{ "blockly": false, "blockly_xml": "", "category": "Identifier Activity Analysis", "coa": { "data": { "description": "Accepts a file_hash, domain name, URL, or IP Address, and asks Splunk for a list of devices and users that have interacted with each. It then produces a normalized output and summary table. Defaults to -30d searches.", "edges": [ { "id": "port_0_to_port_2", "sourceNode": "0", "sourcePort": "0_out", "targetNode": "2", "targetPort": "2_in" }, { "conditions": [ { "index": 1 } ], "id": "port_2_to_port_4", "sourceNode": "2", "sourcePort": "2_out", "targetNode": "4", "targetPort": "4_in" }, { "conditions": [ { "index": 2 } ], "id": "port_2_to_port_5", "sourceNode": "2", "sourcePort": "2_out", "targetNode": "5", "targetPort": "5_in" }, { "conditions": [ { "index": 3 } ], "id": "port_2_to_port_6", "sourceNode": "2", "sourcePort": "2_out", "targetNode": "6", "targetPort": "6_in" }, { "id": "port_3_to_port_8", "sourceNode": "3", "sourcePort": "3_out", "targetNode": "8", "targetPort": "8_in" }, { "id": "port_4_to_port_9", "sourceNode": "4", "sourcePort": "4_out", "targetNode": "9", "targetPort": "9_in" }, { "id": "port_5_to_port_10", "sourceNode": "5", "sourcePort": "5_out", "targetNode": "10", "targetPort": "10_in" }, { "id": "port_6_to_port_11", "sourceNode": "6", "sourcePort": "6_out", "targetNode": "11", "targetPort": "11_in" }, { "id": "port_8_to_port_12", "sourceNode": "8", "sourcePort": "8_out", "targetNode": "12", "targetPort": "12_in" }, { "id": "port_9_to_port_13", "sourceNode": "9", "sourcePort": "9_out", "targetNode": "13", "targetPort": "13_in" }, { "id": "port_10_to_port_14", "sourceNode": "10", "sourcePort": "10_out", "targetNode": "14", "targetPort": "14_in" }, { "id": "port_11_to_port_15", "sourceNode": "11", "sourcePort": "11_out", "targetNode": "15", "targetPort": "15_in" }, { "conditions": [ { "index": 0 } ], "id": "port_12_to_port_16", "sourceNode": "12", "sourcePort": "12_out", "targetNode": "16", "targetPort": "16_in" }, { "conditions": [ { "index": 0 } ], "id": "port_13_to_port_17", "sourceNode": "13", "sourcePort": "13_out", "targetNode": "17", "targetPort": "17_in" }, { "conditions": [ { "index": 0 } ], "id": "port_14_to_port_18", "sourceNode": "14", "sourcePort": "14_out", "targetNode": "18", "targetPort": "18_in" }, { "conditions": [ { "index": 0 } ], "id": "port_15_to_port_19", "sourceNode": "15", "sourcePort": "15_out", "targetNode": "19", "targetPort": "19_in" }, { "id": "port_16_to_port_20", "sourceNode": "16", "sourcePort": "16_out", "targetNode": "20", "targetPort": "20_in" }, { "id": "port_17_to_port_21", "sourceNode": "17", "sourcePort": "17_out", "targetNode": "21", "targetPort": "21_in" }, { "id": "port_18_to_port_22", "sourceNode": "18", "sourcePort": "18_out", "targetNode": "22", "targetPort": "22_in" }, { "id": "port_19_to_port_23", "sourceNode": "19", "sourcePort": "19_out", "targetNode": "23", "targetPort": "23_in" }, { "id": "port_20_to_port_1", "sourceNode": "20", "sourcePort": "20_out", "targetNode": "1", "targetPort": "1_in" }, { "id": "port_21_to_port_1", "sourceNode": "21", "sourcePort": "21_out", "targetNode": "1", "targetPort": "1_in" }, { "id": "port_22_to_port_1", "sourceNode": "22", "sourcePort": "22_out", "targetNode": "1", "targetPort": "1_in" }, { "id": "port_23_to_port_1", "sourceNode": "23", "sourcePort": "23_out", "targetNode": "1", "targetPort": "1_in" }, { "conditions": [ { "index": 0 } ], "id": "port_2_to_port_24", "sourceNode": "2", "sourcePort": "2_out", "targetNode": "24", "targetPort": "24_in" }, { "id": "port_24_to_port_3", "sourceNode": "24", "sourcePort": "24_out", "targetNode": "3", "targetPort": "3_in" } ], "hash": "0604d756765c915ea237e4795b7e394632189f1d", "nodes": { "0": { "data": { "advanced": { "join": [] }, "functionName": "on_start", "id": "0", "type": "start" }, "errors": {}, "id": "0", "type": "start", "warnings": {}, "x": 530, "y": -6.394884621840902e-14 }, "1": { "data": { "advanced": { "join": [] }, "functionName": "on_finish", "id": "1", "type": "end" }, "errors": {}, "id": "1", "type": "end", "warnings": {}, "x": 530, "y": 1398 }, "10": { "data": { "action": "run query", "actionType": "investigate", "advanced": { "customName": "run domain query", "customNameId": 0, "description": "May need to change search command dependent on your format block", "join": [], "note": "Splunk query execution" }, "connector": "Splunk", "connectorConfigs": [ "splunk" ], "connectorId": "91883aa8-9c81-470b-97a1-5d8f7995f560", "connectorVersion": "v1", "functionId": 3, "functionName": "run_domain_query", "id": "10", "parameters": { "command": "tstats", "query": "build_domain_query:formatted_data", "search_mode": "smart", "start_time": "-30d" }, "requiredParameters": [ { "data_type": "string", "field": "query" }, { "data_type": "string", "default": "search", "field": "command" }, { "data_type": "string", "default": "smart", "field": "search_mode" } ], "type": "action" }, "errors": {}, "id": "10", "type": "action", "warnings": {}, "x": 680, "y": 684 }, "11": { "data": { "action": "run query", "actionType": "investigate", "advanced": { "customName": "run IP query", "customNameId": 0, "description": "May need to change search command dependent on your format block", "join": [], "note": "Splunk query execution" }, "connector": "Splunk", "connectorConfigs": [ "splunk" ], "connectorId": "91883aa8-9c81-470b-97a1-5d8f7995f560", "connectorVersion": "v1", "functionId": 4, "functionName": "run_ip_query", "id": "11", "parameters": { "command": "tstats", "display": "src, src_asset_id, src_dns, src_ip", "query": "build_ip_query:formatted_data", "search_mode": "smart", "start_time": "-30d" }, "requiredParameters": [ { "data_type": "string", "field": "query" }, { "data_type": "string", "default": "search", "field": "command" }, { "data_type": "string", "default": "smart", "field": "search_mode" } ], "type": "action" }, "errors": {}, "id": "11", "type": "action", "warnings": {}, "x": 1020, "y": 684 }, "12": { "data": { "advanced": { "customName": "filter URL query", "customNameId": 0, "delimiter": ",", "delimiter_enabled": true, "join": [], "note": "only proceed when there are results" }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": ">", "param": "run_url_query:action_result.summary.total_events", "value": "0" } ], "conditionIndex": 0, "customName": "Results", "logic": "and" } ], "functionId": 2, "functionName": "filter_url_query", "id": "12", "type": "filter" }, "errors": {}, "id": "12", "type": "filter", "warnings": {}, "x": 60, "y": 862 }, "13": { "data": { "advanced": { "customName": "filter file query", "customNameId": 0, "delimiter": ",", "delimiter_enabled": true, "join": [], "note": "only proceed when there are results" }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": ">", "param": "run_file_query:action_result.summary.total_events", "value": "0" } ], "conditionIndex": 0, "customName": "Results", "logic": "and" } ], "functionId": 3, "functionName": "filter_file_query", "id": "13", "type": "filter" }, "errors": {}, "id": "13", "type": "filter", "warnings": {}, "x": 400, "y": 862 }, "14": { "data": { "advanced": { "customName": "filter domain query", "customNameId": 0, "delimiter": ",", "delimiter_enabled": true, "join": [], "note": "only proceed when there are results" }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": ">", "param": "run_domain_query:action_result.summary.total_events", "value": "0" } ], "conditionIndex": 0, "customName": "Results", "logic": "and" } ], "functionId": 4, "functionName": "filter_domain_query", "id": "14", "type": "filter" }, "errors": {}, "id": "14", "type": "filter", "warnings": {}, "x": 740, "y": 862 }, "15": { "data": { "advanced": { "customName": "filter IP query", "customNameId": 0, "delimiter": ",", "delimiter_enabled": true, "join": [], "note": "only proceed when there are results" }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": ">", "param": "run_ip_query:action_result.summary.total_events", "value": "0" } ], "conditionIndex": 0, "customName": "Results", "logic": "and" } ], "functionId": 5, "functionName": "filter_ip_query", "id": "15", "type": "filter" }, "errors": {}, "id": "15", "type": "filter", "warnings": {}, "x": 1080, "y": 862 }, "16": { "data": { "advanced": { "customName": "format URL report", "customNameId": 0, "description": "Markdown report used in calling playbook", "drop_none": true, "join": [], "note": "Markdown report output" }, "functionId": 5, "functionName": "format_url_report", "id": "16", "parameters": [ "filtered-data:input_filter:condition_1:playbook_input:url", "filtered-data:filter_url_query:condition_1:run_url_query:action_result.data.*.src_dns", "filtered-data:filter_url_query:condition_1:run_url_query:action_result.data.*.src_ip", "filtered-data:filter_url_query:condition_1:run_url_query:action_result.data.*.src_asset_id", "filtered-data:filter_url_query:condition_1:run_url_query:action_result.data.*.user" ], "template": "SOAR searched for occurrences of `{0}` within your environment using Splunk. The table below shows a summary of the information gathered.\n\n| URL | Computer | IP Address | Asset ID | User | Source |\n| --- | --- | --- | --- | --- | --- |\n%%\n| `{0}` | {1} | {2} | {3} | {4} | Splunk |\n%%", "type": "format" }, "errors": {}, "id": "16", "type": "format", "warnings": {}, "x": 0, "y": 1042 }, "17": { "data": { "advanced": { "customName": "format file report", "customNameId": 0, "description": "Markdown report used in calling playbook", "drop_none": true, "join": [], "note": "Markdown report output" }, "functionId": 6, "functionName": "format_file_report", "id": "17", "parameters": [ "filtered-data:input_filter:condition_2:playbook_input:file", "filtered-data:filter_file_query:condition_1:run_file_query:action_result.data.*.dest_dns", "filtered-data:filter_file_query:condition_1:run_file_query:action_result.data.*.dest_ip", "filtered-data:filter_file_query:condition_1:run_file_query:action_result.data.*.dest_asset_id", "filtered-data:filter_file_query:condition_1:run_file_query:action_result.data.*.user", "filtered-data:filter_file_query:condition_1:run_file_query:action_result.data.*.process_name" ], "template": "SOAR searched for occurrences of `{0}` within your environment using Splunk. The table below shows a summary of the information gathered.\n\n| File | Process Name | Computer | IP Address | Asset ID | User | Source |\n| --- | --- | --- | --- | --- | --- | --- |\n%%\n| `{0}` | {5} | {1} | {2} | {3} | {4} | Splunk |\n%%", "type": "format" }, "errors": {}, "id": "17", "type": "format", "warnings": {}, "x": 340, "y": 1042 }, "18": { "data": { "advanced": { "customName": "format domain report", "customNameId": 0, "description": "Markdown report used in calling playbook", "drop_none": true, "join": [], "note": "Markdown report output" }, "functionId": 7, "functionName": "format_domain_report", "id": "18", "parameters": [ "filtered-data:input_filter:condition_3:playbook_input:domain", "filtered-data:filter_domain_query:condition_1:run_domain_query:action_result.data.*.src_dns", "filtered-data:filter_domain_query:condition_1:run_domain_query:action_result.data.*.src_ip", "filtered-data:filter_domain_query:condition_1:run_domain_query:action_result.data.*.src_asset_id", "filtered-data:filter_domain_query:condition_1:run_domain_query:action_result.data.*.src_user" ], "template": "SOAR searched for occurrences of `{0}` within your environment using Splunk. The table below shows a summary of the information gathered.\n\n| Domain | Computer | IP Address | Asset ID | User | Source |\n| --- | --- | --- | --- | --- | --- |\n%%\n| `{0}` | {1} | {2} | {3} | {4} | Splunk |\n%%", "type": "format" }, "errors": {}, "id": "18", "type": "format", "warnings": {}, "x": 680, "y": 1042 }, "19": { "data": { "advanced": { "customName": "format ip report", "customNameId": 0, "description": "Markdown report used in calling playbook", "drop_none": true, "join": [], "note": "Markdown report output" }, "functionId": 8, "functionName": "format_ip_report", "id": "19", "parameters": [ "filtered-data:input_filter:condition_4:playbook_input:ip", "filtered-data:filter_ip_query:condition_1:run_ip_query:action_result.data.*.src_dns", "filtered-data:filter_ip_query:condition_1:run_ip_query:action_result.data.*.src_ip", "filtered-data:filter_ip_query:condition_1:run_ip_query:action_result.data.*.src_asset_id", "filtered-data:filter_ip_query:condition_1:run_ip_query:action_result.data.*.user" ], "template": "SOAR searched for occurrences of `{0}` within your environment using Splunk. The table below shows a summary of the information gathered.\n\n| IP | Computer | IP Address | Asset ID | User | Source |\n| --- | --- | --- | --- | --- | --- |\n%%\n| `{0}` | {1} | {2} | {3} | {4} | Splunk |\n%%", "type": "format" }, "errors": {}, "id": "19", "type": "format", "warnings": {}, "x": 1020, "y": 1042 }, "2": { "data": { "advanced": { "customName": "input filter", "customNameId": 0, "delimiter": ",", "delimiter_enabled": true, "join": [], "note": "Routing paths by indicator type" }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "!=", "param": "playbook_input:url", "value": "None" } ], "conditionIndex": 0, "customName": "url", "logic": "and" }, { "comparisons": [ { "conditionIndex": 1, "op": "!=", "param": "playbook_input:file", "value": "None" } ], "conditionIndex": 1, "customName": "file", "logic": "and" }, { "comparisons": [ { "conditionIndex": 2, "op": "!=", "param": "playbook_input:domain", "value": "None" } ], "conditionIndex": 2, "customName": "domain", "logic": "and" }, { "comparisons": [ { "conditionIndex": 3, "op": "!=", "param": "playbook_input:ip", "value": "None" } ], "conditionIndex": 3, "customName": "ip", "logic": "and" } ], "functionId": 1, "functionName": "input_filter", "id": "2", "type": "filter" }, "errors": {}, "id": "2", "type": "filter", "warnings": {}, "x": 580, "y": 300 }, "20": { "data": { "advanced": { "customName": "build URL output", "customNameId": 0, "description": "Observable object expected by calling playbook", "join": [], "note": "Observable output" }, "functionId": 1, "functionName": "build_url_output", "id": "20", "inputParameters": [ "filtered-data:filter_url_query:condition_1:run_url_query:action_result.data.*.url", "filtered-data:filter_url_query:condition_1:run_url_query:action_result.data.*.src_dns", "filtered-data:filter_url_query:condition_1:run_url_query:action_result.data.*.src_ip", "filtered-data:filter_url_query:condition_1:run_url_query:action_result.data.*.src_asset_id", "filtered-data:filter_url_query:condition_1:run_url_query:action_result.data.*.user" ], "outputVariables": [ "observable_array" ], "type": "code" }, "errors": {}, "id": "20", "type": "code", "userCode": "\n # Init variables + convenience naming\n build_url_output__observable_array = []\n observable_dict = {}\n \n # Build device list\n for indicator, dns, ip, asset_id, user in zip(filtered_result_0_data___url, filtered_result_0_data___src_dns, filtered_result_0_data___src_ip, filtered_result_0_data___src_asset_id, filtered_result_0_data___user): \n \n device = {\n \"name\": dns,\n \"id\": asset_id, \n \"ip_address\": ip,\n \"operating_system\": \"Unknown\",\n \"user\": user\n }\n\n # Drop devices from list if we don't know anything about them\n if device.get(\"name\") == \"Unknown\" and device.get(\"id\") == \"Unknown\" and device.get(\"ip_address\") == \"Unknown\" and device.get(\"user\") == \"Unknown\":\n continue\n\n # Add to or update observable_dict\n if observable_dict.get('indicator'):\n observable_dict['identifier_activity'].append(device)\n else:\n observable_dict[indicator] ={\n \"value\": indicator,\n \"type\": \"url\",\n \"source\": \"Splunk\",\n \"identifier_activity\": [device]\n }\n\n for key in observable_dict.keys():\n observable_dict[key]['total_count'] = len(observable_dict[key]['identifier_activity'])\n build_url_output__observable_array.append(observable_dict[key])\n\n", "warnings": {}, "x": 0, "y": 1220 }, "21": { "data": { "advanced": { "customName": "build file output", "customNameId": 0, "description": "Observable object expected by calling playbook", "join": [], "note": "Observable output" }, "functionId": 2, "functionName": "build_file_output", "id": "21", "inputParameters": [ "filtered-data:filter_file_query:condition_1:run_file_query:action_result.data.*.process_hash", "filtered-data:filter_file_query:condition_1:run_file_query:action_result.data.*.dest_dns", "filtered-data:filter_file_query:condition_1:run_file_query:action_result.data.*.dest_ip", "filtered-data:filter_file_query:condition_1:run_file_query:action_result.data.*.dest_asset_id", "filtered-data:filter_file_query:condition_1:run_file_query:action_result.data.*.user" ], "outputVariables": [ "observable_array" ], "type": "code" }, "errors": {}, "id": "21", "type": "code", "userCode": "\n \n # Init variables + convenience naming\n build_file_output__observable_array = []\n observable_dict = {}\n \n # Build device list\n for indicator, dns, ip, asset_id, user in zip(filtered_result_0_data___process_hash, filtered_result_0_data___dest_dns, filtered_result_0_data___dest_ip, filtered_result_0_data___dest_asset_id, filtered_result_0_data___user): \n \n device = {\n \"name\": dns,\n \"id\": asset_id, \n \"ip_address\": ip,\n \"operating_system\": \"Unknown\",\n \"user\": user\n }\n\n # Drop devices from list if we don't know anything about them\n if device.get(\"name\") == \"Unknown\" and device.get(\"id\") == \"Unknown\" and device.get(\"ip_address\") == \"Unknown\" and device.get(\"user\") == \"Unknown\":\n continue\n\n # Add to or update observable_dict\n if observable_dict.get('indicator'):\n observable_dict['identifier_activity'].append(device)\n else:\n observable_dict[indicator] ={\n \"value\": indicator,\n \"type\": \"hash\",\n \"source\": \"Splunk\",\n \"identifier_activity\": [device]\n }\n\n for key in observable_dict.keys():\n observable_dict[key]['total_count'] = len(observable_dict[key]['identifier_activity'])\n build_file_output__observable_array.append(observable_dict[key])\n\n", "warnings": {}, "x": 340, "y": 1220 }, "22": { "data": { "advanced": { "customName": "build domain output", "customNameId": 0, "description": "Observable object expected by calling playbook", "join": [], "note": "Observable output" }, "functionId": 3, "functionName": "build_domain_output", "id": "22", "inputParameters": [ "filtered-data:filter_domain_query:condition_1:run_domain_query:action_result.data.*.query", "filtered-data:filter_domain_query:condition_1:run_domain_query:action_result.data.*.src_dns", "filtered-data:filter_domain_query:condition_1:run_domain_query:action_result.data.*.src_ip", "filtered-data:filter_domain_query:condition_1:run_domain_query:action_result.data.*.src_asset_id", "filtered-data:filter_domain_query:condition_1:run_domain_query:action_result.data.*.src_user" ], "outputVariables": [ "observable_array" ], "type": "code" }, "errors": {}, "id": "22", "type": "code", "userCode": "\n # Init variables + convenience naming\n build_domain_output__observable_array = []\n observable_dict = {}\n \n # Build device list\n for indicator, dns, ip, asset_id, user in zip(filtered_result_0_data___query, filtered_result_0_data___src_dns, filtered_result_0_data___src_ip, filtered_result_0_data___src_asset_id, filtered_result_0_data___src_user): \n \n device = {\n \"name\": dns,\n \"id\": asset_id, \n \"ip_address\": ip,\n \"operating_system\": \"Unknown\",\n \"user\": user\n }\n\n # Drop devices from list if we don't know anything about them\n if device.get(\"name\") == \"Unknown\" and device.get(\"id\") == \"Unknown\" and device.get(\"ip_address\") == \"Unknown\" and device.get(\"user\") == \"Unknown\":\n continue\n\n # Add to or update observable_dict\n if observable_dict.get('indicator'):\n observable_dict['identifier_activity'].append(device)\n else:\n observable_dict[indicator] ={\n \"value\": indicator,\n \"type\": \"url\",\n \"source\": \"Splunk\",\n \"identifier_activity\": [device]\n }\n\n for key in observable_dict.keys():\n observable_dict[key]['total_count'] = len(observable_dict[key]['identifier_activity'])\n build_domain_output__observable_array.append(observable_dict[key])\n \n", "warnings": {}, "x": 680, "y": 1220 }, "23": { "data": { "advanced": { "customName": "build ip output", "customNameId": 0, "description": "Observable object expected by calling playbook", "join": [], "note": "Observable output" }, "functionId": 4, "functionName": "build_ip_output", "id": "23", "inputParameters": [ "filtered-data:filter_ip_query:condition_1:run_ip_query:action_result.data.*.dest_ip", "filtered-data:filter_ip_query:condition_1:run_ip_query:action_result.data.*.src_dns", "filtered-data:filter_ip_query:condition_1:run_ip_query:action_result.data.*.src_ip", "filtered-data:filter_ip_query:condition_1:run_ip_query:action_result.data.*.src_asset_id", "filtered-data:filter_ip_query:condition_1:run_ip_query:action_result.data.*.user" ], "outputVariables": [ "observable_array" ], "type": "code" }, "errors": {}, "id": "23", "type": "code", "userCode": " \n # Init variables + convenience naming\n build_ip_output__observable_array = []\n observable_dict = {}\n\n # Build device list\n for indicator, dns, ip, asset_id, user in zip(filtered_result_0_data___dest_ip, filtered_result_0_data___src_dns, filtered_result_0_data___src_ip, filtered_result_0_data___src_asset_id, filtered_result_0_data___user): \n \n device = {\n \"name\": dns,\n \"id\": asset_id, \n \"ip_address\": ip,\n \"operating_system\": \"Unknown\",\n \"user\": user\n }\n\n # Drop devices from list if we don't know anything about them\n if device.get(\"name\") == \"Unknown\" and device.get(\"id\") == \"Unknown\" and device.get(\"ip_address\") == \"Unknown\" and device.get(\"user\") == \"Unknown\":\n continue\n\n # Add to or update observable_dict\n if observable_dict.get('indicator'):\n observable_dict['identifier_activity'].append(device)\n else:\n observable_dict[indicator] ={\n \"value\": indicator,\n \"type\": \"url\",\n \"source\": \"Splunk\",\n \"identifier_activity\": [device]\n }\n\n for key in observable_dict.keys():\n observable_dict[key]['total_count'] = len(observable_dict[key]['identifier_activity'])\n build_ip_output__observable_array.append(observable_dict[key])\n \n", "warnings": {}, "x": 1020, "y": 1220 }, "24": { "data": { "advanced": { "customName": "parse url", "customNameId": 0, "description": "", "join": [], "note": "Parse URL into its components." }, "customFunction": { "draftMode": false, "name": "url_parse", "repoName": "community" }, "functionId": 1, "functionName": "parse_url", "id": "24", "selectMore": false, "type": "utility", "utilities": { "url_parse": { "description": "Separate a URL into its components using urlparse() from the urllib module of Python 3.", "fields": [ { "dataTypes": [ "url" ], "description": "The URL to parse", "inputType": "item", "label": "input_url", "name": "input_url", "placeholder": "artifact:*.cef.requestUrl", "renderType": "datapath", "required": false } ], "label": "url_parse", "name": "url_parse" } }, "utilityType": "custom_function", "values": { "url_parse": { "input_url": "playbook_input:url" } } }, "errors": {}, "id": "24", "type": "utility", "warnings": {}, "x": 0, "y": 328 }, "3": { "data": { "advanced": { "customName": "build URL query", "customNameId": 0, "description": "Query may need editing to reflect your splunk environment", "join": [], "note": "Splunk query template" }, "functionId": 1, "functionName": "build_url_query", "id": "3", "parameters": [ "parse_url:custom_function_result.data.netloc", "parse_url:custom_function_result.data.path" ], "template": "count fillnull_value=\"Unknown\" from datamodel=Web.Web where Web.url IN (\n%%\n\"*{0}{1}*\" \n%%\n) by Web.src Web.user Web.url | `drop_dm_object_name(\"Web\")` | `get_asset(src)` | fields url, src, src_asset_id, src_dns, src_ip, user | fillnull value=\"Unknown\"", "type": "format" }, "errors": {}, "id": "3", "type": "format", "warnings": {}, "x": 0, "y": 506 }, "4": { "data": { "advanced": { "customName": "build file query", "customNameId": 0, "description": "Query may need editing to reflect your splunk environment", "join": [], "note": "Splunk query template" }, "functionId": 2, "functionName": "build_file_query", "id": "4", "parameters": [ "filtered-data:input_filter:condition_2:playbook_input:file" ], "template": "count fillnull_value=\"Unknown\" values(Processes.process_name) as process_name from datamodel=Endpoint.Processes where (Processes.process_hash IN (\n%%\n\"{0}\" \n%%\n) OR Processes.process_hash IN (\n%%\n\"*{0}*\" \n%%\n)) by Processes.dest Processes.user Processes.process_hash | `drop_dm_object_name(\"Processes\")` | `get_asset(dest)` | fields process_hash, process_name, dest, dest_asset_id, dest_dns, dest_ip, user | fillnull value=\"Unknown\"", "type": "format" }, "errors": {}, "id": "4", "type": "format", "warnings": {}, "x": 340, "y": 500 }, "5": { "data": { "advanced": { "customName": "build domain query", "customNameId": 0, "description": "Query may need editing to reflect your splunk environment", "join": [], "note": "Splunk query template" }, "functionId": 3, "functionName": "build_domain_query", "id": "5", "parameters": [ "filtered-data:input_filter:condition_3:playbook_input:domain" ], "template": "count from datamodel=Network_Resolution where DNS.query IN (\n%%\n\"{0}\" \n%%\n) by DNS.src DNS.query | `drop_dm_object_name(\"DNS\")` | `get_asset(src)` | fields query, src, src_asset_id, src_dns, src_ip, src_owner |rename src_owner as src_user | fillnull value=\"Unknown\"", "type": "format" }, "errors": {}, "id": "5", "type": "format", "warnings": {}, "x": 680, "y": 506 }, "6": { "data": { "advanced": { "customName": "build IP query", "customNameId": 0, "description": "Query may need editing to reflect your splunk environment", "join": [], "note": "Splunk query template" }, "functionId": 4, "functionName": "build_ip_query", "id": "6", "parameters": [ "filtered-data:input_filter:condition_4:playbook_input:ip" ], "template": "count fillnull_value=\"Unknown\" from datamodel=Network_Traffic where All_Traffic.dest_ip IN (\n%%\n\"{0}\" \n%%\n) by All_Traffic.src All_Traffic.user All_Traffic.dest_ip | `drop_dm_object_name(\"All_Traffic\")` | `get_asset(src)` | fields src, src_asset_id, src_dns, src_ip, dest_ip, user | fillnull value=\"Unknown\"", "type": "format" }, "errors": {}, "id": "6", "type": "format", "warnings": {}, "x": 1020, "y": 506 }, "8": { "data": { "action": "run query", "actionType": "investigate", "advanced": { "customName": "run URL query", "customNameId": 0, "description": "May need to change search command dependent on your format block", "join": [], "note": "Splunk query execution" }, "connector": "Splunk", "connectorConfigs": [ "splunk" ], "connectorId": "91883aa8-9c81-470b-97a1-5d8f7995f560", "connectorVersion": "v1", "functionId": 1, "functionName": "run_url_query", "id": "8", "parameters": { "command": "tstats", "query": "build_url_query:formatted_data", "search_mode": "smart", "start_time": "-30d" }, "requiredParameters": [ { "data_type": "string", "field": "query" }, { "data_type": "string", "default": "search", "field": "command" }, { "data_type": "string", "default": "smart", "field": "search_mode" } ], "type": "action" }, "errors": {}, "id": "8", "type": "action", "warnings": {}, "x": 0, "y": 684 }, "9": { "data": { "action": "run query", "actionType": "investigate", "advanced": { "customName": "run file query", "customNameId": 0, "description": "May need to change search command dependent on your format block", "join": [], "note": "Splunk query execution" }, "connector": "Splunk", "connectorConfigs": [ "splunk" ], "connectorId": "91883aa8-9c81-470b-97a1-5d8f7995f560", "connectorVersion": "v1", "functionId": 2, "functionName": "run_file_query", "id": "9", "parameters": { "command": "tstats", "query": "build_file_query:formatted_data", "search_mode": "smart", "start_time": "-30d" }, "requiredParameters": [ { "data_type": "string", "field": "query" }, { "data_type": "string", "default": "search", "field": "command" }, { "data_type": "string", "default": "smart", "field": "search_mode" } ], "type": "action" }, "errors": {}, "id": "9", "type": "action", "warnings": {}, "x": 340, "y": 684 } }, "notes": "Inputs: file_hash, domain, url, ip_address\nInteractions: Splunk\nActions: run_query\nOutputs: observable, markdown report" }, "input_spec": [ { "contains": [ "url" ], "description": "A URL to look for within your events in Splunk", "name": "url" }, { "contains": [ "hash" ], "description": "A file hash to look for within your events in Splunk", "name": "file" }, { "contains": [ "domain" ], "description": "A domain name to look for within your events in Splunk", "name": "domain" }, { "contains": [ "ip" ], "description": "An IP Address to look for within your events in Splunk", "name": "ip" } ], "output_spec": [ { "contains": [], "datapaths": [ "build_url_output:custom_function:observable_array", "build_domain_output:custom_function:observable_array", "build_ip_output:custom_function:observable_array", "build_file_output:custom_function:observable_array" ], "deduplicate": false, "description": "An array of Observable objects ", "metadata": {}, "name": "observable" }, { "contains": [], "datapaths": [ "format_url_report:formatted_data", "format_file_report:formatted_data", "format_domain_report:formatted_data", "format_ip_report:formatted_data" ], "deduplicate": false, "description": "An array of markdown reports", "metadata": {}, "name": "markdown_report" } ], "playbook_type": "data", "python_version": "3.13", "schema": "5.0.10", "version": "6.1.1.211" }, "create_time": "2023-12-21T15:17:45.576110+00:00", "draft_mode": false, "labels": [ "*" ], "tags": [ "domain", "url", "ip", "file_hash", "splunk", "identifier_activity", "D3-IAA" ] }