 43 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.netconn_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.os_type", + "data_type": "string", + "example_values": [ + "windows" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_md5", + "data_type": "string", + "example_values": [ + "000000000000000000000000000000" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.results.*.parent_name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_pid", + "data_type": "numeric", + "example_values": [ + 600 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.path", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.process_md5", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "process name", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.process_name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.process.results.*.process_pid", + "data_type": "numeric", + "example_values": [ + 1672 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.processblock_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.regmod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.segment_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.process.results.*.sensor_id", + "data_type": "numeric", + "example_values": [ + 15 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.start", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.758Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.terminated", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243-000000000001" + ] + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.process.results.*.username", + "data_type": "string", + "example_values": [ + "SYSTEM" + ] + }, + { + "data_path": "action_result.data.*.process.start", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.terms", + "data_type": "string", + "example_values": [ + "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.total_results", + "data_type": "numeric", + "example_values": [ + 32404 + ] + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "numeric", + "example_values": [ + 32404, + 1 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Displaying 10 'process' results of total 32404", + "Displaying 1 'binary' results of total 1", + "Displaying 0 'binary' results of total 1" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "Carbon Black", + "product_vendor": "Bit9", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt file 1" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_1' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_1' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name=\"hunt_file_1\")\n\n return", + "callback_code": "", + "callback_start": 193, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Hunt for binaries with the malicious fileHash across endpoints.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 112, + "line_end": 193, + "line_start": 168, + "message": "Configuring now", + "name": "hunt file", + "notes": "Hunt for binaries with the malicious fileHash across endpoints.", + "number": 1, + "order": 8, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 780, + "y": 100 + }, + "previous_function": "", + "previous_name": "hunt_file_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2024 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 1 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.fileHash\", \"!=\", \"\"],\n ],\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n file_reputation_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 1", + "description": "Only process artifacts that have a CEF fileHash.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 37, + "line_end": 213, + "line_start": 196, + "name": "filter", + "notes": "Only process artifacts that have a CEF fileHash.", + "number": 1, + "order": 9, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "artifact:*.cef.fileHash", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 20, + "y": 100 + }, + "previous_function": "", + "previous_name": "filter_1", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2025 + }, + { + "action": "detonate file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "file_name": "", + "force_analysis": "", + "private": "", + "vault_id": "filtered-data:filter_11:condition_1:artifact:*.cef.vaultId", + "vm": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "WildFire", + "app_version": "1.0.24", + "appid": "", + "config_type": "asset", + "fields": { + "file_name": "", + "vault_id": "filtered-data:filter_4:condition_1:artifact:*.cef.vaultId" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "wildfire", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.parameter.file_name", + "data_type": "string" + }, + { + "contains": [ + "pe file", + "pdf", + "flash", + "apk", + "jar", + "doc", + "xls", + "ppt" + ], + "data_path": "action_result.parameter.vault_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_info.filetype", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_info.malware", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.file_info.md5", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.file_info.sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.file_info.sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.file_info.size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@behavior_id", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@md5", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@behavior_id", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@md5", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@deleted_file", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@process_image", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@written_file", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.malware", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.md5", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@query", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@response", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@country", + "data_type": "string" + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@ip", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@port", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@country", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@ip", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@port", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@host", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@method", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@uri", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.network.url.*.@user_agent", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.platform", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@command", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@name", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@md5", + "data_type": "string" + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@name", + "data_type": "string" + }, + { + "contains": [ + "sha1", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.mutex.createmutex.*.@name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@key", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@subkey", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@data", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@key", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@subkey", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@name", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@pid", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@text", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@reg_key", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@reg_key", + "data_type": "string" + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@pid", + "data_type": "string" + }, + { + "contains": [ + "process name" + ], + "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@process_image", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@reg_key", + "data_type": "string" + }, + { + "contains": [ + "sha256", + "hash" + ], + "data_path": "action_result.data.*.task_info.report.*.sha256", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.size", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.software", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@details", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@score", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.task", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.#text", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.@seq", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.task_info.report.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.summary.malware", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "WildFire", + "product_vendor": "Palo Alto Networks", + "type": "sandbox" + } + ], + "attrs": { + ".action": { + "text": "detonate file" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('detonate_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'detonate_file_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.vaultId', 'filtered-data:filter_4:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'detonate_file_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'vault_id': filtered_artifacts_item_1[0],\n 'file_name': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"detonate file\", parameters=parameters, assets=['wildfire'], callback=filter_5, name=\"detonate_file_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Detonate the file(s) in the vault.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "12461935-1aee-4aec-878c-0e2fb1742912", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 135, + "line_end": 240, + "line_start": 216, + "message": "Configuring now", + "name": "detonate file", + "notes": "Detonate the file(s) in the vault.", + "number": 1, + "order": 10, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 780, + "y": 240 + }, + "previous_function": "", + "previous_name": "detonate_file_1", + "required_params": { + "vault_id": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2026 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "13fce689-6a47-484b-a70a-aa77e2e79cb1", + "router": { + "name": "metro" + }, + "source": { + "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f989d5e9-9586-408e-b424-8a3a5384936a", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 2037 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "eeca94e9-2c8b-4474-ad9f-39da792e28a3", + "router": { + "name": "metro" + }, + "source": { + "id": "35f205e2-949e-463e-9057-658f597b1dc9", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f989d5e9-9586-408e-b424-8a3a5384936a", + "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 2040 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 4 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_4() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"filtered-data:filter_3:condition_1:artifact:*.cef.vaultId\", \"!=\", \"\"],\n ],\n name=\"filter_4:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n detonate_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "filter 4", + "description": "Detonate file requires a Vault file, so only proceed if vaultId is not null.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 89, + "line_start": 71, + "name": "filter", + "notes": "Detonate file requires a Vault file, so only proceed if vaultId is not null.", + "number": 4, + "order": 4, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": "!=", + "data_type": "", + "param": "filtered-data:filter_3:condition_1:artifact:*.cef.vaultId", + "value": "" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 640, + "y": 240 + }, + "previous_function": "", + "previous_name": "filter_4", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2059 + }, + { + "action": "hunt file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", + "range": "", + "type": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", + "range": "", + "type": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7", + "13ded573464ba7f43fe640479b309e09", + "9bf50324444c46997c2492d505b47f2d", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.range", + "data_type": "string", + "example_values": [ + "0-10", + "0-2", + "5-8" + ] + }, + { + "contains": [ + "carbon black query type" + ], + "data_path": "action_result.parameter.type", + "data_type": "string", + "example_values": [ + "process", + "binary" + ] + }, + { + "data_path": "action_result.data.*.binary.elapsed", + "data_type": "numeric", + "example_values": [ + 0.1120398044586182, + 0.04952096939086914, + 0.1234798431396484, + 0.05507302284240723, + 0.05384993553161621 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", + "data_type": "string", + "example_values": [ + "2018-10-01T00:00:00Z", + "2015-01-01T00:00:00Z", + "2013-11-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.name", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "CB-TEST-02", + "WIN7-CLIENT1", + "ACCOUNTING-PC" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "16.7" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "C:\\Windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "50.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", + "data_type": "string", + "example_values": [ + "2018-10-19T00:00:00Z", + "2018-09-29T00:00:00Z", + "2018-10-02T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.highlights.*.ids", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.highlights.*.name", + "data_type": "string", + "example_values": [ + "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", + "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", + "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 510, + 511 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_issuer", + "data_type": "string", + "example_values": [ + "Microsoft Code Signing PCA" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Corp." + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-10-14T20:23:00Z", + "2015-01-30T19:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_subject", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.endpoint", + "data_type": "string", + "example_values": [ + "CB-TEST-02|27", + "WIN7-CLIENT1|15", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.event_partition_id", + "data_type": "numeric", + "example_values": [ + 100972684312576, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.facet_id", + "data_type": "numeric", + "example_values": [ + 883737, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_desc", + "data_type": "string", + "example_values": [ + "Microsoft Office Click-to-Run (SxS)", + "Microsoft Network Realtime Inspection Service", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.host_count", + "data_type": "numeric", + "example_values": [ + 1, + 6 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.internal_name", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.last_seen", + "data_type": "string", + "example_values": [ + "2018-10-28T10:06:02.456Z", + "2018-10-28T10:06:42.455Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.md5", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.original_filename", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "column_name": "Signed", + "column_order": 1, + "data_path": "action_result.data.*.binary.results.*.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-07-01T02:20:02.062Z", + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.binary.start", + "data_type": "numeric", + "example_values": [ + 0, + 5 + ] + }, + { + "data_path": "action_result.data.*.binary.terms", + "data_type": "string", + "example_values": [ + "md5:13ded573464ba7f43fe640479b309e09", + "md5:9bf50324444c46997c2492d505b47f2d", + "md5:5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.total_results", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.process.all_segments", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.comprehensive_search", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.elapsed", + "data_type": "numeric", + "example_values": [ + 0.2200779914855957 + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.value", + "data_type": "numeric", + "example_values": [ + 1566 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 10128 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.name", + "data_type": "string", + "example_values": [ + "domain_controller" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.value", + "data_type": "numeric", + "example_values": [ + 10123 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "dc2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "51.2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 5185 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", + "data_type": "numeric", + "example_values": [ + 411 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.parent_name.*.name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.facets.path_full.*.name", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.facets.process_md5.*.name", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.process_name.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.name", + "data_type": "string", + "example_values": [ + "2018-02-24T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.value", + "data_type": "numeric", + "example_values": [ + 324 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.name", + "data_type": "string", + "example_values": [ + "LOCAL SERVICE" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.4" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.value", + "data_type": "numeric", + "example_values": [ + 9966 + ] + }, + { + "data_path": "action_result.data.*.process.incomplete_results", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.childproc_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.process.results.*.cmdline", + "data_type": "string", + "example_values": [ + "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.comms_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.crossproc_count", + "data_type": "numeric", + "example_values": [ + 2 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_config", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filemod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.group", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.host_type", + "data_type": "string", + "example_values": [ + "workstation" + ] + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.process.results.*.hostname", + "data_type": "string", + "example_values": [ + "win7-client1" + ] + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.process.results.*.id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.interface_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_server_update", + "data_type": "string", + "example_values": [ + "2018-03-22T09:21:32.332Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_update", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.82Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.modload_count", + "data_type": "numeric", + "example_values": [ + 43 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.netconn_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.os_type", + "data_type": "string", + "example_values": [ + "windows" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_md5", + "data_type": "string", + "example_values": [ + "000000000000000000000000000000" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.results.*.parent_name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_pid", + "data_type": "numeric", + "example_values": [ + 600 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.path", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.process_md5", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "process name", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.process_name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.process.results.*.process_pid", + "data_type": "numeric", + "example_values": [ + 1672 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.processblock_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.regmod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.segment_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.process.results.*.sensor_id", + "data_type": "numeric", + "example_values": [ + 15 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.start", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.758Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.terminated", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243-000000000001" + ] + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.process.results.*.username", + "data_type": "string", + "example_values": [ + "SYSTEM" + ] + }, + { + "data_path": "action_result.data.*.process.start", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.terms", + "data_type": "string", + "example_values": [ + "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.total_results", + "data_type": "numeric", + "example_values": [ + 32404 + ] + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "numeric", + "example_values": [ + 32404, + 1 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Displaying 10 'process' results of total 32404", + "Displaying 1 'binary' results of total 1", + "Displaying 0 'binary' results of total 1" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt file 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_2' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5\", \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_2' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name=\"hunt_file_2\")\n\n return", + "callback_code": "", + "callback_start": 68, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "detonate file", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Hunt for binaries with the malicious fileHash across endpoints.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "35f205e2-949e-463e-9057-658f597b1dc9", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 215, + "line_end": 68, + "line_start": 43, + "message": "Configuring now", + "name": "hunt file", + "notes": "Hunt for binaries with the malicious fileHash across endpoints.", + "number": 2, + "order": 3, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1160, + "y": 240 + }, + "previous_function": "", + "previous_name": "hunt_file_2", + "required_params": { + "hash": true + }, + "reviewer": "", + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2065 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".format": { + "text": "format_for_emailer" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "opacity": 0, + "text": "Configuring now" + }, + ".outPorts>.port-out-1": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out-1>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + ".title": { + "text": "format" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + } + }, + "block_code": "def format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_for_emailer() called')\n \n template = \"\"\"Malware in a security event has been confirmed using file reputation and/or file detonation services.\n\nReputation Results:\nUsing file reputation services, the following file hashes have been identified as malware:\n{0}\n\nEDR tool detects that the above file hashes are present on the following endpoints: \n{1}\n\nDetonation Results:\nUsing sandboxing services, the following file hashes have been identified as malware:\n{2}\n\nThe Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows:\n{3}\n\nEDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: \n{4}\n\nContainer id: {5}\n\n[EOM]\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"hunt_file_1:action_result.parameter.hash\",\n \"hunt_file_1:action_result.data.*.process.results.*.hostname\",\n \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5\",\n \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id\",\n \"hunt_file_2:action_result.data.*.process.results.*.hostname\",\n \"container:id\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_for_emailer\")\n\n send_email_1(container=container)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "hunt file 1, hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "format_for_emailer", + "description": "Format all results for an email.", + "format": "format", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "f989d5e9-9586-408e-b424-8a3a5384936a", + "inPorts": [ + "in" + ], + "join_code": "def join_format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('join_format_for_emailer() called')\n\n # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n if phantom.completed(action_names=['hunt_file_1', 'hunt_file_2']):\n \n # call connected block \"format_for_emailer\"\n format_for_emailer(container=container, handle=handle)\n \n return", + "join_optional": [], + "join_start": 314, + "line_end": 325, + "line_start": 272, + "message": "Configuring now", + "name": "format", + "notes": "Format all results for an email.", + "number": 2, + "order": 12, + "outPorts": [ + "out-1" + ], + "parameters": [ + { + "position": 0, + "type": "", + "value": "hunt_file_1:action_result.parameter.hash" + }, + { + "position": 1, + "type": "", + "value": "hunt_file_1:action_result.data.*.process.results.*.hostname" + }, + { + "position": 2, + "type": "", + "value": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5" + }, + { + "position": 3, + "type": "", + "value": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id" + }, + { + "position": 4, + "type": "", + "value": "hunt_file_2:action_result.data.*.process.results.*.hostname" + }, + { + "position": 5, + "type": "", + "value": "container:id" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1400, + "y": 100 + }, + "previous_function": "", + "previous_name": "format_for_emailer", + "show_number": true, + "size": { + "height": 100, + "width": 180 + }, + "state": "format", + "status": "", + "template": "Malware in a security event has been confirmed using file reputation and/or file detonation services.\n\nReputation Results:\nUsing file reputation services, the following file hashes have been identified as malware:\n{0}\n\nEDR tool detects that the above file hashes are present on the following endpoints: \n{1}\n\nDetonation Results:\nUsing sandboxing services, the following file hashes have been identified as malware:\n{2}\n\nThe Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows:\n{3}\n\nEDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: \n{4}\n\n\nContainer id: {5}\n\n[EOM]", + "title": "format", + "type": "coa.Format", + "warn": false, + "z": 2067 + }, + { + "attrs": { + ".connection": { + "stroke": "#818D99", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#818D99", + "stroke": "#818D99" + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "24b9331c-ecbd-454d-bdbd-926babd67934", + "router": { + "name": "metro" + }, + "source": { + "id": "f989d5e9-9586-408e-b424-8a3a5384936a", + "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb", + "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 2068 + }, + { + "action": "send email", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "attachments": "", + "bcc": "", + "body": "format_for_emailer:formatted_data", + "cc": "", + "from": "automation@phantom.localhost", + "headers": "", + "subject": "Malware event confirmed", + "to": "recipient@phantom.localhost" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "SMTP", + "app_version": "1.2.29", + "appid": "", + "config_type": "asset", + "fields": { + "attachments": "", + "bcc": "", + "body": "format_for_emailer:formatted_data", + "cc": "", + "from": "automation@phantom.localhost", + "headers": "", + "subject": "Malware event confirmed", + "to": "recipient@phantom.localhost" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "smtp", + "output": [ + { + "column_name": "Status", + "column_order": 0, + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "contains": [ + "vault id" + ], + "data_path": "action_result.parameter.attachments", + "data_type": "string", + "example_values": [ + "ab2b2ccfba08ea538ef22f521caa01c3c2b17ccf" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.parameter.bcc", + "data_type": "string", + "example_values": [ + "test1@testdomain.com" + ] + }, + { + "data_path": "action_result.parameter.body", + "data_type": "string", + "example_values": [ + "Test body" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.parameter.cc", + "data_type": "string", + "example_values": [ + "test2@testdomain.com" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.parameter.from", + "data_type": "string", + "example_values": [ + "sender@testdomain.com" + ] + }, + { + "data_path": "action_result.parameter.headers", + "data_type": "string", + "example_values": [ + "{\"Subject\": \"Test1\", \"To\": \"test3@testdomain.com\"}" + ] + }, + { + "data_path": "action_result.parameter.subject", + "data_type": "string", + "example_values": [ + "Test" + ] + }, + { + "contains": [ + "email" + ], + "data_path": "action_result.parameter.to", + "data_type": "string", + "example_values": [ + "receiver@testdomain.com" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Email sent" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "SMTP", + "product_vendor": "Generic", + "type": "email" + } + ], + "attrs": { + ".action": { + "text": "send email" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Generic" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def send_email_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('send_email_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'send_email_1' call\n formatted_data_1 = phantom.get_format_data(name='format_for_emailer')\n\n parameters = []\n \n # build parameters list for 'send_email_1' call\n parameters.append({\n 'cc': \"\",\n 'to': \"recipient@phantom.localhost\",\n 'bcc': \"\",\n 'body': formatted_data_1,\n 'from': \"automation@phantom.localhost\",\n 'headers': \"\",\n 'subject': \"Malware event confirmed\",\n 'attachments': \"\",\n })\n\n phantom.act(action=\"send email\", parameters=parameters, assets=['smtp'], name=\"send_email_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": true, + "connection_name": "hunt file 1, hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": 0, + "description": "Send the formatted string as an email.", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 269, + "line_start": 243, + "message": "Configuring now", + "name": "send email", + "notes": "Send the formatted string as an email.", + "number": 1, + "order": 11, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1640, + "y": 100 + }, + "previous_function": "", + "previous_name": "send_email_1", + "required_params": { + "body": true, + "to": true + }, + "reviewer": "", + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Generic", + "type": "coa.Action", + "warn": "", + "z": 2069 + } + ] + }, + "notes": "The playbook uses the following Apps: \n - Virus Total (file reputation) [asset name = virustotal]\n - Palo Alto Networks Wildfire (detonate file) [asset name = wildfire]\n - Carbon Black (hunt file) [asset name = carbonblack]\n - SMTP (send email) [asset name = smtp]\n\nBe sure to update asset naming to reflect the asset names configured in your environment." + }, + "python_version": "3", + "schema": 4, + "version": "4.10.0.40961" + }, + "create_time": "2021-01-19T21:50:52.204902+00:00", + "draft_mode": false, + "labels": [ + "*" + ], + "tags": [] +} \ No newline at end of file diff --git a/playbooks/email_notification_for_malware.png b/playbooks/email_notification_for_malware.png new file mode 100644 index 0000000000..bc5bb024d6 Binary files /dev/null and b/playbooks/email_notification_for_malware.png differ diff --git a/playbooks/email_notification_for_malware.py b/playbooks/email_notification_for_malware.py new file mode 100644 index 0000000000..020befaecf --- /dev/null +++ b/playbooks/email_notification_for_malware.py @@ -0,0 +1,338 @@ +""" +This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team. +""" + +import phantom.rules as phantom +import json +from datetime import datetime, timedelta +def on_start(container): + phantom.debug('on_start() called') + + # call 'filter_1' block + filter_1(container=container) + + return + +""" +Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware. +""" +def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('file_reputation_1() called') + + # collect data for 'file_reputation_1' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_1:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'file_reputation_1' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'hash': filtered_artifacts_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="file reputation", parameters=parameters, assets=['virustotal'], callback=filter_2, name="file_reputation_1") + + return + +""" +Hunt for binaries with the malicious fileHash across endpoints. +""" +def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('hunt_file_2() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'hunt_file_2' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", "filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'hunt_file_2' call + for filtered_results_item_1 in filtered_results_data_1: + if filtered_results_item_1[0]: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'type': "", + 'range': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name="hunt_file_2") + + return + +""" +Detonate file requires a Vault file, so only proceed if vaultId is not null. +""" +def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_4() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["filtered-data:filter_3:condition_1:artifact:*.cef.vaultId", "!=", ""], + ], + name="filter_4:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + detonate_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Only hunt files that are considered malware per the sandbox (malware == yes). +""" +def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_5() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["detonate_file_1:action_result.summary.malware", "==", "yes"], + ], + name="filter_5:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Match hashes with less than 10 positives to artifacts to identify filtered_artifacts. +""" +def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_3() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash", "==", "artifact:*.cef.fileHash"], + ], + name="filter_3:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first. +""" +def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_2() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">=", 10], + ], + name="filter_2:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + # collect filtered artifact ids for 'if' condition 2 + matched_artifacts_2, matched_results_2 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", "<", 10], + ], + name="filter_2:condition_2") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_2 or matched_results_2: + filter_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2) + + return + +""" +Hunt for binaries with the malicious fileHash across endpoints. +""" +def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('hunt_file_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'hunt_file_1' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'hunt_file_1' call + for filtered_results_item_1 in filtered_results_data_1: + if filtered_results_item_1[0]: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'type': "", + 'range': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name="hunt_file_1") + + return + +""" +Only process artifacts that have a CEF fileHash. +""" +def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_1() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["artifact:*.cef.fileHash", "!=", ""], + ], + name="filter_1:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + file_reputation_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +""" +Detonate the file(s) in the vault. +""" +def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('detonate_file_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'detonate_file_1' call + filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.vaultId', 'filtered-data:filter_4:condition_1:artifact:*.id']) + + parameters = [] + + # build parameters list for 'detonate_file_1' call + for filtered_artifacts_item_1 in filtered_artifacts_data_1: + if filtered_artifacts_item_1[0]: + parameters.append({ + 'vault_id': filtered_artifacts_item_1[0], + 'file_name': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_artifacts_item_1[1]}, + }) + + phantom.act(action="detonate file", parameters=parameters, assets=['wildfire'], callback=filter_5, name="detonate_file_1") + + return + +""" +Send the formatted string as an email. +""" +def send_email_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('send_email_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'send_email_1' call + formatted_data_1 = phantom.get_format_data(name='format_for_emailer') + + parameters = [] + + # build parameters list for 'send_email_1' call + parameters.append({ + 'cc': "", + 'to': "recipient@phantom.localhost", + 'bcc': "", + 'body': formatted_data_1, + 'from': "automation@phantom.localhost", + 'headers': "", + 'subject': "Malware event confirmed", + 'attachments': "", + }) + + phantom.act(action="send email", parameters=parameters, assets=['smtp'], name="send_email_1") + + return + +""" +Format all results for an email. +""" +def format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('format_for_emailer() called') + + template = """Malware in a security event has been confirmed using file reputation and/or file detonation services. + +Reputation Results: +Using file reputation services, the following file hashes have been identified as malware: +{0} + +EDR tool detects that the above file hashes are present on the following endpoints: +{1} + +Detonation Results: +Using sandboxing services, the following file hashes have been identified as malware: +{2} + +The Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows: +{3} + +EDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: +{4} + +Container id: {5} + +[EOM]""" + + # parameter list for template variable replacement + parameters = [ + "hunt_file_1:action_result.parameter.hash", + "hunt_file_1:action_result.data.*.process.results.*.hostname", + "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", + "filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id", + "hunt_file_2:action_result.data.*.process.results.*.hostname", + "container:id", + ] + + phantom.format(container=container, template=template, parameters=parameters, name="format_for_emailer") + + send_email_1(container=container) + + return + +def join_format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None): + phantom.debug('join_format_for_emailer() called') + + # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed + if phantom.completed(action_names=['hunt_file_1', 'hunt_file_2']): + + # call connected block "format_for_emailer" + format_for_emailer(container=container, handle=handle) + + return + +def on_finish(container, summary): + phantom.debug('on_finish() called') + # This function is called after all actions are completed. + # summary of all the action and/or all details of actions + # can be collected here. + + # summary_json = phantom.get_summary() + # if 'result' in summary_json: + # for action_result in summary_json['result']: + # if 'action_run_id' in action_result: + # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False) + # phantom.debug(action_results) + + return \ No newline at end of file diff --git a/playbooks/email_notification_for_malware.yml b/playbooks/email_notification_for_malware.yml new file mode 100644 index 0000000000..a6c5b70531 --- /dev/null +++ b/playbooks/email_notification_for_malware.yml @@ -0,0 +1,23 @@ +name: Email Notification for Malware +id: fb3edc76-ff2b-48b0-5f6f-63da6483fd63 +version: 1 +date: '2021-01-19' +author: Philip Royer, Splunk +type: Response +description: This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team. +playbook: email_notification_for_malware +how_to_implement: "Be sure to update asset naming to reflect the asset names configured in your environment." +references: [] +app_list: +- "VirusTotal" +- "WildFire" +- "CarbonBlack Response" +- "SMTP" +tags: + platform_tags: + - Response + playbook_fields: + - fileHash + - vaultId + product: + - Splunk SOAR \ No newline at end of file diff --git a/playbooks/malware_hunt_and_contain.json b/playbooks/malware_hunt_and_contain.json new file mode 100644 index 0000000000..ab2ede583c --- /dev/null +++ b/playbooks/malware_hunt_and_contain.json @@ -0,0 +1,11686 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Use Cases", + "coa": { + "data": { + "clean": true, + "code_block": "\"\"\"Malicous file detected on endpoint\"\"\"", + "description": "This playbook investigates and remediates malware infections on the endpoint.", + "hash": "d1af271dc2c9e67bf0393c4503368436c574f31a", + "joint": { + "cells": [ + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "5ad21936-f8c5-45e3-ab48-4aa74d2185b3", + "router": { + "name": "metro" + }, + "source": { + "id": "4c86e34b-13d5-4884-b1d2-53d1f3448f91", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 14 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "c168d4c9-945d-4742-a662-6e4abbc945da", + "router": { + "name": "metro" + }, + "source": { + "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 651 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "3949529c-aff6-4401-90d8-a70c288b74d5", + "router": { + "name": "metro" + }, + "source": { + "id": "b9591115-e22e-48e0-952d-47c76448f051", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "0444efd4-6363-4dea-acca-b0c02ce9f973", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1290 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "9b55f239-b39d-4fe3-adda-f6168661b33a", + "router": { + "name": "metro" + }, + "source": { + "id": "72f13962-4d43-44be-9710-d2ed60cbbf00", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "0444efd4-6363-4dea-acca-b0c02ce9f973", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1558 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "9c84c8ba-08f4-4cec-acfd-c4dbccbbc66e", + "router": { + "name": "metro" + }, + "source": { + "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1694 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "b415fd2a-3939-4c18-a92e-efa93d32b1c6", + "router": { + "name": "metro" + }, + "source": { + "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "port": "in", + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1706 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "961848a5-5fd4-4e3b-8b7b-6ef40ea4d007", + "router": { + "name": "metro" + }, + "source": { + "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "port": "in", + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1710 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "1649dbd5-f0bf-43ec-951b-5ad008365d1d", + "router": { + "name": "metro" + }, + "source": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "b9591115-e22e-48e0-952d-47c76448f051", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1718 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "0db3fd7f-4779-44c3-8ea3-694bad0388d9", + "router": { + "name": "metro" + }, + "source": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1886 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "88f69577-f71a-4ee0-8386-9ab6bcd33e28", + "router": { + "name": "metro" + }, + "source": { + "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1892 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "48627df2-9bc5-40fa-858e-426631c72ab9", + "router": { + "name": "metro" + }, + "source": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "91866693-2720-43a1-a437-f65f19382b9a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1903 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "fbce023e-da26-4df2-829b-99d0a167cdd0", + "router": { + "name": "metro" + }, + "source": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "port": "out-2", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 1968 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "509e0e96-ee20-4dd7-8a04-e5a9b8f1db85", + "router": { + "name": "metro" + }, + "source": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1982 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "f5d00299-537c-4bf8-b86b-a500fa1c2258", + "router": { + "name": "metro" + }, + "source": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1988 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "ee268141-044c-48e5-b1ad-29803892a264", + "router": { + "name": "metro" + }, + "source": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 1992 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "0a60f02d-fb84-4d21-af04-0adc070f3ccf", + "router": { + "name": "metro" + }, + "source": { + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "port": "out-2", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "e6a1a311-5337-4d44-b8d3-58d8a6cf8be1", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 2050 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "562f6e73-5fb8-4722-b99b-7b2b91109a37", + "router": { + "name": "metro" + }, + "source": { + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 2324 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "14967b49-8e3a-4a08-8c66-53f7e7b5b4b2", + "router": { + "name": "metro" + }, + "source": { + "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "port": "in", + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 2339 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "d580f77a-9877-4c13-9a40-308797deca8d", + "router": { + "name": "metro" + }, + "source": { + "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88", + "selector": ".port-body[type=\"input\"]" + }, + "type": "link", + "z": 2544 + }, + { + "attrs": { + ".connection": { + "stroke": "#6C7A89", + "stroke-width": 2 + }, + ".marker-target": { + "d": "M 10 0 L 0 5 L 10 10 z", + "fill": "#6a6c8a", + "stroke": "#6a6c8a" + }, + ".tool-remove": { + "position": 0.5 + } + }, + "connector": { + "args": { + "radius": 5 + }, + "name": "rounded" + }, + "endDirections": [ + "left" + ], + "id": "c2f5849d-4fa9-4a35-93df-7570b63d2304", + "router": { + "name": "metro" + }, + "source": { + "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88", + "port": "out-1", + "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" + }, + "startDirections": [ + "right" + ], + "target": { + "id": "72f13962-4d43-44be-9710-d2ed60cbbf00", + "port": null, + "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" + }, + "type": "link", + "z": 2557 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 3 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 5],\n [\"file_reputation_1:action_result.summary.positives\", \"<=\", 10],\n ],\n logical_operator='and',\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n create_ticket_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": false, + "connection_name": "block hash 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "hasElse": false, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 44, + "line_start": 24, + "name": "filter", + "notes": "", + "number": 3, + "order": 2, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": ">", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "5" + }, + { + "comparison": "<=", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1080, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "filter_3", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2590 + }, + { + "action": "shutdown system", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname", + "message": "", + "wait_time": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname", + "message": "", + "ph": "", + "wait_time": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "domainctrl1", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.wait_time", + "data_type": "numeric" + }, + { + "data_path": "action_result.parameter.message", + "data_type": "string" + }, + { + "column_name": "Machine Ip Name", + "column_order": 0, + "contains": [ + "ip", + "host name" + ], + "data_path": "action_result.parameter.ip_hostname", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string" + }, + { + "column_name": "Total Objects", + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "column_name": "Total Objects Successful", + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "shutdown system" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def shutdown_system_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('shutdown_system_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'shutdown_system_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'shutdown_system_1' call\n for results_item_1 in results_data_1:\n parameters.append({\n 'ph': \"\",\n 'message': \"\",\n 'wait_time': \"\",\n 'ip_hostname': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"shutdown system\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"shutdown_system_1\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 69, + "line_start": 44, + "message": "Configuring now", + "name": "shutdown system", + "notes": "", + "number": 1, + "order": 3, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 760 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "shutdown_system_1", + "required_params": {}, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2794 + }, + { + "action": "create ticket", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "description": "", + "fields": "", + "short_description": "Virus Detected" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "description": "", + "fields": "", + "short_description": "Virus Detected", + "table": "", + "vault_id": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "servicenow", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.short_description", + "data_type": "string" + }, + { + "contains": [ + "servicenow table" + ], + "data_path": "action_result.parameter.table", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.fields", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.description", + "data_type": "string" + }, + { + "contains": [ + "servicenow ticket id" + ], + "data_path": "action_result.summary.created_ticket_id", + "data_type": "string" + }, + { + "contains": [ + "vault id" + ], + "data_path": "action_result.parameter.vault_id", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_updated_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_updated_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.escalation", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.watch_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.follow_up", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.made_sla", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.delivery_task", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sla_due", + "data_type": "string" + }, + { + "column_name": "Number", + "column_order": 0, + "data_path": "action_result.data.*.number", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.caller_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.correlation_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_mod_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.notify", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.resolved_by", + "data_type": "string" + }, + { + "column_name": "Closed On", + "column_order": 6, + "data_path": "action_result.data.*.closed_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_tags", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.cmdb_ci", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.subcategory", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.category", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.close_notes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.expected_start", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.knowledge", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.opened_by.link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.opened_by.value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.impact", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.calendar_stc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.caused_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.comments", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.problem_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.activity_due", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.state", + "data_type": "string" + }, + { + "column_name": "ID", + "column_order": 4, + "contains": [ + "servicenow ticket id" + ], + "data_path": "action_result.data.*.sys_id", + "data_type": "string" + }, + { + "column_name": "Opened On", + "column_order": 5, + "data_path": "action_result.data.*.opened_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.child_incidents", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_notes", + "data_type": "string" + }, + { + "column_name": "Short Description", + "column_order": 0, + "data_path": "action_result.data.*.short_description", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.comments_and_work_notes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.time_worked", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_created_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.upon_reject", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.reassignment_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_stc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.due_date", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_class_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.delivery_plan", + "data_type": "string" + }, + { + "column_name": "Description", + "column_order": 1, + "data_path": "action_result.data.*.description", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.parent", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_duration", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.rfc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.company", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.assigned_to", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval_history", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.user_input", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_start", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain.link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain.value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.resolved_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.calendar_duration", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.group_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.active", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.parent_incident", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain_path", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.closed_by", + "data_type": "string" + }, + { + "column_name": "Severity", + "column_order": 2, + "data_path": "action_result.data.*.severity", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.upon_approval", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.incident_state", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.reopen_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.contact_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_end", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_notes_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_created_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.location", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.correlation_display", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.close_code", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.assignment_group", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval_set", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.order", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.urgency", + "data_type": "string" + }, + { + "column_name": "Priority", + "column_order": 2, + "data_path": "action_result.data.*.priority", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.hold_reason", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_service", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_tags", + "data_type": "string" + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.attachment_details.*.file_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.compressed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.size_bytes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.table_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.image_width", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.content_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.image_height", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.table_sys_id", + "data_type": "string" + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.attachment_details.*.download_link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_mod_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_created_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_created_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_updated_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_updated_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.size_compressed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.average_image_color", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.additional_assignee_list", + "data_type": "string" + }, + { + "data_path": "action_result.summary.attachment_id", + "data_type": "string" + }, + { + "data_path": "action_result.summary.attachment_added", + "data_type": "boolean" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "ticketing" + } + ], + "attrs": { + ".action": { + "text": "create ticket 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Utilities" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "# read-only block view not available", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": false, + "connection_name": "logoff user, shutdown system, disable user, block hash 3", + "connection_type": "action", + "custom_callback": "", + "custom_code": "def create_ticket_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'create_ticket_2' call\n\n disabled_users = set(phantom.collect2(datapath='disable_user_1:action_result.parameter.username'))\n blocked_hashes = set(phantom.collect2(datapath='block_hash_3:action_result.parameter.hash'))\n loggedoff_users = set(phantom.collect2(datapath='logoff_user_1:action_result.parameter.username'))\n shutdown_systems = set(phantom.collect2(datapath='shutdown_system_1:action_result.parameter.ip_hostname'))\n file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash', \n 'file_reputation_1:filtered-action_result.summary.positives'])\n detected_users = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.username'))\n detected_systems = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.hostname'))\n \n title = \"Virus Detected on {0} devices\".format(len(detected_systems))\n \n description = \"Hashes sumbitted with detections:\\n{0}\\n\\n\".format(\", \".join([\"{0} ({1})\".format(*fr) for fr in file_reputation]))\n description += \"File was found on {0} devices:\\n{1}\\n\\n\".format(len(detected_systems), ', '.join(detected_systems))\n description += \"This impacts at least {0} users:\\n{1}\\n\\n\".format(len(detected_users), ', '.join(detected_users))\n if len(blocked_hashes):\n description += \"{0} hashes were submitted for blocking:\\n{1}\\n\\n\".format(len(blocked_hashes), \", \".join(blocked_hashes))\n if len(loggedoff_users):\n description += \"{0} users were forced to logoff:\\n{1}\\n\\n\".format(len(loggedoff_users), \", \".join(loggedoff_users))\n if len(disabled_users):\n description += \"{0} user accounts were disabled:\\n{1}\\n\\n\".format(len(disabled_users), \", \".join(disabled_users))\n if len(shutdown_systems):\n description += \"{0} systems were shutdown:\\n{1}\\n\\n\".format(len(shutdown_systems), \", \".join(shutdown_systems))\n\n parameters = []\n \n # build parameters list for 'create_ticket_2' call\n parameters.append({\n 'short_description': title,\n 'description': description,\n 'fields': \"\",\n })\n\n if parameters:\n phantom.act(\"create ticket\", parameters=parameters, assets=['servicenow'], name=\"create_ticket_2\", parent_action=action) \n else:\n phantom.error(\"'create_ticket_2' will not be executed due to lack of parameters\")\n \n return", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": true, + "has_custom_block": true, + "has_custom_callback": false, + "has_custom_join": false, + "id": "b9591115-e22e-48e0-952d-47c76448f051", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 114, + "line_start": 69, + "message": "Configuring now", + "name": "create ticket", + "notes": "", + "number": 2, + "order": 4, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1220, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "create_ticket_2", + "required_params": {}, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Utilities", + "type": "coa.Action", + "warn": false, + "z": 2825 + }, + { + "action": "logoff user", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname", + "username": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname", + "username": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "domainctrl1", + "output": [ + { + "column_name": "Username", + "column_order": 0, + "contains": [ + "user name" + ], + "data_path": "action_result.parameter.username", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "contains": [ + "ip", + "host name" + ], + "data_path": "action_result.parameter.ip_hostname", + "data_type": "string" + }, + { + "column_name": "Total Objects", + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "column_name": "Total Objects Successful", + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "logoff user" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def logoff_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('logoff_user_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'logoff_user_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'logoff_user_1' call\n for results_item_1 in results_data_1:\n parameters.append({\n 'username': \"\",\n 'ip_hostname': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"logoff user\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"logoff_user_1\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 166, + "line_start": 143, + "message": "Configuring now", + "name": "logoff user", + "notes": "", + "number": 1, + "order": 6, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 620 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "logoff_user_1", + "required_params": {}, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2827 + }, + { + "0": "S", + "1": "T", + "2": "A", + "3": "R", + "4": "T", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "ref-x": 33, + "ref-y": 8, + "text": "START" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "ref-x": 13, + "xlink:href": "/inc/coa/img/block_icon_start.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'file_reputation_1' block\n file_reputation_1(container=container)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "4c86e34b-13d5-4884-b1d2-53d1f3448f91", + "inPorts": [], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 24, + "line_start": 16, + "name": "", + "notes": "", + "number": 0, + "order": 1, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 80, + "y": 100 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "START", + "type": "coa.StartEnd", + "warn": false, + "z": 2895 + }, + { + "0": "E", + "1": "N", + "2": "D", + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".title": { + "text": "END" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_end.svg" + }, + "g.notes": { + "display": "block" + } + }, + "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return", + "callback_code": "# read-only block view not available", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "create ticket 2, create ticket 3", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "0444efd4-6363-4dea-acca-b0c02ce9f973", + "inPorts": [ + "in" + ], + "join_code": "# read-only block view not available", + "join_optional": [], + "join_start": 1, + "line_end": 456, + "line_start": 443, + "name": "", + "notes": "", + "number": 0, + "order": 17, + "outPorts": [], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1460, + "y": 100 + }, + "previous_function": "", + "previous_name": "", + "show_number": true, + "size": { + "height": 54, + "width": 80 + }, + "status": "", + "title": "END", + "type": "coa.StartEnd", + "warn": false, + "z": 2901 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 1 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + ".outPorts>.port-1": { + "port": { + "id": "out-2", + "type": "out" + }, + "ref-x": 41, + "ref-y": 82 + }, + ".outPorts>.port-1>.port-body": { + "port": { + "id": "out-2", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 5],\n [\"file_reputation_1:action_result.summary.positives\", \"<=\", 10],\n ],\n logical_operator='and',\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n get_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n # collect filtered artifact ids for 'if' condition 2\n matched_artifacts_2, matched_results_2 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 10],\n ],\n name=\"filter_1:condition_2\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_2 or matched_results_2:\n hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n get_file_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "hasElse": false, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "8c9518d8-506f-4750-9e8e-2094bd14d431", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 201, + "line_start": 166, + "name": "filter", + "notes": "", + "number": 1, + "order": 7, + "outPorts": [ + "out-1", + "out-2" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": ">", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "5" + }, + { + "comparison": "<=", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + }, + { + "conditions": [ + { + "comparison": ">", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 460, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "filter_1", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2941 + }, + { + "action": "hunt file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7", + "13ded573464ba7f43fe640479b309e09", + "9bf50324444c46997c2492d505b47f2d", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.range", + "data_type": "string", + "example_values": [ + "0-10", + "0-2", + "5-8" + ] + }, + { + "contains": [ + "carbon black query type" + ], + "data_path": "action_result.parameter.type", + "data_type": "string", + "example_values": [ + "process", + "binary" + ] + }, + { + "data_path": "action_result.data.*.binary.elapsed", + "data_type": "numeric", + "example_values": [ + 0.1120398044586182, + 0.04952096939086914, + 0.1234798431396484, + 0.05507302284240723, + 0.05384993553161621 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", + "data_type": "string", + "example_values": [ + "2018-10-01T00:00:00Z", + "2015-01-01T00:00:00Z", + "2013-11-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.name", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "CB-TEST-02", + "WIN7-CLIENT1", + "ACCOUNTING-PC" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "16.7" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "C:\\Windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "50.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", + "data_type": "string", + "example_values": [ + "2018-10-19T00:00:00Z", + "2018-09-29T00:00:00Z", + "2018-10-02T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.highlights.*.ids", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.highlights.*.name", + "data_type": "string", + "example_values": [ + "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", + "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", + "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 510, + 511 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_issuer", + "data_type": "string", + "example_values": [ + "Microsoft Code Signing PCA" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Corp." + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-10-14T20:23:00Z", + "2015-01-30T19:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_subject", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.endpoint", + "data_type": "string", + "example_values": [ + "CB-TEST-02|27", + "WIN7-CLIENT1|15", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.event_partition_id", + "data_type": "numeric", + "example_values": [ + 100972684312576, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.facet_id", + "data_type": "numeric", + "example_values": [ + 883737, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_desc", + "data_type": "string", + "example_values": [ + "Microsoft Office Click-to-Run (SxS)", + "Microsoft Network Realtime Inspection Service", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.host_count", + "data_type": "numeric", + "example_values": [ + 1, + 6 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.internal_name", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.last_seen", + "data_type": "string", + "example_values": [ + "2018-10-28T10:06:02.456Z", + "2018-10-28T10:06:42.455Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.md5", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.original_filename", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "column_name": "Signed", + "column_order": 1, + "data_path": "action_result.data.*.binary.results.*.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-07-01T02:20:02.062Z", + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.binary.start", + "data_type": "numeric", + "example_values": [ + 0, + 5 + ] + }, + { + "data_path": "action_result.data.*.binary.terms", + "data_type": "string", + "example_values": [ + "md5:13ded573464ba7f43fe640479b309e09", + "md5:9bf50324444c46997c2492d505b47f2d", + "md5:5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.total_results", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.process.all_segments", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.comprehensive_search", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.elapsed", + "data_type": "numeric", + "example_values": [ + 0.2200779914855957 + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.value", + "data_type": "numeric", + "example_values": [ + 1566 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 10128 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.name", + "data_type": "string", + "example_values": [ + "domain_controller" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.value", + "data_type": "numeric", + "example_values": [ + 10123 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "dc2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "51.2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 5185 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", + "data_type": "numeric", + "example_values": [ + 411 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.parent_name.*.name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.facets.path_full.*.name", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.facets.process_md5.*.name", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.process_name.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.name", + "data_type": "string", + "example_values": [ + "2018-02-24T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.value", + "data_type": "numeric", + "example_values": [ + 324 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.name", + "data_type": "string", + "example_values": [ + "LOCAL SERVICE" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.4" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.value", + "data_type": "numeric", + "example_values": [ + 9966 + ] + }, + { + "data_path": "action_result.data.*.process.incomplete_results", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.childproc_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.process.results.*.cmdline", + "data_type": "string", + "example_values": [ + "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.comms_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.crossproc_count", + "data_type": "numeric", + "example_values": [ + 2 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_config", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filemod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.group", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.host_type", + "data_type": "string", + "example_values": [ + "workstation" + ] + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.process.results.*.hostname", + "data_type": "string", + "example_values": [ + "win7-client1" + ] + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.process.results.*.id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.interface_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_server_update", + "data_type": "string", + "example_values": [ + "2018-03-22T09:21:32.332Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_update", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.82Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.modload_count", + "data_type": "numeric", + "example_values": [ + 43 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.netconn_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.os_type", + "data_type": "string", + "example_values": [ + "windows" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_md5", + "data_type": "string", + "example_values": [ + "000000000000000000000000000000" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.results.*.parent_name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_pid", + "data_type": "numeric", + "example_values": [ + 600 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.path", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.process_md5", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "process name", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.process_name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.process.results.*.process_pid", + "data_type": "numeric", + "example_values": [ + 1672 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.processblock_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.regmod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.segment_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.process.results.*.sensor_id", + "data_type": "numeric", + "example_values": [ + 15 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.start", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.758Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.terminated", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243-000000000001" + ] + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.process.results.*.username", + "data_type": "string", + "example_values": [ + "SYSTEM" + ] + }, + { + "data_path": "action_result.data.*.process.start", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.terms", + "data_type": "string", + "example_values": [ + "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.total_results", + "data_type": "numeric", + "example_values": [ + 32404 + ] + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "numeric", + "example_values": [ + 32404, + 1 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Displaying 10 'process' results of total 32404", + "Displaying 1 'binary' results of total 1", + "Displaying 0 'binary' results of total 1" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt file 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_2' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_2' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=hunt_file_2_callback, name=\"hunt_file_2\")\n\n return", + "callback_code": "def hunt_file_2_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('hunt_file_2_callback() called')\n \n disable_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n logoff_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n shutdown_system_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n block_hash_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n return", + "callback_start": 226, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 236, + "line_start": 201, + "message": "Configuring now", + "name": "hunt file", + "notes": "", + "number": 2, + "order": 8, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "hunt_file_2", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2944 + }, + { + "action": "get file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "file_source": "", + "get_count": "", + "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", + "offset": "", + "ph_0": "", + "sensor_id": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.parameter.file_source", + "data_type": "string", + "example_values": [ + "C:\\\\Windows\\\\CarbonBlack\\\\Sensor.LOG" + ] + }, + { + "data_path": "action_result.parameter.get_count", + "data_type": "numeric", + "example_values": [ + 1024 + ] + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "75E683BC8284D99F998500162BE4CFE2", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.offset", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.parameter.sensor_id", + "data_type": "numeric", + "example_values": [ + 27 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.file_details.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.file_details.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.file_details.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.file_details.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 511 + ] + }, + { + "data_path": "action_result.data.*.file_details.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.file_details.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 489984, + 16896 + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-02-12T10:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.endpoint", + "data_type": "string", + "example_values": [ + "WIN10-TEST-EP|28", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.file_details.event_partition_id", + "data_type": "numeric", + "example_values": [ + 99742385111040, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.file_details.facet_id", + "data_type": "numeric", + "example_values": [ + 241095, + 0 + ] + }, + { + "data_path": "action_result.data.*.file_details.file_desc", + "data_type": "string", + "example_values": [ + "WMI Provider Host", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.file_details.file_version", + "data_type": "string", + "example_values": [ + "10.0.16299.248 (WinBuild.160101.0800)", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.file_details.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.file_details.host_count", + "data_type": "numeric", + "example_values": [ + 2, + 6 + ] + }, + { + "data_path": "action_result.data.*.file_details.icon", + "data_type": "string", + "example_values": [ + "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAzoSURBVGhD1ZhXcFzlFccNPJBg8pIJY554JOGB\nzCQPhMwkDN3JJA6BkECSwYCFe5MtyepdWvW60kpa9dVKK61WWvXed9Ulq3fLEjZ2jCxjGxtcsPnn\nnKO98qp47GGIRM7M8S2r3fv/ne+U73oL/s9t0wASExPF8/JybXfub/n5+cu+2jYcwGDQy5GFT05O\nijNIUFCQ3F/PjEYjLFbr5gOw+OioCNsVRDQDDA8PIzs7+74QDDA5OYGUlBTbnXu2YQDzc58iMyMN\nJ/v7lyFYMPvs7CyuXr0KlWrperUxwJkzn6772YYB5BvyMDo6ugKAjUUNDg4KAIMwREKC2vbpkjHA\npUuX4OzsbLtzzzYMoKDAgPPnz+Py5cvQapOXISIjwmGxtAmAAuHu7iafKcYAvb292L17t+3OPdtw\ngIWFBQxRxBUIq9WyLP7ixYtYXFxERMS9FWIzmUw/DACO7vz8vAiPCA9DS3OTiFacxd+5c+eHCxAa\nGirCLW2tuHLl8grxvDIsfmZmZk2xbirA8PC4RDw8LFSE24tW/ObNm7h+/bqIt1K/D/D3t317yTYF\nQBHOvlr4lStXJNos7MaNGyJcEc+rtLqINwXA08MNNTU16wrv7OzEgQMHsGPHDhHNXllZKe7p4bFG\n6KalEEPwlGXxinAnJycRvtSBrEhKSloWHxgYSPkfYPv2PdvUGmChDHH69Oll4d3d3SJKWYXCwkLE\nxsauK55tUwHYWLRWq10jnO/zBk2lUt1XPNumA7A5OjoKhCKcU+dhxLP9zwG2bNmCRx55RI6PPvqo\nOJ+z25sCoezt+Vyj0dg+vb99JwD/qAQExycjOC4ZIWototN0SMjKQ7LeiKjUbMRn5cK8/Q1sfeyx\nJYAntmLbM8/gp9u24RfPPYdtTz+Nx+gzBYbtHad8vPaxdoXzvQfZQwOw6KDYJBEckZyBdGMJylu7\nYBmeQGP/CMrbupBf3YjMonKosw1IzMnHj378Y7z02pt470MH7Nx7CI8//ji2bt2KZwjml88/j58/\n+yyefPJJWaEdR/QIyj8pHmhYOh5LbLE9/f72UABRKVkIS0xDqsGM0uYOtI1Mo2N8FtaxU2gbnUbr\n0CRahiZQ1zuIuEw9zi0skrCf4Pevvg5dSRUyiysQk54DVXwKfCPi4BkSBbegcDgcOoafPfUUtj7x\nBN4+bhDRTbOXxRWA9dLN3h4IkKQzQEMRbSFxI/Pn0TP9KdonTsMyegqtI1MkfBLNg+M2HxMAh8NO\n+NULLyKt0CxQJS3tKG6ywFjXgtyKWqSbyqDRFyI6VUdA8bIq77oYRXiWZQ4uKVa8+lHK97MC5uoG\n9A2P4Zs7d3H7m7u4fuMmLl65hrnPFzE6fw49UwQzMonGgVHU9w2jtmcQZW2dKKhpQmF9C8otXTA3\nW2BqaKF7jcitrIOurFpWJa2wDNkl1fj1b36Lf3oUo2HmC0SYh8UVAJ/wWPFQjVZErbYHAmSbqzBw\n6iwmP1vA/MIXWLh6DV9+dQNf37pNfkuAFuneGUqb8fmz6J2cgWVoDFXtPQJQ1NRG4lsp+s0wMACt\nQHZpFTKoVrQFZqQWlmL7W3/HTr9SWM9eQ5hpSFwBCIxOQmCMBgHRict1GKZJI6BUeIerHwKgtIby\nnaI8Nkt+Cu2U+91Tcxg8fRZTZy/g7MVLWPzyGq59TVA3b8nx4uWrmDt/AYPTs2jpG6Bib4fRTrxE\n31SKlPxiqHXU76kxfBxUjp4LXyG44KS4AuAXmQjfMDV8wuIREJkA79BYHDzhiz3HPXDI3f/BADll\ntZL3HRNzsJJ4hmilIm4enoJ1YpaKeEpSyEreO3EKI7PzmDl7HmcuLODcxUUp6Llz/8Hw9ClY+gZR\nQemURymUZjRLtwrTpEOVkAqHkCoMLt6Ef24v/PU9dgAc9WS4+Idhn5MXdh0+AYejblL0XDNFveeg\nbZjBLlUl/uVpxu/eTxDxbAKgzs5HfKYBGaYKKkQuxpXOLZS9gbymewDVnX3itV19aOg5idb+IXRS\nSvWNTaJ/fAo9I+Noo1WpplUprKpHJqVQEhX0J6HVGLlyG97ZXeIKgBdFfL+LNz465IxPHN2wx8kT\n++iaAez9lQ+TxdcAcOG1UHfhPq+jgovNyBV3OeYozucM0Do8KR2HxVdYu1Ha2kmA3Hko92k+5FXW\nw0AFXEBNwVTbRN4IE50b6X4etVpegbGr38AjvUNcARDhx9yx19mLhPvggKsfDrr546hnkAh3Trbg\nffciOX/hnSgRrpgA6DmFpubRNX0aXVOz4iy6yGyCnl4FuQDjMvKoyJJowGXRADMiy1wpQ40BuJAN\nVQ3UeWrofgVSaQCq6W8Sc02Iy8qX78am67EruAJT1+/AVWsVVwD2UtrsP+FDov1w2D0AR72C4ewX\nAiefYBGd3jwLx4QWgbCPPpsAZBVVossu/9upoBmA7dT8nAC0j01RYVPBUqpUWLugL6+VtPMMiZUu\nEp6USdsL2moYimi7UQB1Rs6yhySkIZj8o8ByTH91F05JbeIKwCGK9mGPQDh6q6QOjnsHyW6gpNm6\nBuClf2tWDD05yzCVy9RtG52RCWyhIwNkZWoRGkRR2e2ABur/PAPqe4fQeHKYUm6UpvQkurkL0XlZ\nW4dM5CitbkX6uQVHIig+VZzb6OyNb9cAOHqx8HA4+6rgoYqilW2Q2cHfWQ3A37Gf3PJvWkEp7Xem\naMrSxB2YQNPAuIiobKwXZ4Cqjl7xktYOFDdaYapvRT4NsjxKHU6hUrpf09UvMJxq9ukXQh3I0SsI\nH/iWYP424JbaLq4AuAaGS7ok55noty006Q0IScygzpWxBuCNT9KXAcQZQGsoRguJru/nSTtCk3aI\n+nglkpPU4i5+4Sim/ZG5pYMGVhuMtZTzlP/6ijrq+dU0sCqgpbxPyitCAuU+A7Ap6VdHnaqThh+3\nwDN3sKILHVU3EyClC3WslIISRKToEKnNkaNzYMoagD/sy8LLb/usBOAWV987TN1lAJXt/ZTjfSiz\n9CylAonPJaFFFPUC2ucYqprouh46Gn6ZVMhptOdJyTdDk0vidQVUtAYBsE8/3gt5RySIgPPfAr45\nPeIMcDiuUYqfRUenU/ej6LPHZBjwt31qAeChxwDsfP3KexErAdTUKVh4aWs3RbmLOksHCW6HiUTz\nkhrrWilVOOL1MrV5ddIKeZtwL+rcbWJIQGRqjgDYpx8XuhdN2X+4FmKBAEILB8UZYH9UPUU7WwSr\ndYV2bsRfjuol+nxk8fbXKwBiqMWVNHdSLrPYNhTUtlKKNNtEc3usRRYVVTp1q1RjGXWaEom4OqdQ\nhHPkWHg4CQnVZAqAkn4fH3SBe0gc3FWxshu9RABxFePiDLAnvEYinpBjorZbJL+r+J8O5ohgPjKA\n/fUKgEh6cCEJ11c0Iqeco0yCzTWU21W0ESun3Cwl0WZ5QAKJjs8ukIcqwsNYOLVRVUI6AuO18I+l\n1KB+zuK9w+LgpoqBa1CUvH19TgAp9dPiDMDDLVFvopUsRhLVIj8nyeac70l103JkAPtrFs8m/3Kf\nDiMBUWm5snT8Y/xDktci2JYitMzRaXoSrado6+g7WQjRZEiPD4xLFeF+FH3viER40S7SPZTEBy+J\ndwmIxFuOufjsLqBrnxNnAJ4NGkpD5ZlcT+x8zh0ntmxUjgxgf62YAPhGqmXy8dbVJ0JND4+HD+0Q\nA+K0BJeBsGQdIqjIwpI50iSaWlwwRTtIbRMeQ29hJNwnSkPfTYAn5bs75b1rcDRO2MQ7U59fD4Bb\n60qAEhtAsXyuMg7IkQHsrxVbWodVplLzPjwenrTJcldFUxTJKQ04qr6RGhKcLHB+inC6x13Gkz73\n4KhTvov4QBYfASc/mq6+ofJOfPoW1VzZmDgL4ZccDW05lgCWnBtDMkHw1OV2y0cGsL9WbF2A1ca7\nxRMB4TTqg0WQM527kLNIN4o0pwoL52J1JVCJeiBHfUn8MZ9QOPqopPg48vxewM4A3JkSKU01VAdL\nxWui7lYqw4z3PfzqyUcGsL9W7KEAVpvDERcqUn8cdPWV/QtH97hfqIjlVHFil6iz+BD5myO0Qfvj\n/mzEli9Fn4/sXNgJVHfcivkdWkuR9wyNxl/f34kX340R4esdFftOAKvtw/3H6AXEVV5GeB9/hLbB\nvKNkd5RjEN0LxPa9mSJaWQE+57rg95FEEh+VqsO+4+54efsO+V3eOrPg9Y6KfS8Aq83h6Ans3OdI\nK3WCoDxlm8yvhm/uyRDhh+j6AG2f+fzPh/QCwO/CB1w8bb+wZJsGsNoY5oO9R/Hm7iWA3fTycoDe\nefmc02q/syd27j1i++t7tj+yTsTazwG+5u2HYhsCoBgD8H9msXB2Pue0up+98V4IXt9FO1kSrzhf\n833FNhSAH8ydx97txaxnCoTiq/9+QwG+fwP+CyGRvQpx7eyKAAAAAElFTkSuQmCC\n", + "iVBORw0KGgoAAAANSUhEUgAAACUAAAAlCAYAAADFniADAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlz\nAAAewgAAHsIBbtB1PgAAAjJJREFUWEftWEFrGkEYVQIqGtFTjrmF/IEYWLzEgOQQiBCIEPaiEATb\n9CA0eKiFlgqlBw9CI9Yl1kjjIhYPNSgpSkuN4kXPXgr+k9f5Ju7SYoNDaY2UGXh833z7vuHxdnbZ\nHYtFDkEH0un0zbIgEoncMNmXFiYIlUoFtVoNiUSCI5VK8Ui1YrHI83g8jmw2a9aoTjA4lFMfxXK5\n/EudOAaPYjKZRKFQ4DUDmqaBiQIT9Z2L6nQ6SKe72N1N4uAgg729FyaoRtjffw1V/cDrNKd4ePgW\nx8fvcXT0zqzRNZqfnn7jHOqLRutm38nJNedSjTgGzs6qs6K2t78wlc8ZOtNIOeHNNGo/5VR7yvCK\n4Wp6nXKjh9a469vYyEJRPmJt7RG83ifw+z9hc/MZVlYeY2vrGjs7X7G+fgGf7+V9omgxUZCI+dzz\n81v0+33EYjEEg0Get1otuFwulEolPldVlYny/Q1R8wWR6EymjXa7zW5XFIFAgOf1eh1OpxP5fJ7P\nw+HwYkWtrvrZbfPC4XDAZrPx3OPxwGq1wu1287ndbv+9KF2/hab9C1yxdbW5oCd75unTdX1uo8ji\nf8JpNBr81TAjKpfLoVqtotvtLhy9Xu9+UcPhEA8xJpOJFCVkvHRKyCZGkk5Jp0QdEOXJPSWdEnVA\nlCf3lHRK1AFRntxT/6dTzWYTg8EA4/F44RiNRrPf6MZJCZ2WPBTob8r8xQqFQlgWKIpydxTExucl\nw6Xged9iaT8A6ipWINQO9M4AAAAASUVORK5CYII=\n" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.file_details.internal_name", + "data_type": "string", + "example_values": [ + "Wmiprvse.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.file_details.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.file_details.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.file_details.last_seen", + "data_type": "string", + "example_values": [ + "2018-03-25T06:49:27.776Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "column_name": "MD5", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.file_details.md5", + "data_type": "string", + "example_values": [ + "75E683BC8284D99F998500162BE4CFE2", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.file_details.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\windows\\system32\\wbem\\wmiprvse.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.file_details.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 489984, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.file_details.original_filename", + "data_type": "string", + "example_values": [ + "Wmiprvse.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.file_details.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.file_details.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Windows Operating System" + ] + }, + { + "data_path": "action_result.data.*.file_details.product_version", + "data_type": "string", + "example_values": [ + "10.0.16299.248", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.file_details.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-02-15T01:48:13.517Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.file_details.timestamp", + "data_type": "string", + "example_values": [ + "2018-02-15T01:48:13.517Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.file_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file name", + "file path" + ], + "data_path": "action_result.data.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe", + "C:\\Windows\\CarbonBlack\\Sensor.LOG", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.session_id", + "data_type": "numeric", + "example_values": [ + 101 + ] + }, + { + "column_name": "Vault ID", + "column_order": 1, + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.data.*.vault_id", + "data_type": "string", + "example_values": [ + "08f57fd06bbd8063d5b828521654225952a8155e", + "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.cb_url", + "data_type": "string", + "example_values": [ + "https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2", + "https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.summary.file_type", + "data_type": "string", + "example_values": [ + "pe file" + ] + }, + { + "contains": [ + "file name", + "file path" + ], + "data_path": "action_result.summary.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe", + "C:\\Windows\\CarbonBlack\\Sensor.LOG", + "ping.exe" + ] + }, + { + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.summary.vault_id", + "data_type": "string", + "example_values": [ + "08f57fd06bbd8063d5b828521654225952a8155e", + "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "File type: pe file\nVault id: 08f57fd06bbd8063d5b828521654225952a8155e\nName: wmiprvse.exe\nCb url: https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2", + "Vault id: cefbc5c62d7e1f90d250ddcd35bc388a7b01f4d4, Name: C:\\Windows\\CarbonBlack\\Sensor.LOG", + "File type: pe file, Vault id: 41c4e1e9abe08b218f5ea60d8ae41a5f523e7534, Name: ping.exe, Cb url: https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "get file 3" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def get_file_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('get_file_3() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'get_file_3' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'get_file_3' call\n for filtered_results_item_1 in filtered_results_data_1:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'ph_0': \"\",\n 'offset': \"\",\n 'get_count': \"\",\n 'sensor_id': \"\",\n 'file_source': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"get file\", parameters=parameters, assets=['carbonblack'], name=\"get_file_3\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "e6a1a311-5337-4d44-b8d3-58d8a6cf8be1", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 263, + "line_start": 236, + "message": "Configuring now", + "name": "get file", + "notes": "", + "number": 3, + "order": 9, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 900 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "get_file_3", + "required_params": {}, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2945 + }, + { + "action": "get file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "file_source": "", + "get_count": "", + "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", + "offset": "", + "ph_0": "", + "sensor_id": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.parameter.file_source", + "data_type": "string", + "example_values": [ + "C:\\\\Windows\\\\CarbonBlack\\\\Sensor.LOG" + ] + }, + { + "data_path": "action_result.parameter.get_count", + "data_type": "numeric", + "example_values": [ + 1024 + ] + }, + { + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "75E683BC8284D99F998500162BE4CFE2", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.offset", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.parameter.sensor_id", + "data_type": "numeric", + "example_values": [ + 27 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.file_details.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.file_details.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.file_details.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.file_details.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 511 + ] + }, + { + "data_path": "action_result.data.*.file_details.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.file_details.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 489984, + 16896 + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.file_details.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-02-12T10:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.endpoint", + "data_type": "string", + "example_values": [ + "WIN10-TEST-EP|28", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.file_details.event_partition_id", + "data_type": "numeric", + "example_values": [ + 99742385111040, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.file_details.facet_id", + "data_type": "numeric", + "example_values": [ + 241095, + 0 + ] + }, + { + "data_path": "action_result.data.*.file_details.file_desc", + "data_type": "string", + "example_values": [ + "WMI Provider Host", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.file_details.file_version", + "data_type": "string", + "example_values": [ + "10.0.16299.248 (WinBuild.160101.0800)", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.file_details.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.file_details.host_count", + "data_type": "numeric", + "example_values": [ + 2, + 6 + ] + }, + { + "data_path": "action_result.data.*.file_details.icon", + "data_type": "string", + "example_values": [ + "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAzoSURBVGhD1ZhXcFzlFccNPJBg8pIJY554JOGB\nzCQPhMwkDN3JJA6BkECSwYCFe5MtyepdWvW60kpa9dVKK61WWvXed9Ulq3fLEjZ2jCxjGxtcsPnn\nnKO98qp47GGIRM7M8S2r3fv/ne+U73oL/s9t0wASExPF8/JybXfub/n5+cu+2jYcwGDQy5GFT05O\nijNIUFCQ3F/PjEYjLFbr5gOw+OioCNsVRDQDDA8PIzs7+74QDDA5OYGUlBTbnXu2YQDzc58iMyMN\nJ/v7lyFYMPvs7CyuXr0KlWrperUxwJkzn6772YYB5BvyMDo6ugKAjUUNDg4KAIMwREKC2vbpkjHA\npUuX4OzsbLtzzzYMoKDAgPPnz+Py5cvQapOXISIjwmGxtAmAAuHu7iafKcYAvb292L17t+3OPdtw\ngIWFBQxRxBUIq9WyLP7ixYtYXFxERMS9FWIzmUw/DACO7vz8vAiPCA9DS3OTiFacxd+5c+eHCxAa\nGirCLW2tuHLl8grxvDIsfmZmZk2xbirA8PC4RDw8LFSE24tW/ObNm7h+/bqIt1K/D/D3t317yTYF\nQBHOvlr4lStXJNos7MaNGyJcEc+rtLqINwXA08MNNTU16wrv7OzEgQMHsGPHDhHNXllZKe7p4bFG\n6KalEEPwlGXxinAnJycRvtSBrEhKSloWHxgYSPkfYPv2PdvUGmChDHH69Oll4d3d3SJKWYXCwkLE\nxsauK55tUwHYWLRWq10jnO/zBk2lUt1XPNumA7A5OjoKhCKcU+dhxLP9zwG2bNmCRx55RI6PPvqo\nOJ+z25sCoezt+Vyj0dg+vb99JwD/qAQExycjOC4ZIWototN0SMjKQ7LeiKjUbMRn5cK8/Q1sfeyx\nJYAntmLbM8/gp9u24RfPPYdtTz+Nx+gzBYbtHad8vPaxdoXzvQfZQwOw6KDYJBEckZyBdGMJylu7\nYBmeQGP/CMrbupBf3YjMonKosw1IzMnHj378Y7z02pt470MH7Nx7CI8//ji2bt2KZwjml88/j58/\n+yyefPJJWaEdR/QIyj8pHmhYOh5LbLE9/f72UABRKVkIS0xDqsGM0uYOtI1Mo2N8FtaxU2gbnUbr\n0CRahiZQ1zuIuEw9zi0skrCf4Pevvg5dSRUyiysQk54DVXwKfCPi4BkSBbegcDgcOoafPfUUtj7x\nBN4+bhDRTbOXxRWA9dLN3h4IkKQzQEMRbSFxI/Pn0TP9KdonTsMyegqtI1MkfBLNg+M2HxMAh8NO\n+NULLyKt0CxQJS3tKG6ywFjXgtyKWqSbyqDRFyI6VUdA8bIq77oYRXiWZQ4uKVa8+lHK97MC5uoG\n9A2P4Zs7d3H7m7u4fuMmLl65hrnPFzE6fw49UwQzMonGgVHU9w2jtmcQZW2dKKhpQmF9C8otXTA3\nW2BqaKF7jcitrIOurFpWJa2wDNkl1fj1b36Lf3oUo2HmC0SYh8UVAJ/wWPFQjVZErbYHAmSbqzBw\n6iwmP1vA/MIXWLh6DV9+dQNf37pNfkuAFuneGUqb8fmz6J2cgWVoDFXtPQJQ1NRG4lsp+s0wMACt\nQHZpFTKoVrQFZqQWlmL7W3/HTr9SWM9eQ5hpSFwBCIxOQmCMBgHRict1GKZJI6BUeIerHwKgtIby\nnaI8Nkt+Cu2U+91Tcxg8fRZTZy/g7MVLWPzyGq59TVA3b8nx4uWrmDt/AYPTs2jpG6Bib4fRTrxE\n31SKlPxiqHXU76kxfBxUjp4LXyG44KS4AuAXmQjfMDV8wuIREJkA79BYHDzhiz3HPXDI3f/BADll\ntZL3HRNzsJJ4hmilIm4enoJ1YpaKeEpSyEreO3EKI7PzmDl7HmcuLODcxUUp6Llz/8Hw9ClY+gZR\nQemURymUZjRLtwrTpEOVkAqHkCoMLt6Ef24v/PU9dgAc9WS4+Idhn5MXdh0+AYejblL0XDNFveeg\nbZjBLlUl/uVpxu/eTxDxbAKgzs5HfKYBGaYKKkQuxpXOLZS9gbymewDVnX3itV19aOg5idb+IXRS\nSvWNTaJ/fAo9I+Noo1WpplUprKpHJqVQEhX0J6HVGLlyG97ZXeIKgBdFfL+LNz465IxPHN2wx8kT\n++iaAez9lQ+TxdcAcOG1UHfhPq+jgovNyBV3OeYozucM0Do8KR2HxVdYu1Ha2kmA3Hko92k+5FXW\nw0AFXEBNwVTbRN4IE50b6X4etVpegbGr38AjvUNcARDhx9yx19mLhPvggKsfDrr546hnkAh3Trbg\nffciOX/hnSgRrpgA6DmFpubRNX0aXVOz4iy6yGyCnl4FuQDjMvKoyJJowGXRADMiy1wpQ40BuJAN\nVQ3UeWrofgVSaQCq6W8Sc02Iy8qX78am67EruAJT1+/AVWsVVwD2UtrsP+FDov1w2D0AR72C4ewX\nAiefYBGd3jwLx4QWgbCPPpsAZBVVossu/9upoBmA7dT8nAC0j01RYVPBUqpUWLugL6+VtPMMiZUu\nEp6USdsL2moYimi7UQB1Rs6yhySkIZj8o8ByTH91F05JbeIKwCGK9mGPQDh6q6QOjnsHyW6gpNm6\nBuClf2tWDD05yzCVy9RtG52RCWyhIwNkZWoRGkRR2e2ABur/PAPqe4fQeHKYUm6UpvQkurkL0XlZ\nW4dM5CitbkX6uQVHIig+VZzb6OyNb9cAOHqx8HA4+6rgoYqilW2Q2cHfWQ3A37Gf3PJvWkEp7Xem\naMrSxB2YQNPAuIiobKwXZ4Cqjl7xktYOFDdaYapvRT4NsjxKHU6hUrpf09UvMJxq9ukXQh3I0SsI\nH/iWYP424JbaLq4AuAaGS7ok55noty006Q0IScygzpWxBuCNT9KXAcQZQGsoRguJru/nSTtCk3aI\n+nglkpPU4i5+4Sim/ZG5pYMGVhuMtZTzlP/6ijrq+dU0sCqgpbxPyitCAuU+A7Ap6VdHnaqThh+3\nwDN3sKILHVU3EyClC3WslIISRKToEKnNkaNzYMoagD/sy8LLb/usBOAWV987TN1lAJXt/ZTjfSiz\n9CylAonPJaFFFPUC2ucYqprouh46Gn6ZVMhptOdJyTdDk0vidQVUtAYBsE8/3gt5RySIgPPfAr45\nPeIMcDiuUYqfRUenU/ej6LPHZBjwt31qAeChxwDsfP3KexErAdTUKVh4aWs3RbmLOksHCW6HiUTz\nkhrrWilVOOL1MrV5ddIKeZtwL+rcbWJIQGRqjgDYpx8XuhdN2X+4FmKBAEILB8UZYH9UPUU7WwSr\ndYV2bsRfjuol+nxk8fbXKwBiqMWVNHdSLrPYNhTUtlKKNNtEc3usRRYVVTp1q1RjGXWaEom4OqdQ\nhHPkWHg4CQnVZAqAkn4fH3SBe0gc3FWxshu9RABxFePiDLAnvEYinpBjorZbJL+r+J8O5ohgPjKA\n/fUKgEh6cCEJ11c0Iqeco0yCzTWU21W0ESun3Cwl0WZ5QAKJjs8ukIcqwsNYOLVRVUI6AuO18I+l\n1KB+zuK9w+LgpoqBa1CUvH19TgAp9dPiDMDDLVFvopUsRhLVIj8nyeac70l103JkAPtrFs8m/3Kf\nDiMBUWm5snT8Y/xDktci2JYitMzRaXoSrado6+g7WQjRZEiPD4xLFeF+FH3viER40S7SPZTEBy+J\ndwmIxFuOufjsLqBrnxNnAJ4NGkpD5ZlcT+x8zh0ntmxUjgxgf62YAPhGqmXy8dbVJ0JND4+HD+0Q\nA+K0BJeBsGQdIqjIwpI50iSaWlwwRTtIbRMeQ29hJNwnSkPfTYAn5bs75b1rcDRO2MQ7U59fD4Bb\n60qAEhtAsXyuMg7IkQHsrxVbWodVplLzPjwenrTJcldFUxTJKQ04qr6RGhKcLHB+inC6x13Gkz73\n4KhTvov4QBYfASc/mq6+ofJOfPoW1VzZmDgL4ZccDW05lgCWnBtDMkHw1OV2y0cGsL9WbF2A1ca7\nxRMB4TTqg0WQM527kLNIN4o0pwoL52J1JVCJeiBHfUn8MZ9QOPqopPg48vxewM4A3JkSKU01VAdL\nxWui7lYqw4z3PfzqyUcGsL9W7KEAVpvDERcqUn8cdPWV/QtH97hfqIjlVHFil6iz+BD5myO0Qfvj\n/mzEli9Fn4/sXNgJVHfcivkdWkuR9wyNxl/f34kX340R4esdFftOAKvtw/3H6AXEVV5GeB9/hLbB\nvKNkd5RjEN0LxPa9mSJaWQE+57rg95FEEh+VqsO+4+54efsO+V3eOrPg9Y6KfS8Aq83h6Ans3OdI\nK3WCoDxlm8yvhm/uyRDhh+j6AG2f+fzPh/QCwO/CB1w8bb+wZJsGsNoY5oO9R/Hm7iWA3fTycoDe\nefmc02q/syd27j1i++t7tj+yTsTazwG+5u2HYhsCoBgD8H9msXB2Pue0up+98V4IXt9FO1kSrzhf\n833FNhSAH8ydx97txaxnCoTiq/9+QwG+fwP+CyGRvQpx7eyKAAAAAElFTkSuQmCC\n", + "iVBORw0KGgoAAAANSUhEUgAAACUAAAAlCAYAAADFniADAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlz\nAAAewgAAHsIBbtB1PgAAAjJJREFUWEftWEFrGkEYVQIqGtFTjrmF/IEYWLzEgOQQiBCIEPaiEATb\n9CA0eKiFlgqlBw9CI9Yl1kjjIhYPNSgpSkuN4kXPXgr+k9f5Ju7SYoNDaY2UGXh833z7vuHxdnbZ\nHYtFDkEH0un0zbIgEoncMNmXFiYIlUoFtVoNiUSCI5VK8Ui1YrHI83g8jmw2a9aoTjA4lFMfxXK5\n/EudOAaPYjKZRKFQ4DUDmqaBiQIT9Z2L6nQ6SKe72N1N4uAgg729FyaoRtjffw1V/cDrNKd4ePgW\nx8fvcXT0zqzRNZqfnn7jHOqLRutm38nJNedSjTgGzs6qs6K2t78wlc8ZOtNIOeHNNGo/5VR7yvCK\n4Wp6nXKjh9a469vYyEJRPmJt7RG83ifw+z9hc/MZVlYeY2vrGjs7X7G+fgGf7+V9omgxUZCI+dzz\n81v0+33EYjEEg0Get1otuFwulEolPldVlYny/Q1R8wWR6EymjXa7zW5XFIFAgOf1eh1OpxP5fJ7P\nw+HwYkWtrvrZbfPC4XDAZrPx3OPxwGq1wu1287ndbv+9KF2/hab9C1yxdbW5oCd75unTdX1uo8ji\nf8JpNBr81TAjKpfLoVqtotvtLhy9Xu9+UcPhEA8xJpOJFCVkvHRKyCZGkk5Jp0QdEOXJPSWdEnVA\nlCf3lHRK1AFRntxT/6dTzWYTg8EA4/F44RiNRrPf6MZJCZ2WPBTob8r8xQqFQlgWKIpydxTExucl\nw6Xged9iaT8A6ipWINQO9M4AAAAASUVORK5CYII=\n" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.file_details.internal_name", + "data_type": "string", + "example_values": [ + "Wmiprvse.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.file_details.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.file_details.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.file_details.last_seen", + "data_type": "string", + "example_values": [ + "2018-03-25T06:49:27.776Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "column_name": "MD5", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.data.*.file_details.md5", + "data_type": "string", + "example_values": [ + "75E683BC8284D99F998500162BE4CFE2", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.file_details.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\windows\\system32\\wbem\\wmiprvse.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.file_details.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 489984, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.file_details.original_filename", + "data_type": "string", + "example_values": [ + "Wmiprvse.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.file_details.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.file_details.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Windows Operating System" + ] + }, + { + "data_path": "action_result.data.*.file_details.product_version", + "data_type": "string", + "example_values": [ + "10.0.16299.248", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.file_details.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-02-15T01:48:13.517Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.file_details.timestamp", + "data_type": "string", + "example_values": [ + "2018-02-15T01:48:13.517Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.file_details.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.file_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file name", + "file path" + ], + "data_path": "action_result.data.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe", + "C:\\Windows\\CarbonBlack\\Sensor.LOG", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.session_id", + "data_type": "numeric", + "example_values": [ + 101 + ] + }, + { + "column_name": "Vault ID", + "column_order": 1, + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.data.*.vault_id", + "data_type": "string", + "example_values": [ + "08f57fd06bbd8063d5b828521654225952a8155e", + "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.summary.cb_url", + "data_type": "string", + "example_values": [ + "https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2", + "https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.summary.file_type", + "data_type": "string", + "example_values": [ + "pe file" + ] + }, + { + "contains": [ + "file name", + "file path" + ], + "data_path": "action_result.summary.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe", + "C:\\Windows\\CarbonBlack\\Sensor.LOG", + "ping.exe" + ] + }, + { + "contains": [ + "vault id", + "sha1" + ], + "data_path": "action_result.summary.vault_id", + "data_type": "string", + "example_values": [ + "08f57fd06bbd8063d5b828521654225952a8155e", + "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534" + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "File type: pe file\nVault id: 08f57fd06bbd8063d5b828521654225952a8155e\nName: wmiprvse.exe\nCb url: https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2", + "Vault id: cefbc5c62d7e1f90d250ddcd35bc388a7b01f4d4, Name: C:\\Windows\\CarbonBlack\\Sensor.LOG", + "File type: pe file, Vault id: 41c4e1e9abe08b218f5ea60d8ae41a5f523e7534, Name: ping.exe, Cb url: https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "get file 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def get_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('get_file_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'get_file_2' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'get_file_2' call\n for filtered_results_item_1 in filtered_results_data_1:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'ph_0': \"\",\n 'offset': \"\",\n 'get_count': \"\",\n 'sensor_id': \"\",\n 'file_source': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"get file\", parameters=parameters, assets=['carbonblack'], name=\"get_file_2\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "91866693-2720-43a1-a437-f65f19382b9a", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 290, + "line_start": 263, + "message": "Configuring now", + "name": "get file", + "notes": "", + "number": 2, + "order": 10, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 200 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "get_file_2", + "required_params": {}, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2947 + }, + { + "action": "create ticket", + "action_type": "generic", + "active": false, + "active_keys": {}, + "active_values": { + "description": "block_hash_2:action_result.message", + "fields": "block_hash_2:action_result.message", + "short_description": "block_hash_2:action_result.message" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "description": "block_hash_2:action_result.message", + "fields": "block_hash_2:action_result.message", + "short_description": "block_hash_2:action_result.message", + "table": "", + "vault_id": "" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "servicenow", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.short_description", + "data_type": "string" + }, + { + "contains": [ + "servicenow table" + ], + "data_path": "action_result.parameter.table", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.fields", + "data_type": "string" + }, + { + "data_path": "action_result.parameter.description", + "data_type": "string" + }, + { + "contains": [ + "servicenow ticket id" + ], + "data_path": "action_result.summary.created_ticket_id", + "data_type": "string" + }, + { + "contains": [ + "vault id" + ], + "data_path": "action_result.parameter.vault_id", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_updated_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_updated_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.escalation", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.watch_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.follow_up", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.made_sla", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.delivery_task", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sla_due", + "data_type": "string" + }, + { + "column_name": "Number", + "column_order": 0, + "data_path": "action_result.data.*.number", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.caller_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.correlation_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_mod_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.notify", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.resolved_by", + "data_type": "string" + }, + { + "column_name": "Closed On", + "column_order": 6, + "data_path": "action_result.data.*.closed_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_tags", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.cmdb_ci", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.subcategory", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.category", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.close_notes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.expected_start", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.knowledge", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.opened_by.link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.opened_by.value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.impact", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.calendar_stc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.caused_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.comments", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.problem_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.activity_due", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.state", + "data_type": "string" + }, + { + "column_name": "ID", + "column_order": 4, + "contains": [ + "servicenow ticket id" + ], + "data_path": "action_result.data.*.sys_id", + "data_type": "string" + }, + { + "column_name": "Opened On", + "column_order": 5, + "data_path": "action_result.data.*.opened_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.child_incidents", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_notes", + "data_type": "string" + }, + { + "column_name": "Short Description", + "column_order": 0, + "data_path": "action_result.data.*.short_description", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.comments_and_work_notes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.time_worked", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_created_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.upon_reject", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.reassignment_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_stc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.due_date", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_class_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.delivery_plan", + "data_type": "string" + }, + { + "column_name": "Description", + "column_order": 1, + "data_path": "action_result.data.*.description", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.parent", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_duration", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.rfc", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.company", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.assigned_to", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval_history", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.user_input", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_start", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain.link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain.value", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.resolved_at", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.calendar_duration", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.group_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.active", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.parent_incident", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_domain_path", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.closed_by", + "data_type": "string" + }, + { + "column_name": "Severity", + "column_order": 2, + "data_path": "action_result.data.*.severity", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.upon_approval", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.incident_state", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.reopen_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.contact_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_end", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.work_notes_list", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.sys_created_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.location", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.correlation_display", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.close_code", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.assignment_group", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.approval_set", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.order", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.urgency", + "data_type": "string" + }, + { + "column_name": "Priority", + "column_order": 2, + "data_path": "action_result.data.*.priority", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.hold_reason", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.business_service", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_id", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_tags", + "data_type": "string" + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.attachment_details.*.file_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.compressed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.size_bytes", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.table_name", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.image_width", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.content_type", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.image_height", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.table_sys_id", + "data_type": "string" + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.attachment_details.*.download_link", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_mod_count", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_created_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_created_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_updated_by", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.sys_updated_on", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.size_compressed", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.attachment_details.*.average_image_color", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.additional_assignee_list", + "data_type": "string" + }, + { + "data_path": "action_result.summary.attachment_id", + "data_type": "string" + }, + { + "data_path": "action_result.summary.attachment_added", + "data_type": "boolean" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "product_name": "", + "product_vendor": "", + "type": "ticketing" + } + ], + "attrs": { + ".action": { + "text": "create ticket 3" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Utilities" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1, + "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg" + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_generic.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "# read-only block view not available", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#5094D4", + "connected_to_start": false, + "connection_name": "block hash 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "def create_ticket_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'create_ticket_2' call\n\n file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash', \n 'file_reputation_1:filtered-action_result.summary.positives'])\n blocked_hashes = set(phantom.collect2(datapath='block_hash_2:action_result.parameter.hash'))\n detected_users = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.username'))\n detected_systems = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.hostname'))\n \n title = \"Virus Detected on {0} devices\".format(len(detected_systems))\n \n description = \"Hashes sumbitted with detections:\\n{0}\\n\\n\".format(\", \".join([\"{0} ({1})\".format(*fr) for fr in file_reputation]))\n description += \"File was found on {0} devices:\\n{1}\\n\\n\".format(len(detected_systems), ', '.join(detected_systems))\n description += \"This impacts at least {0} users:\\n{1}\\n\\n\".format(len(detected_users), ', '.join(detected_users))\n if len(blocked_hashes):\n description += \"{0} hashes were submitted for blocking:\\n{1}\\n\\n\".format(len(blocked_hashes), \", \".join(blocked_hashes))\n\n parameters = []\n \n # build parameters list for 'create_ticket_2' call\n parameters.append({\n 'short_description': title,\n 'description': description,\n 'fields': \"\",\n })\n\n if parameters:\n phantom.act(\"create ticket\", parameters=parameters, assets=['servicenow'], name=\"create_ticket_3\", parent_action=action) \n else:\n phantom.error(\"'create_ticket_3' will not be executed due to lack of parameters\")\n \n return", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": true, + "has_custom_block": true, + "has_custom_callback": false, + "has_custom_join": false, + "id": "72f13962-4d43-44be-9710-d2ed60cbbf00", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 326, + "line_start": 290, + "message": "Configuring now", + "name": "create ticket", + "notes": "", + "number": 3, + "order": 11, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1220, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "create_ticket_3", + "required_params": {}, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Utilities", + "type": "coa.Action", + "warn": false, + "z": 2948 + }, + { + "action": "disable user", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "username": "hunt_file_2:action_result.data.*.process.results.*.username" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "username": "hunt_file_2:action_result.data.*.process.results.*.username" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "domainctrl1", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success", + "failed" + ] + }, + { + "column_name": "Username", + "column_order": 0, + "contains": [ + "user name", + "ldap distinguished name" + ], + "data_path": "action_result.parameter.username", + "data_type": "string", + "example_values": [ + "test_user3" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "User state changed" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "directory service" + } + ], + "attrs": { + ".action": { + "text": "disable user" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def disable_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('disable_user_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'disable_user_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.username', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'disable_user_1' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'username': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"disable user\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"disable_user_1\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 349, + "line_start": 326, + "message": "Configuring now", + "name": "disable user", + "notes": "", + "number": 1, + "order": 12, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 480 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "disable_user_1", + "required_params": { + "username": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2949 + }, + { + "action": "hunt file", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "binary" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", + "range": "", + "type": "binary" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7", + "13ded573464ba7f43fe640479b309e09", + "9bf50324444c46997c2492d505b47f2d", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.parameter.range", + "data_type": "string", + "example_values": [ + "0-10", + "0-2", + "5-8" + ] + }, + { + "contains": [ + "carbon black query type" + ], + "data_path": "action_result.parameter.type", + "data_type": "string", + "example_values": [ + "process", + "binary" + ] + }, + { + "data_path": "action_result.data.*.binary.elapsed", + "data_type": "numeric", + "example_values": [ + 0.1120398044586182, + 0.04952096939086914, + 0.1234798431396484, + 0.05507302284240723, + 0.05384993553161621 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", + "data_type": "string", + "example_values": [ + "2018-10-01T00:00:00Z", + "2015-01-01T00:00:00Z", + "2013-11-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.name", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.host_count.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "CB-TEST-02", + "WIN7-CLIENT1", + "ACCOUNTING-PC" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "16.7" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "C:\\Windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0", + "50.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", + "data_type": "string", + "example_values": [ + "2018-10-19T00:00:00Z", + "2018-09-29T00:00:00Z", + "2018-10-02T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", + "data_type": "numeric", + "example_values": [ + 1, + 0 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.highlights.*.ids", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.highlights.*.name", + "data_type": "string", + "example_values": [ + "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", + "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", + "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.cb_version", + "data_type": "numeric", + "example_values": [ + 610, + 510, + 511 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.company_name", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.copied_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_issuer", + "data_type": "string", + "example_values": [ + "Microsoft Code Signing PCA" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Corp." + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_publisher", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_result_code", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", + "data_type": "string", + "example_values": [ + "2018-10-14T20:23:00Z", + "2015-01-30T19:14:00Z", + "2009-07-14T10:17:00Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.digsig_subject", + "data_type": "string", + "example_values": [ + "Microsoft Corporation" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.endpoint", + "data_type": "string", + "example_values": [ + "CB-TEST-02|27", + "WIN7-CLIENT1|15", + "DC1|19" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.event_partition_id", + "data_type": "numeric", + "example_values": [ + 100972684312576, + 100955696070656 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.facet_id", + "data_type": "numeric", + "example_values": [ + 883737, + 0 + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_desc", + "data_type": "string", + "example_values": [ + "Microsoft Office Click-to-Run (SxS)", + "Microsoft Network Realtime Inspection Service", + "TCP/IP Ping Command" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.file_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385 (win7_rtm.090713-1255)" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.group", + "data_type": "string", + "example_values": [ + "Default Group" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.host_count", + "data_type": "numeric", + "example_values": [ + 1, + 6 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.internal_name", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_64bit", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.is_executable_image", + "data_type": "boolean", + "example_values": [ + false, + true + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.last_seen", + "data_type": "string", + "example_values": [ + "2018-10-28T10:06:02.456Z", + "2018-10-28T10:06:42.455Z", + "2018-10-26T00:01:41.224Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.legal_copyright", + "data_type": "string", + "example_values": [ + "Microsoft Corporation. All rights reserved." + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.binary.results.*.md5", + "data_type": "string", + "example_values": [ + "13DED573464BA7F43FE640479B309E09", + "9BF50324444C46997C2492D505B47F2D", + "5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.observed_filename", + "data_type": "string", + "example_values": [ + "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", + "c:\\program files\\microsoft security client\\nissrv.exe", + "c:\\windows\\system32\\ping.exe" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.orig_mod_len", + "data_type": "numeric", + "example_values": [ + 9683736, + 366512, + 16896 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.binary.results.*.original_filename", + "data_type": "string", + "example_values": [ + "OfficeClickToRun.exe", + "NisSrv.exe", + "ping.exe.mui" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.os_type", + "data_type": "string", + "example_values": [ + "Windows" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_name", + "data_type": "string", + "example_values": [ + "Microsoft Office", + "Microsoft Malware Protection" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.product_version", + "data_type": "string", + "example_values": [ + "16.0.10827.20181", + "4.7.0205.0", + "6.1.7600.16385" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "column_name": "Signed", + "column_order": 1, + "data_path": "action_result.data.*.binary.results.*.signed", + "data_type": "string", + "example_values": [ + "Signed" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.timestamp", + "data_type": "string", + "example_values": [ + "2018-10-19T17:04:47.906Z", + "2015-07-01T02:12:21.783Z", + "2015-05-15T07:23:54.846Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", + "data_type": "string", + "example_values": [ + "2015-07-01T02:20:02.062Z", + "2015-05-15T07:30:02.843Z" + ] + }, + { + "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", + "data_type": "string", + "example_values": [ + "5" + ] + }, + { + "data_path": "action_result.data.*.binary.start", + "data_type": "numeric", + "example_values": [ + 0, + 5 + ] + }, + { + "data_path": "action_result.data.*.binary.terms", + "data_type": "string", + "example_values": [ + "md5:13ded573464ba7f43fe640479b309e09", + "md5:9bf50324444c46997c2492d505b47f2d", + "md5:5FB30FE90736C7FC77DE637021B1CE7C" + ] + }, + { + "data_path": "action_result.data.*.binary.total_results", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.process.all_segments", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.comprehensive_search", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.elapsed", + "data_type": "numeric", + "example_values": [ + 0.2200779914855957 + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.day_of_week.*.value", + "data_type": "numeric", + "example_values": [ + 1566 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.name", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.group.*.value", + "data_type": "numeric", + "example_values": [ + 10128 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.name", + "data_type": "string", + "example_values": [ + "domain_controller" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.ratio", + "data_type": "string", + "example_values": [ + "100.0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.host_type.*.value", + "data_type": "numeric", + "example_values": [ + 10123 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.name", + "data_type": "string", + "example_values": [ + "dc2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.ratio", + "data_type": "string", + "example_values": [ + "51.2" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hostname.*.value", + "data_type": "numeric", + "example_values": [ + 5185 + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", + "data_type": "numeric", + "example_values": [ + 411 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.parent_name.*.name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.parent_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.facets.path_full.*.name", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.path_full.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.facets.process_md5.*.name", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_md5.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.facets.process_name.*.name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.ratio", + "data_type": "string", + "example_values": [ + "98.5" + ] + }, + { + "data_path": "action_result.data.*.process.facets.process_name.*.value", + "data_type": "numeric", + "example_values": [ + 9971 + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.name", + "data_type": "string", + "example_values": [ + "2018-02-24T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.process.facets.start.*.value", + "data_type": "numeric", + "example_values": [ + 324 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.name", + "data_type": "string", + "example_values": [ + "LOCAL SERVICE" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.percent", + "data_type": "numeric", + "example_values": [ + 100 + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.ratio", + "data_type": "string", + "example_values": [ + "98.4" + ] + }, + { + "data_path": "action_result.data.*.process.facets.username_full.*.value", + "data_type": "numeric", + "example_values": [ + 9966 + ] + }, + { + "data_path": "action_result.data.*.process.incomplete_results", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", + "data_type": "string", + "example_values": [ + "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", + "data_type": "numeric", + "example_values": [ + -100 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", + "data_type": "string", + "example_values": [ + "2018-02-07T02:37:28Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.childproc_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "contains": [ + "file path" + ], + "data_path": "action_result.data.*.process.results.*.cmdline", + "data_type": "string", + "example_values": [ + "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.comms_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.crossproc_count", + "data_type": "numeric", + "example_values": [ + 2 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_config", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.emet_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filemod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.group", + "data_type": "string", + "example_values": [ + "default group" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.host_type", + "data_type": "string", + "example_values": [ + "workstation" + ] + }, + { + "contains": [ + "host name" + ], + "data_path": "action_result.data.*.process.results.*.hostname", + "data_type": "string", + "example_values": [ + "win7-client1" + ] + }, + { + "contains": [ + "carbon black process id" + ], + "data_path": "action_result.data.*.process.results.*.id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.interface_ip", + "data_type": "numeric", + "example_values": [ + 168886572 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_server_update", + "data_type": "string", + "example_values": [ + "2018-03-22T09:21:32.332Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.last_update", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.82Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.modload_count", + "data_type": "numeric", + "example_values": [ + 43 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.netconn_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.os_type", + "data_type": "string", + "example_values": [ + "windows" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_md5", + "data_type": "string", + "example_values": [ + "000000000000000000000000000000" + ] + }, + { + "contains": [ + "file name" + ], + "data_path": "action_result.data.*.process.results.*.parent_name", + "data_type": "string", + "example_values": [ + "svchost.exe" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_pid", + "data_type": "numeric", + "example_values": [ + 600 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.parent_unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" + ] + }, + { + "contains": [ + "file path", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.path", + "data_type": "string", + "example_values": [ + "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" + ] + }, + { + "contains": [ + "md5" + ], + "data_path": "action_result.data.*.process.results.*.process_md5", + "data_type": "string", + "example_values": [ + "4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "contains": [ + "process name", + "file name" + ], + "data_path": "action_result.data.*.process.results.*.process_name", + "data_type": "string", + "example_values": [ + "wmiprvse.exe" + ] + }, + { + "contains": [ + "pid" + ], + "data_path": "action_result.data.*.process.results.*.process_pid", + "data_type": "numeric", + "example_values": [ + 1672 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.processblock_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.regmod_count", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.segment_id", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "contains": [ + "carbon black sensor id" + ], + "data_path": "action_result.data.*.process.results.*.sensor_id", + "data_type": "numeric", + "example_values": [ + 15 + ] + }, + { + "data_path": "action_result.data.*.process.results.*.start", + "data_type": "string", + "example_values": [ + "2017-09-07T00:52:15.758Z" + ] + }, + { + "data_path": "action_result.data.*.process.results.*.terminated", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.process.results.*.unique_id", + "data_type": "string", + "example_values": [ + "0000000f-0000-0688-01d3-27738c9b4243-000000000001" + ] + }, + { + "contains": [ + "user name" + ], + "data_path": "action_result.data.*.process.results.*.username", + "data_type": "string", + "example_values": [ + "SYSTEM" + ] + }, + { + "data_path": "action_result.data.*.process.start", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.process.terms", + "data_type": "string", + "example_values": [ + "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" + ] + }, + { + "data_path": "action_result.data.*.process.total_results", + "data_type": "numeric", + "example_values": [ + 32404 + ] + }, + { + "data_path": "action_result.summary.device_count", + "data_type": "numeric", + "example_values": [ + 32404, + 1 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Displaying 10 'process' results of total 32404", + "Displaying 1 'binary' results of total 1", + "Displaying 0 'binary' results of total 1" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "hunt file 1" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_1' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_1' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"binary\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=block_hash_2, name=\"hunt_file_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "file reputation", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 398, + "line_start": 373, + "message": "Configuring now", + "name": "hunt file", + "notes": "", + "number": 1, + "order": 14, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 600, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "hunt_file_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2955 + }, + { + "action": "block hash", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "comment": "", + "hash": "hunt_file_1:artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "comment": "", + "hash": "hunt_file_1:artifact:*.cef.fileHash" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "data_path": "action_result.parameter.comment", + "data_type": "string", + "example_values": [ + "Sample comment" + ] + }, + { + "column_name": "Hash", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "180469AE0B239E31DB4C65F02FD70BC1" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Block hash action succeeded. It might take some time for blacklisting to take effect." + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "block hash 2" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_hash_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'block_hash_2' call\n inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:artifact:*.cef.fileHash', 'hunt_file_1:artifact:*.id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'block_hash_2' call\n for inputs_item_1 in inputs_data_1:\n if inputs_item_1[0]:\n parameters.append({\n 'hash': inputs_item_1[0],\n 'comment': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': inputs_item_1[1]},\n })\n\n phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], callback=filter_3, name=\"block_hash_2\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 1", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 422, + "line_start": 398, + "message": "Configuring now", + "name": "block hash", + "notes": "", + "number": 2, + "order": 15, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "block_hash_2", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": true, + "show_delay": false, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2956 + }, + { + "action": "file reputation", + "action_type": "investigate", + "active": false, + "active_keys": {}, + "active_values": { + "hash": "artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "file reputation", + "active": true, + "app_name": "VirusTotal", + "app_version": "1.2.40", + "appid": "", + "asset_name": "virustotal", + "config_type": "asset", + "count": 0, + "fields": { + "hash": "artifact:*.cef.fileHash" + }, + "has_app": true, + "id": 142, + "loaded": false, + "missing": false, + "name": "virustotal", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "contains": [ + "hash", + "sha256", + "sha1", + "md5" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "contains": [ + "hash", + "md5" + ], + "data_path": "action_result.data.*.md5", + "data_type": "string", + "example_values": [ + "494303294715f5ffad7ad3f43b73b00b" + ] + }, + { + "contains": [ + "url" + ], + "data_path": "action_result.data.*.permalink", + "data_type": "string", + "example_values": [ + "https://www.test.com/file/27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7/analysis/1548112684/" + ] + }, + { + "data_path": "action_result.data.*.positives", + "data_type": "numeric", + "example_values": [ + 64 + ] + }, + { + "contains": [ + "sha1" + ], + "data_path": "action_result.data.*.resource", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "data_path": "action_result.data.*.response_code", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "action_result.data.*.scan_date", + "data_type": "string", + "example_values": [ + "2019-01-21 23:18:04" + ] + }, + { + "contains": [ + "virustotal scan id" + ], + "data_path": "action_result.data.*.scan_id", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684" + ] + }, + { + "data_path": "action_result.data.*.scans.*.detected", + "data_type": "boolean" + }, + { + "data_path": "action_result.data.*.scans.*.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.*.update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.*.version", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.ALYac.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ALYac.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ALYac.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.ALYac.version", + "data_type": "string", + "example_values": [ + "1.1.1.5" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.result", + "data_type": "string", + "example_values": [ + "Win32:Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AVG.version", + "data_type": "string", + "example_values": [ + "18.4.3895.0" + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b (v)" + ] + }, + { + "data_path": "action_result.data.*.scans.AVware.update", + "data_type": "string", + "example_values": [ + "20180925" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.AVware.version", + "data_type": "string", + "example_values": [ + "1.6.0.52" + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.result", + "data_type": "string", + "example_values": [ + "suspicious" + ] + }, + { + "data_path": "action_result.data.*.scans.Acronis.update", + "data_type": "string", + "example_values": [ + "20190119" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Acronis.version", + "data_type": "string", + "example_values": [ + "1.0.1.37" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Ad-Aware.version", + "data_type": "string", + "example_values": [ + "3.0.5.370" + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.AegisLab.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AegisLab.version", + "data_type": "string", + "example_values": [ + "4.2" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.result", + "data_type": "string", + "example_values": [ + "Win32/Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.AhnLab-V3.version", + "data_type": "string", + "example_values": [ + "3.14.1.22785" + ] + }, + { + "data_path": "action_result.data.*.scans.Alibaba.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Alibaba.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Alibaba.update", + "data_type": "string", + "example_values": [ + "20180921" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Alibaba.version", + "data_type": "string", + "example_values": [ + "0.1.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.result", + "data_type": "string", + "example_values": [ + "Virus/Win32.Parite.c" + ] + }, + { + "data_path": "action_result.data.*.scans.Antiy-AVL.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Antiy-AVL.version", + "data_type": "string", + "example_values": [ + "3.0.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Arcabit.version", + "data_type": "string", + "example_values": [ + "1.0.0.837" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast-Mobile.version", + "data_type": "string", + "example_values": [ + "190121-00" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.result", + "data_type": "string", + "example_values": [ + "Win32:Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Avast.version", + "data_type": "string", + "example_values": [ + "18.4.3895.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.result", + "data_type": "string", + "example_values": [ + "W32/Parite" + ] + }, + { + "data_path": "action_result.data.*.scans.Avira.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Avira.version", + "data_type": "string", + "example_values": [ + "8.3.3.8" + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Babable.update", + "data_type": "string", + "example_values": [ + "20180918" + ] + }, + { + "data_path": "action_result.data.*.scans.Babable.version", + "data_type": "string", + "example_values": [ + "9107201" + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.result", + "data_type": "string", + "example_values": [ + "Win32.Virus.Parite.d" + ] + }, + { + "data_path": "action_result.data.*.scans.Baidu.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Baidu.version", + "data_type": "string", + "example_values": [ + "1.0.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.BitDefender.version", + "data_type": "string", + "example_values": [ + "7.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.result", + "data_type": "string", + "example_values": [ + "W32.Pinfi.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Bkav.version", + "data_type": "string", + "example_values": [ + "1.3.0.9899" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.result", + "data_type": "string", + "example_values": [ + "W32.Perite.A" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.CAT-QuickHeal.version", + "data_type": "string", + "example_values": [ + "14.00" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b!O" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.CMC.version", + "data_type": "string", + "example_values": [ + "1.1.0.977" + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.result", + "data_type": "string", + "example_values": [ + "Heuristics.W32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ClamAV.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.ClamAV.version", + "data_type": "string", + "example_values": [ + "0.101.1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.result", + "data_type": "string", + "example_values": [ + "Malware@#1b1651nqd7ivb" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Comodo.version", + "data_type": "string", + "example_values": [ + "30310" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.result", + "data_type": "string", + "example_values": [ + "malicious_confidence_100% (W)" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.update", + "data_type": "string", + "example_values": [ + "20181023" + ] + }, + { + "data_path": "action_result.data.*.scans.CrowdStrike.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.result", + "data_type": "string", + "example_values": [ + "malicious.94715f" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.update", + "data_type": "string", + "example_values": [ + "20190109" + ] + }, + { + "data_path": "action_result.data.*.scans.Cybereason.version", + "data_type": "string", + "example_values": [ + "1.2.27" + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.result", + "data_type": "string", + "example_values": [ + "Unsafe" + ] + }, + { + "data_path": "action_result.data.*.scans.Cylance.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Cylance.version", + "data_type": "string", + "example_values": [ + "2.3.1.101" + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.result", + "data_type": "string", + "example_values": [ + "W32/Virut.E.gen!Eldorado" + ] + }, + { + "data_path": "action_result.data.*.scans.Cyren.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Cyren.version", + "data_type": "string", + "example_values": [ + "6.2.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.result", + "data_type": "string", + "example_values": [ + "Trojan.DownLoader20.25948" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.DrWeb.version", + "data_type": "string", + "example_values": [ + "7.0.34.11020" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.result", + "data_type": "string", + "example_values": [ + "Win32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ESET-NOD32.version", + "data_type": "string", + "example_values": [ + "18744" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B (B)" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Emsisoft.version", + "data_type": "string", + "example_values": [ + "2018.4.0.1029" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.result", + "data_type": "string", + "example_values": [ + "malicious (high confidence)" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.update", + "data_type": "string", + "example_values": [ + "20181108" + ] + }, + { + "data_path": "action_result.data.*.scans.Endgame.version", + "data_type": "string", + "example_values": [ + "3.0.2" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.result", + "data_type": "string", + "example_values": [ + "W32/Virut.E.gen!Eldorado" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Prot.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.F-Prot.version", + "data_type": "string", + "example_values": [ + "4.7.1.166" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.F-Secure.version", + "data_type": "string", + "example_values": [ + "11.0.19100.45" + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.result", + "data_type": "string", + "example_values": [ + "W32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Fortinet.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Fortinet.version", + "data_type": "string", + "example_values": [ + "5.4.247.0" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.GData.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.GData.version", + "data_type": "string", + "example_values": [ + "A:25.20275B:25.14197" + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Virut" + ] + }, + { + "data_path": "action_result.data.*.scans.Ikarus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Ikarus.version", + "data_type": "string", + "example_values": [ + "0.1.5.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.result", + "data_type": "string", + "example_values": [ + "heuristic" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.update", + "data_type": "string", + "example_values": [ + "20181128" + ] + }, + { + "data_path": "action_result.data.*.scans.Invincea.version", + "data_type": "string", + "example_values": [ + "6.3.6.26157" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.result", + "data_type": "string", + "example_values": [ + "Win32/Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Jiangmin.version", + "data_type": "string", + "example_values": [ + "16.0.100" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.result", + "data_type": "string", + "example_values": [ + "Virus ( 00001b711 )" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.K7AntiVirus.version", + "data_type": "string", + "example_values": [ + "11.24.29740" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.result", + "data_type": "string", + "example_values": [ + "Virus ( 00001b711 )" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.K7GW.version", + "data_type": "string", + "example_values": [ + "11.24.29740" + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.Kaspersky.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Kaspersky.version", + "data_type": "string", + "example_values": [ + "15.0.1.13" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b.5756" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Kingsoft.version", + "data_type": "string", + "example_values": [ + "2013.8.14.323" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.result", + "data_type": "string", + "example_values": [ + "malware (ai score=100)" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.MAX.version", + "data_type": "string", + "example_values": [ + "2018.9.12.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.result", + "data_type": "string", + "example_values": [ + "Trojan.Agent.QQ" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Malwarebytes.version", + "data_type": "string", + "example_values": [ + "2.1.1.1115" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.result", + "data_type": "string", + "example_values": [ + "BehavesLike.Win32.Pate.hh" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee-GW-Edition.version", + "data_type": "string", + "example_values": [ + "v2017.3010" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.result", + "data_type": "string", + "example_values": [ + "W32/Pate.b" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.McAfee.version", + "data_type": "string", + "example_values": [ + "6.0.6.653" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.MicroWorld-eScan.version", + "data_type": "string", + "example_values": [ + "14.0.297.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.result", + "data_type": "string", + "example_values": [ + "Virus:Win32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Microsoft.version", + "data_type": "string", + "example_values": [ + "1.1.15500.2" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.bgvo" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.NANO-Antivirus.version", + "data_type": "string", + "example_values": [ + "1.0.134.24576" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.result", + "data_type": "string", + "example_values": [ + "generic.ml" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Paloalto.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.result", + "data_type": "string", + "example_values": [ + "W32/Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Panda.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Panda.version", + "data_type": "string", + "example_values": [ + "4.6.4.2" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.H" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Qihoo-360.version", + "data_type": "string", + "example_values": [ + "1.0.0.1120" + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.result", + "data_type": "string", + "example_values": [ + "Virus.Parite!1.9B80 (CLOUD)" + ] + }, + { + "data_path": "action_result.data.*.scans.Rising.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Rising.version", + "data_type": "string", + "example_values": [ + "25.0.0.24" + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.update", + "data_type": "string", + "example_values": [ + "20190116" + ] + }, + { + "data_path": "action_result.data.*.scans.SUPERAntiSpyware.version", + "data_type": "string", + "example_values": [ + "5.6.0.1032" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.result", + "data_type": "string", + "example_values": [ + "static engine - malicious" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.SentinelOne.version", + "data_type": "string", + "example_values": [ + "1.0.21.268" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.result", + "data_type": "string", + "example_values": [ + "W32/Parite-B" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Sophos.version", + "data_type": "string", + "example_values": [ + "4.98.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.result", + "data_type": "string", + "example_values": [ + "Trojan.Gen.6" + ] + }, + { + "data_path": "action_result.data.*.scans.Symantec.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Symantec.version", + "data_type": "string", + "example_values": [ + "1.8.0.0" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.result", + "data_type": "string", + "example_values": [ + "Virus/W32.Parite.C" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TACHYON.version", + "data_type": "string", + "example_values": [ + "2019-01-21.02" + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Dropper.c" + ] + }, + { + "data_path": "action_result.data.*.scans.Tencent.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Tencent.version", + "data_type": "string", + "example_values": [ + "1.0.0.1" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.result", + "data_type": "string", + "example_values": [ + "W32/Pate.B" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.TheHacker.version", + "data_type": "string", + "example_values": [ + "6.8.0.5.3962" + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.result", + "data_type": "string", + "example_values": [ + "Win32/Pinfi.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TotalDefense.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.TotalDefense.version", + "data_type": "string", + "example_values": [ + "37.1.62.1" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.result", + "data_type": "string", + "example_values": [ + "malicious.high.ml.score" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.update", + "data_type": "string", + "example_values": [ + "20190103" + ] + }, + { + "data_path": "action_result.data.*.scans.Trapmine.version", + "data_type": "string", + "example_values": [ + "3.0.34.707" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.result", + "data_type": "string", + "example_values": [ + "PE_PARITE.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.version", + "data_type": "string", + "example_values": [ + "10.0.0.1040" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.result", + "data_type": "string", + "example_values": [ + "PE_PARITE.A" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.TrendMicro.version", + "data_type": "string", + "example_values": [ + "10.0.0.1040" + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Trustlook.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Trustlook.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.VBA32.version", + "data_type": "string", + "example_values": [ + "3.35.1" + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.b (v)" + ] + }, + { + "data_path": "action_result.data.*.scans.VIPRE.update", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.VIPRE.version", + "data_type": "string", + "example_values": [ + "None" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.A" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ViRobot.version", + "data_type": "string", + "example_values": [ + "2014.3.20.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.Webroot.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.Webroot.version", + "data_type": "string", + "example_values": [ + "1.0.0.403" + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Yandex.update", + "data_type": "string", + "example_values": [ + "20190120" + ] + }, + { + "contains": [ + "ip" + ], + "data_path": "action_result.data.*.scans.Yandex.version", + "data_type": "string", + "example_values": [ + "5.5.1.3" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.result", + "data_type": "string", + "example_values": [ + "Virus.Parite.Win32.9" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.update", + "data_type": "string", + "example_values": [ + "20190118" + ] + }, + { + "data_path": "action_result.data.*.scans.Zillya.version", + "data_type": "string", + "example_values": [ + "2.0.0.3733" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.result", + "data_type": "string", + "example_values": [ + "Virus.Win32.Parite.b" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.ZoneAlarm.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.result", + "data_type": "string", + "example_values": [ + "Win32.Parite.B" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.update", + "data_type": "string", + "example_values": [ + "20190121" + ] + }, + { + "data_path": "action_result.data.*.scans.Zoner.version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.detected", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.result", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.scans.eGambit.update", + "data_type": "string", + "example_values": [ + "20190122" + ] + }, + { + "data_path": "action_result.data.*.scans.eGambit.version", + "data_type": "string", + "example_values": [ + "v4.3.5" + ] + }, + { + "contains": [ + "hash", + "sha1" + ], + "data_path": "action_result.data.*.sha1", + "data_type": "string", + "example_values": [ + "6c1948f7edf115cd1f13cd170b882077930be150" + ] + }, + { + "contains": [ + "hash", + "sha256" + ], + "data_path": "action_result.data.*.sha256", + "data_type": "string", + "example_values": [ + "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7" + ] + }, + { + "data_path": "action_result.data.*.total", + "data_type": "numeric", + "example_values": [ + 72 + ] + }, + { + "data_path": "action_result.data.*.verbose_msg", + "data_type": "string", + "example_values": [ + "Scan finished, information embedded" + ] + }, + { + "data_path": "action_result.summary.positives", + "data_type": "numeric", + "example_values": [ + 64 + ] + }, + { + "data_path": "action_result.summary.total_scans", + "data_type": "numeric", + "example_values": [ + 72 + ] + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Positives: 64, Total scans: 72" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_positives", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "parameters": { + "hash": { + "contains": [ + "hash", + "sha256", + "sha1", + "md5" + ], + "data_type": "string", + "default": null, + "description": "File hash to query", + "key": "hash", + "order": 0, + "primary": true, + "required": true + } + }, + "product_name": "VirusTotal", + "product_vendor": "VirusTotal", + "targets": "34", + "type": "" + } + ], + "attrs": { + ".action": { + "text": "file reputation" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Investigate" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.error image": { + "xlink:href": "/inc/coa/img/block_icon_warn.svg" + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_investigate.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('file_reputation_1() called')\n\n # collect data for 'file_reputation_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'file_reputation_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'hash': container_item[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n phantom.act(action=\"file reputation\", parameters=parameters, assets=['virustotal'], callback=filter_1, name=\"file_reputation_1\")\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#654796", + "connected_to_start": true, + "connection_name": "", + "connection_type": "", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 443, + "line_start": 422, + "message": "Configuring now", + "name": "file reputation", + "notes": "", + "number": 1, + "order": 16, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 220, + "y": 80 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "file_reputation_1", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": false, + "show_number": false, + "size": { + "height": 112, + "width": 168 + }, + "state": "action_assets", + "status": "", + "title": "Investigate", + "type": "coa.Action", + "warn": false, + "z": 2957 + }, + { + "action": "block hash", + "action_type": "contain", + "active": false, + "active_keys": {}, + "active_values": { + "comment": "", + "hash": "hunt_file_2:artifact:*.cef.fileHash" + }, + "angle": 0, + "app": "", + "approver": "", + "assets": [ + { + "action": "", + "active": true, + "app_name": "", + "app_version": "", + "appid": "", + "config_type": "asset", + "fields": { + "comment": "", + "hash": "hunt_file_2:artifact:*.cef.fileHash" + }, + "has_app": true, + "id": "-", + "loaded": false, + "missing": false, + "name": "carbonblack", + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "example_values": [ + "success" + ] + }, + { + "data_path": "action_result.parameter.comment", + "data_type": "string", + "example_values": [ + "Sample comment" + ] + }, + { + "column_name": "Hash", + "column_order": 0, + "contains": [ + "md5", + "hash" + ], + "data_path": "action_result.parameter.hash", + "data_type": "string", + "example_values": [ + "180469AE0B239E31DB4C65F02FD70BC1" + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "column_name": "Message", + "column_order": 1, + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Block hash action succeeded. It might take some time for blacklisting to take effect." + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "product_name": "", + "product_vendor": "", + "type": "endpoint" + } + ], + "attrs": { + ".action": { + "text": "block hash 3" + }, + ".background": { + "fill": "#000000", + "stroke": "#5C6773" + }, + ".border": { + "height": 88 + }, + ".color-band": { + "fill": "#3C444D" + }, + ".inPorts>.port-in": { + "ref": ".background", + "ref-x": 0.5 + }, + ".inPorts>.port-in>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".message": { + "fill": "#FFFFFF", + "font-size": 12, + "font-weight": 300, + "opacity": 0, + "ref": ".background", + "ref-x": 5, + "ref-y": 105, + "text": "Configuring now" + }, + ".outPorts>.port-out": { + "ref": ".background", + "ref-x": 0.5 + }, + ".outPorts>.port-out>.port-body": { + "port": { + "id": "out", + "type": "out" + } + }, + ".title": { + "text": "Contain" + }, + "g.approver image": { + "opacity": 1 + }, + "g.code image": { + "opacity": 1 + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.icon image": { + "xlink:href": "/inc/coa/img/block_icon_contain.svg" + }, + "g.notes": { + "display": "block", + "opacity": 1 + }, + "g.notes image": { + "opacity": 1 + }, + "g.timer image": { + "opacity": 1 + }, + "rect.warn-background": { + "fill": "#FFFFFF" + }, + "text.icon": { + "fill": "#FFFFFF" + } + }, + "block_code": "def block_hash_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_hash_3() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'block_hash_3' call\n inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:artifact:*.cef.fileHash', 'hunt_file_2:artifact:*.id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'block_hash_3' call\n for inputs_item_1 in inputs_data_1:\n if inputs_item_1[0]:\n parameters.append({\n 'hash': inputs_item_1[0],\n 'comment': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': inputs_item_1[1]},\n })\n\n phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], callback=join_filter_2, name=\"block_hash_3\", parent_action=action)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": true, + "color": "#3D9959", + "connected_to_start": false, + "connection_name": "hunt file 2", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "delay": "0", + "description": "", + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f", + "inPorts": [ + "in" + ], + "join_code": "", + "join_optional": [], + "join_start": 1, + "line_end": 373, + "line_start": 349, + "message": "Configuring now", + "name": "block hash", + "notes": "", + "number": 3, + "order": 13, + "outPorts": [ + "out" + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 840, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "block_hash_3", + "required_params": { + "hash": true + }, + "reviewer": "", + "showNumber": true, + "show_number": true, + "size": { + "height": 112, + "width": 168 + }, + "state": "asset", + "status": "", + "title": "Contain", + "type": "coa.Action", + "warn": false, + "z": 2958 + }, + { + "active": false, + "angle": 0, + "attrs": { + ".background": { + "fill": "#000000", + "stroke": "#5C6773", + "transform": "rotate(45 30 70)" + }, + ".border": { + "transform": "rotate(45 30 70)" + }, + ".inPorts>.port-0>.port-body": { + "port": { + "id": "in", + "type": "in" + } + }, + ".number": { + "text": 2 + }, + ".outPorts>.port-0": { + "port": { + "id": "out-1", + "type": "out" + }, + "ref-x": 83, + "ref-y": 40 + }, + ".outPorts>.port-0>.port-body": { + "port": { + "id": "out-1", + "type": "out" + } + }, + "g.delete": { + "display": "none" + }, + "g.error": { + "opacity": 0 + }, + "g.notes": { + "display": "block" + }, + "g.notes image": { + "opacity": 1 + } + }, + "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 10],\n ],\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n create_ticket_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", + "callback_code": "", + "callback_start": 1, + "callsback": false, + "connected_to_start": false, + "connection_name": "logoff user, shutdown system, disable user, block hash 3", + "connection_type": "action", + "custom_callback": "", + "custom_code": "", + "custom_join": "", + "custom_name": "", + "description": "", + "hasElse": false, + "has_custom": false, + "has_custom_block": false, + "has_custom_callback": false, + "has_custom_join": false, + "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4", + "inPorts": [ + "in" + ], + "join_code": "def join_filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('join_filter_2() called')\n\n # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n if phantom.completed(action_names=['logoff_user_1', 'shutdown_system_1', 'disable_user_1', 'block_hash_3']):\n \n # call connected block \"filter_2\"\n filter_2(container=container, handle=handle)\n \n return", + "join_optional": [], + "join_start": 132, + "line_end": 143, + "line_start": 114, + "name": "filter", + "notes": "", + "number": 2, + "order": 5, + "outPorts": [ + "out-1" + ], + "outputs": [ + { + "conditions": [ + { + "comparison": ">", + "data_type": "", + "param": "file_reputation_1:action_result.summary.positives", + "value": "10" + } + ], + "display": "If", + "logic": "and", + "type": "if" + } + ], + "ports": { + "groups": { + "in": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "left" + } + }, + "position": { + "name": "left" + } + }, + "out": { + "attrs": { + ".port-body": { + "fill": "#fff", + "magnet": true, + "r": 10, + "stroke": "#000" + }, + ".port-label": { + "fill": "#000" + } + }, + "label": { + "position": { + "args": { + "y": 10 + }, + "name": "right" + } + }, + "position": { + "name": "right" + } + } + } + }, + "position": { + "x": 1080, + "y": 340 + }, + "previous_block_type": "", + "previous_function": "", + "previous_name": "filter_2", + "show_number": true, + "size": { + "height": 82, + "width": 82 + }, + "state": "filter", + "status": "", + "type": "coa.Filter", + "warn": false, + "z": 2959 + } + ] + }, + "notes": "" + }, + "python_version": "3", + "schema": 4, + "version": "4.10.0.40961" + }, + "create_time": "2021-01-21T21:31:52.515480+00:00", + "draft_mode": false, + "labels": [ + "events" + ], + "tags": [], + "misc": { + "apps_list": [ + "LDAP", + "ServiceNow", + "Carbon Black Response", + "VirusTotal" + ] + } +} \ No newline at end of file diff --git a/playbooks/malware_hunt_and_contain.png b/playbooks/malware_hunt_and_contain.png new file mode 100644 index 0000000000..784fcde3ab Binary files /dev/null and b/playbooks/malware_hunt_and_contain.png differ diff --git a/playbooks/malware_hunt_and_contain.py b/playbooks/malware_hunt_and_contain.py new file mode 100644 index 0000000000..eb7e2f484f --- /dev/null +++ b/playbooks/malware_hunt_and_contain.py @@ -0,0 +1,456 @@ +""" +This playbook investigates and remediates malware infections on the endpoint. +""" + +import phantom.rules as phantom +import json +from datetime import datetime, timedelta +############################## +# Start - Global Code Block + +"""Malicous file detected on endpoint""" + +# End - Global Code block +############################## + +def on_start(container): + phantom.debug('on_start() called') + + # call 'file_reputation_1' block + file_reputation_1(container=container) + + return + +def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_3() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">", 5], + ["file_reputation_1:action_result.summary.positives", "<=", 10], + ], + logical_operator='and', + name="filter_3:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + create_ticket_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def shutdown_system_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('shutdown_system_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'shutdown_system_1' call + results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'shutdown_system_1' call + for results_item_1 in results_data_1: + parameters.append({ + 'ph': "", + 'message': "", + 'wait_time': "", + 'ip_hostname': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="shutdown system", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name="shutdown_system_1", parent_action=action) + + return + +def create_ticket_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'create_ticket_2' call + + disabled_users = set(phantom.collect2(datapath='disable_user_1:action_result.parameter.username')) + blocked_hashes = set(phantom.collect2(datapath='block_hash_3:action_result.parameter.hash')) + loggedoff_users = set(phantom.collect2(datapath='logoff_user_1:action_result.parameter.username')) + shutdown_systems = set(phantom.collect2(datapath='shutdown_system_1:action_result.parameter.ip_hostname')) + file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash', + 'file_reputation_1:filtered-action_result.summary.positives']) + detected_users = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.username')) + detected_systems = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.hostname')) + + title = "Virus Detected on {0} devices".format(len(detected_systems)) + + description = "Hashes sumbitted with detections:\n{0}\n\n".format(", ".join(["{0} ({1})".format(*fr) for fr in file_reputation])) + description += "File was found on {0} devices:\n{1}\n\n".format(len(detected_systems), ', '.join(detected_systems)) + description += "This impacts at least {0} users:\n{1}\n\n".format(len(detected_users), ', '.join(detected_users)) + if len(blocked_hashes): + description += "{0} hashes were submitted for blocking:\n{1}\n\n".format(len(blocked_hashes), ", ".join(blocked_hashes)) + if len(loggedoff_users): + description += "{0} users were forced to logoff:\n{1}\n\n".format(len(loggedoff_users), ", ".join(loggedoff_users)) + if len(disabled_users): + description += "{0} user accounts were disabled:\n{1}\n\n".format(len(disabled_users), ", ".join(disabled_users)) + if len(shutdown_systems): + description += "{0} systems were shutdown:\n{1}\n\n".format(len(shutdown_systems), ", ".join(shutdown_systems)) + + parameters = [] + + # build parameters list for 'create_ticket_2' call + parameters.append({ + 'short_description': title, + 'description': description, + 'fields': "", + }) + + if parameters: + phantom.act("create ticket", parameters=parameters, assets=['servicenow'], name="create_ticket_2", parent_action=action) + else: + phantom.error("'create_ticket_2' will not be executed due to lack of parameters") + + return + +def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_2() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">", 10], + ], + name="filter_2:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + create_ticket_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + +def join_filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None): + phantom.debug('join_filter_2() called') + + # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed + if phantom.completed(action_names=['logoff_user_1', 'shutdown_system_1', 'disable_user_1', 'block_hash_3']): + + # call connected block "filter_2" + filter_2(container=container, handle=handle) + + return + +def logoff_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('logoff_user_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'logoff_user_1' call + results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'logoff_user_1' call + for results_item_1 in results_data_1: + parameters.append({ + 'username': "", + 'ip_hostname': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="logoff user", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name="logoff_user_1", parent_action=action) + + return + +def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('filter_1() called') + + # collect filtered artifact ids for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">", 5], + ["file_reputation_1:action_result.summary.positives", "<=", 10], + ], + logical_operator='and', + name="filter_1:condition_1") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + get_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + # collect filtered artifact ids for 'if' condition 2 + matched_artifacts_2, matched_results_2 = phantom.condition( + container=container, + action_results=results, + conditions=[ + ["file_reputation_1:action_result.summary.positives", ">", 10], + ], + name="filter_1:condition_2") + + # call connected blocks if filtered artifacts or results + if matched_artifacts_2 or matched_results_2: + hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2) + get_file_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2) + + return + +def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('hunt_file_2() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'hunt_file_2' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'hunt_file_2' call + for filtered_results_item_1 in filtered_results_data_1: + if filtered_results_item_1[0]: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'type': "", + 'range': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=hunt_file_2_callback, name="hunt_file_2") + + return + +def hunt_file_2_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None): + phantom.debug('hunt_file_2_callback() called') + + disable_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) + logoff_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) + shutdown_system_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) + block_hash_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function) + + return + +def get_file_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('get_file_3() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'get_file_3' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'get_file_3' call + for filtered_results_item_1 in filtered_results_data_1: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'ph_0': "", + 'offset': "", + 'get_count': "", + 'sensor_id': "", + 'file_source': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="get file", parameters=parameters, assets=['carbonblack'], name="get_file_3") + + return + +def get_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('get_file_2() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'get_file_2' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'get_file_2' call + for filtered_results_item_1 in filtered_results_data_1: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'ph_0': "", + 'offset': "", + 'get_count': "", + 'sensor_id': "", + 'file_source': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="get file", parameters=parameters, assets=['carbonblack'], name="get_file_2") + + return + +def create_ticket_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'create_ticket_2' call + + file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash', + 'file_reputation_1:filtered-action_result.summary.positives']) + blocked_hashes = set(phantom.collect2(datapath='block_hash_2:action_result.parameter.hash')) + detected_users = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.username')) + detected_systems = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.hostname')) + + title = "Virus Detected on {0} devices".format(len(detected_systems)) + + description = "Hashes sumbitted with detections:\n{0}\n\n".format(", ".join(["{0} ({1})".format(*fr) for fr in file_reputation])) + description += "File was found on {0} devices:\n{1}\n\n".format(len(detected_systems), ', '.join(detected_systems)) + description += "This impacts at least {0} users:\n{1}\n\n".format(len(detected_users), ', '.join(detected_users)) + if len(blocked_hashes): + description += "{0} hashes were submitted for blocking:\n{1}\n\n".format(len(blocked_hashes), ", ".join(blocked_hashes)) + + parameters = [] + + # build parameters list for 'create_ticket_2' call + parameters.append({ + 'short_description': title, + 'description': description, + 'fields': "", + }) + + if parameters: + phantom.act("create ticket", parameters=parameters, assets=['servicenow'], name="create_ticket_3", parent_action=action) + else: + phantom.error("'create_ticket_3' will not be executed due to lack of parameters") + + return + +def disable_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('disable_user_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'disable_user_1' call + results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.username', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results) + + parameters = [] + + # build parameters list for 'disable_user_1' call + for results_item_1 in results_data_1: + if results_item_1[0]: + parameters.append({ + 'username': results_item_1[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': results_item_1[1]}, + }) + + phantom.act(action="disable user", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name="disable_user_1", parent_action=action) + + return + +def block_hash_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_hash_3() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'block_hash_3' call + inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:artifact:*.cef.fileHash', 'hunt_file_2:artifact:*.id'], action_results=results) + + parameters = [] + + # build parameters list for 'block_hash_3' call + for inputs_item_1 in inputs_data_1: + if inputs_item_1[0]: + parameters.append({ + 'hash': inputs_item_1[0], + 'comment': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': inputs_item_1[1]}, + }) + + phantom.act(action="block hash", parameters=parameters, assets=['carbonblack'], callback=join_filter_2, name="block_hash_3", parent_action=action) + + return + +def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('hunt_file_1() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'hunt_file_1' call + filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id"]) + + parameters = [] + + # build parameters list for 'hunt_file_1' call + for filtered_results_item_1 in filtered_results_data_1: + if filtered_results_item_1[0]: + parameters.append({ + 'hash': filtered_results_item_1[0], + 'type': "binary", + 'range': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': filtered_results_item_1[1]}, + }) + + phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=block_hash_2, name="hunt_file_1") + + return + +def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('block_hash_2() called') + + #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + # collect data for 'block_hash_2' call + inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:artifact:*.cef.fileHash', 'hunt_file_1:artifact:*.id'], action_results=results) + + parameters = [] + + # build parameters list for 'block_hash_2' call + for inputs_item_1 in inputs_data_1: + if inputs_item_1[0]: + parameters.append({ + 'hash': inputs_item_1[0], + 'comment': "", + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': inputs_item_1[1]}, + }) + + phantom.act(action="block hash", parameters=parameters, assets=['carbonblack'], callback=filter_3, name="block_hash_2", parent_action=action) + + return + +def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs): + phantom.debug('file_reputation_1() called') + + # collect data for 'file_reputation_1' call + container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id']) + + parameters = [] + + # build parameters list for 'file_reputation_1' call + for container_item in container_data: + if container_item[0]: + parameters.append({ + 'hash': container_item[0], + # context (artifact id) is added to associate results with the artifact + 'context': {'artifact_id': container_item[1]}, + }) + + phantom.act(action="file reputation", parameters=parameters, assets=['virustotal'], callback=filter_1, name="file_reputation_1") + + return + +def on_finish(container, summary): + phantom.debug('on_finish() called') + # This function is called after all actions are completed. + # summary of all the action and/or all details of actions + # can be collected here. + + # summary_json = phantom.get_summary() + # if 'result' in summary_json: + # for action_result in summary_json['result']: + # if 'action_run_id' in action_result: + # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False) + # phantom.debug(action_results) + + return \ No newline at end of file diff --git a/playbooks/malware_hunt_and_contain.yml b/playbooks/malware_hunt_and_contain.yml new file mode 100644 index 0000000000..fda6970320 --- /dev/null +++ b/playbooks/malware_hunt_and_contain.yml @@ -0,0 +1,22 @@ +name: Malware Hunt and Contain +id: fb3edc76-ff2b-43c0-5f6f-63da4483fd63 +version: 1 +date: '2021-01-21' +author: Philip Royer, Splunk +type: Response +description: This playbook investigates and remediates malware infections on the endpoint. +playbook: malware_hunt_and_contain +how_to_implement: "Be sure to update asset naming to reflect the asset names configured in your environment." +references: [] +app_list: +- "LDAP" +- "ServiceNow" +- "CarbonBlack Response" +- "VirusTotal" +tags: + platform_tags: + - Response + playbook_fields: + - fileHash + product: + - Splunk SOAR \ No newline at end of file diff --git a/tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml b/tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml new file mode 100644 index 0000000000..c06a3b15a4 --- /dev/null +++ b/tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml @@ -0,0 +1,12 @@ +name: MSI Module Loaded by Non-System Binary Unit Test +tests: +- name: MSI Module Loaded by Non-System Binary + file: endpoint/msi_module_loaded_by_non_system_binary.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/msi_module_load/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_dism_remove_defender.test.yml b/tests/endpoint/windows_dism_remove_defender.test.yml new file mode 100644 index 0000000000..9f090a3664 --- /dev/null +++ b/tests/endpoint/windows_dism_remove_defender.test.yml @@ -0,0 +1,12 @@ +name: Windows DISM Remove Defender Unit Test +tests: +- name: Windows DISM Remove Defender + file: endpoint/windows_dism_remove_defender.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_dism.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml b/tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml new file mode 100644 index 0000000000..849361ab9d --- /dev/null +++ b/tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml @@ -0,0 +1,12 @@ +name: Windows Raccine Scheduled Task Deletion Unit Test +tests: +- name: Windows Raccine Scheduled Task Deletion + file: endpoint/windows_raccine_scheduled_task_deletion.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_raccine.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file