mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
ljstella
795 lines
50 KiB
JSON
795 lines
50 KiB
JSON
{
|
|
"blockly": false,
|
|
"blockly_xml": "<xml></xml>",
|
|
"category": "Enrichment",
|
|
"coa": {
|
|
"data": {
|
|
"description": "Accepts a hostname or device id as input and collects running processes, network connections and various system information from the device via Crowdstrike. We then generate an observable report for each. This can be customized based on user preference.",
|
|
"edges": [
|
|
{
|
|
"id": "port_0_to_port_2",
|
|
"sourceNode": "0",
|
|
"sourcePort": "0_out",
|
|
"targetNode": "2",
|
|
"targetPort": "2_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_2_to_port_7",
|
|
"sourceNode": "2",
|
|
"sourcePort": "2_out",
|
|
"targetNode": "7",
|
|
"targetPort": "7_in"
|
|
},
|
|
{
|
|
"id": "port_7_to_port_8",
|
|
"sourceNode": "7",
|
|
"sourcePort": "7_out",
|
|
"targetNode": "8",
|
|
"targetPort": "8_in"
|
|
},
|
|
{
|
|
"id": "port_8_to_port_11",
|
|
"sourceNode": "8",
|
|
"sourcePort": "8_out",
|
|
"targetNode": "11",
|
|
"targetPort": "11_in"
|
|
},
|
|
{
|
|
"id": "port_11_to_port_12",
|
|
"sourceNode": "11",
|
|
"sourcePort": "11_out",
|
|
"targetNode": "12",
|
|
"targetPort": "12_in"
|
|
},
|
|
{
|
|
"id": "port_12_to_port_17",
|
|
"sourceNode": "12",
|
|
"sourcePort": "12_out",
|
|
"targetNode": "17",
|
|
"targetPort": "17_in"
|
|
},
|
|
{
|
|
"id": "port_11_to_port_18",
|
|
"sourceNode": "11",
|
|
"sourcePort": "11_out",
|
|
"targetNode": "18",
|
|
"targetPort": "18_in"
|
|
},
|
|
{
|
|
"id": "port_18_to_port_19",
|
|
"sourceNode": "18",
|
|
"sourcePort": "18_out",
|
|
"targetNode": "19",
|
|
"targetPort": "19_in"
|
|
},
|
|
{
|
|
"id": "port_8_to_port_20",
|
|
"sourceNode": "8",
|
|
"sourcePort": "8_out",
|
|
"targetNode": "20",
|
|
"targetPort": "20_in"
|
|
},
|
|
{
|
|
"id": "port_20_to_port_21",
|
|
"sourceNode": "20",
|
|
"sourcePort": "20_out",
|
|
"targetNode": "21",
|
|
"targetPort": "21_in"
|
|
},
|
|
{
|
|
"id": "port_21_to_port_1",
|
|
"sourceNode": "21",
|
|
"sourcePort": "21_out",
|
|
"targetNode": "1",
|
|
"targetPort": "1_in"
|
|
},
|
|
{
|
|
"id": "port_19_to_port_23",
|
|
"sourceNode": "19",
|
|
"sourcePort": "19_out",
|
|
"targetNode": "23",
|
|
"targetPort": "23_in"
|
|
},
|
|
{
|
|
"id": "port_17_to_port_23",
|
|
"sourceNode": "17",
|
|
"sourcePort": "17_out",
|
|
"targetNode": "23",
|
|
"targetPort": "23_in"
|
|
},
|
|
{
|
|
"id": "port_23_to_port_1",
|
|
"sourceNode": "23",
|
|
"sourcePort": "23_out",
|
|
"targetNode": "1",
|
|
"targetPort": "1_in"
|
|
},
|
|
{
|
|
"id": "port_11_to_port_24",
|
|
"sourceNode": "11",
|
|
"sourcePort": "11_out",
|
|
"targetNode": "24",
|
|
"targetPort": "24_in"
|
|
},
|
|
{
|
|
"id": "port_24_to_port_25",
|
|
"sourceNode": "24",
|
|
"sourcePort": "24_out",
|
|
"targetNode": "25",
|
|
"targetPort": "25_in"
|
|
},
|
|
{
|
|
"id": "port_25_to_port_23",
|
|
"sourceNode": "25",
|
|
"sourcePort": "25_out",
|
|
"targetNode": "23",
|
|
"targetPort": "23_in"
|
|
}
|
|
],
|
|
"hash": "b056d8c5001ac05e31fe03ff61e1acb72c4b9281",
|
|
"nodes": {
|
|
"0": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_start",
|
|
"id": "0",
|
|
"type": "start"
|
|
},
|
|
"errors": {},
|
|
"id": "0",
|
|
"type": "start",
|
|
"warnings": {},
|
|
"x": 360,
|
|
"y": -3.197442310920451e-13
|
|
},
|
|
"1": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_finish",
|
|
"id": "1",
|
|
"type": "end"
|
|
},
|
|
"errors": {},
|
|
"id": "1",
|
|
"type": "end",
|
|
"warnings": {},
|
|
"x": 440,
|
|
"y": 1460
|
|
},
|
|
"11": {
|
|
"data": {
|
|
"action": "create session",
|
|
"actionType": "generic",
|
|
"advanced": {
|
|
"customName": "create session",
|
|
"customNameId": 0,
|
|
"description": "Create a Real Time Response (RTR) session on CS Falcon to interact with the endpoint.",
|
|
"join": [],
|
|
"note": "Create a Real Time Response (RTR) session on CS Falcon to interact with the endpoint."
|
|
},
|
|
"connector": "CrowdStrike OAuth API",
|
|
"connectorConfigs": [
|
|
"crowdstrike_oauth_api"
|
|
],
|
|
"connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "create_session",
|
|
"id": "11",
|
|
"loop": {
|
|
"enabled": false,
|
|
"exitAfterUnit": "m",
|
|
"exitAfterValue": 10,
|
|
"exitConditionEnabled": false,
|
|
"exitLoopAfter": 2,
|
|
"pauseUnit": "m",
|
|
"pauseValue": 2
|
|
},
|
|
"parameters": {
|
|
"device_id": "query_device:action_result.data.*.device_id"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "device_id"
|
|
}
|
|
],
|
|
"tab": "byAction",
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "11",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": 170,
|
|
"y": 680
|
|
},
|
|
"12": {
|
|
"data": {
|
|
"action": "run admin command",
|
|
"actionType": "generic",
|
|
"advanced": {
|
|
"customName": "run admin command ps",
|
|
"customNameId": 0,
|
|
"description": "Gets a list of running processes on the specified endpoint.",
|
|
"join": [],
|
|
"note": "Gets a list of running processes on the specified endpoint."
|
|
},
|
|
"connector": "CrowdStrike OAuth API",
|
|
"connectorConfigs": [
|
|
"crowdstrike_oauth_api"
|
|
],
|
|
"connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "run_admin_command_ps",
|
|
"id": "12",
|
|
"loop": {
|
|
"enabled": false,
|
|
"exitAfterUnit": "m",
|
|
"exitAfterValue": 10,
|
|
"exitConditionEnabled": false,
|
|
"exitLoopAfter": 2,
|
|
"pauseUnit": "m",
|
|
"pauseValue": 2
|
|
},
|
|
"parameters": {
|
|
"command": "ps",
|
|
"device_id": "query_device:action_result.data.*.device_id",
|
|
"session_id": "create_session:action_result.data.*.resources.*.session_id"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "command"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "device_id"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "session_id"
|
|
}
|
|
],
|
|
"tab": "byAction",
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "12",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": 340,
|
|
"y": 840
|
|
},
|
|
"17": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "process process observables",
|
|
"customNameId": 0,
|
|
"description": "Format a normalized output for each process",
|
|
"join": [],
|
|
"note": "Format a normalized output for each process"
|
|
},
|
|
"functionId": 3,
|
|
"functionName": "process_process_observables",
|
|
"id": "17",
|
|
"inputParameters": [
|
|
"query_device:action_result.data.*.hostname",
|
|
"run_admin_command_ps:action_result.parameter",
|
|
"run_admin_command_ps:action_result.data",
|
|
"run_admin_command_ps:action_result.status",
|
|
"run_admin_command_ps:action_result.message"
|
|
],
|
|
"outputVariables": [
|
|
"observable_array"
|
|
],
|
|
"type": "code"
|
|
},
|
|
"errors": {},
|
|
"id": "17",
|
|
"type": "code",
|
|
"userCode": "\n import re\n process_process_observables__observable_array = []\n i = 0\n \n ################################################################################\n # This returns process information from stdout as text, with lines separated by newlines (\\n).\n # For example:\n #\n # Name Id Start Time (UTC-7) WorkingMemory(kb) CPU(s) HandleCount Path \n # ---- -- ------------------ ----------------- ------ ----------- ---- \n # conhost 2216 4/8/2025 12:14:21 PM 5,612 0.05 93 C:\\Windows\\system32\\conhost.exe \n # conhost 4192 4/8/2025 12:14:21 PM 5,620 0.03 93 C:\\Windows\\system32\\conhost.exe \n # CSFalconService 488 3/27/2025 9:05:13 AM 60,196 312.31 671 \n # csrss 672 3/11/2025 4:21:37 AM 4,476 667.27 500\n # powershell 3768 4/8/2025 12:14:21 PM 60,892 0.66 511 C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe \n # VGAuthService 2412 3/11/2025 4:21:42 AM 10,920 0.05 149 C:\\Program Files\\VMware\\VMware Tools\\VMware \n # VGAuth\\VGAuthService.exe \n # vm3dservice 2440 3/11/2025 4:21:42 AM 6,096 0.02 123 C:\\Windows\\system32\\vm3dservice.exe \n # vm3dservice 2568 3/11/2025 4:21:42 AM 6,564 0.03 110 C:\\Windows\\system32\\vm3dservice.exe \n # vm3dservice 4248 3/11/2025 4:25:31 AM 6,564 0.08 111 C:\\Windows\\system32\\vm3dservice.exe \n \n for system in run_admin_command_ps_result_item_1:\n device_id = run_admin_command_ps_result_item_0[i].get(\"device_id\")\n hostname = query_device_result_item_0[i]\n \n observable = {\n \"source\": \"Crowdstrike OAuth API\",\n \"type\": \"Endpoint\",\n \"activity_name\": \"Process Collection\",\n \"uid\": device_id,\n \"hostname\": hostname,\n \"status\": run_admin_command_ps_result_item_2[i],\n \"status_detail\": run_admin_command_ps_result_message[i],\n \"process_artifacts\": []\n }\n \n stdout = system[0][\"resources\"][0][\"stdout\"]\n \n # Skip header lines and read each one using REGEX (for lack of a better way).\n for line in stdout.split('\\n')[3:]:\n pattern = re.compile('^(?P<name>\\w+)\\s+(?P<pid>\\d+)\\s+(?P<start_time>[\\d\\/:\\s]+(AM|PM))\\s+(?P<working_memory>[\\d,]+)\\s+(?P<cpu>[\\d,\\.]+)\\s+(?P<handle_count>\\d+)\\s(?P<path>.*)$')\n matches = pattern.match(line)\n orphan_matches = pattern.match(line)\n \n if matches:\n name = matches.group('name')\n pid = matches.group('pid')\n start_time = matches.group('start_time')\n working_memory = matches.group('working_memory')\n cpu = matches.group('cpu')\n handle_count = matches.group('handle_count')\n path = matches.group('path') \n \n # Skip lines we don't care about.\n if line.strip() and name not in ['Idle','System']:\n observable['process_artifacts'].append(\n {\n \"name\": name,\n \"pid\": pid,\n \"path\": path.strip(),\n \"created_time\": start_time,\n \"xattributes\": [\n {\n \"working_memory\": working_memory,\n \"handle_count\": handle_count,\n \"cpu\": cpu\n }\n ]\n }\n )\n else:\n # Some paths are continued on the next line... fold them back into the correct observable.\n orphan_pattern = re.compile('^\\s+(?P<orphaned_path>.*?)\\s+$')\n orphan_matches = orphan_pattern.match(line)\n \n if orphan_matches:\n orphaned_path = orphan_matches.group('orphaned_path')\n previous_observable = observable['process_artifacts'][-1]\n if previous_observable:\n previous_observable[\"path\"] = previous_observable[\"path\"] + \" \" + orphaned_path\n \n \n #phantom.debug(f\"observable = {observable}\")\n process_process_observables__observable_array.append(observable)\n i+=1\n \n",
|
|
"warnings": {},
|
|
"x": 340,
|
|
"y": 1020
|
|
},
|
|
"18": {
|
|
"data": {
|
|
"action": "run admin command",
|
|
"actionType": "generic",
|
|
"advanced": {
|
|
"customName": "run admin command netstat",
|
|
"customNameId": 0,
|
|
"description": "List the open sockets & network ports on the specified endpoint.",
|
|
"join": [],
|
|
"note": "List the open sockets & network ports on the specified endpoint."
|
|
},
|
|
"connector": "CrowdStrike OAuth API",
|
|
"connectorConfigs": [
|
|
"crowdstrike_oauth_api"
|
|
],
|
|
"connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
|
|
"connectorVersion": "v1",
|
|
"functionId": 2,
|
|
"functionName": "run_admin_command_netstat",
|
|
"id": "18",
|
|
"loop": {
|
|
"enabled": false,
|
|
"exitAfterUnit": "m",
|
|
"exitAfterValue": 10,
|
|
"exitConditionEnabled": false,
|
|
"exitLoopAfter": 2,
|
|
"pauseUnit": "m",
|
|
"pauseValue": 2
|
|
},
|
|
"parameters": {
|
|
"command": "netstat",
|
|
"device_id": "query_device:action_result.data.*.device_id",
|
|
"session_id": "create_session:action_result.data.*.resources.*.session_id"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "command"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "device_id"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "session_id"
|
|
}
|
|
],
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "18",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": 0,
|
|
"y": 840
|
|
},
|
|
"19": {
|
|
"customCode": null,
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "process network observables",
|
|
"customNameId": 0,
|
|
"description": "Format a normalized output for each network connection",
|
|
"join": [],
|
|
"note": "Format a normalized output for each network connection"
|
|
},
|
|
"functionId": 4,
|
|
"functionName": "process_network_observables",
|
|
"id": "19",
|
|
"inputParameters": [
|
|
"run_admin_command_netstat:action_result.parameter.device_id",
|
|
"query_device:action_result.data.*.hostname",
|
|
"run_admin_command_netstat:action_result.status",
|
|
"run_admin_command_netstat:action_result.message",
|
|
"run_admin_command_netstat:action_result.data"
|
|
],
|
|
"outputVariables": [
|
|
"observable_array"
|
|
],
|
|
"type": "code"
|
|
},
|
|
"errors": {},
|
|
"id": "19",
|
|
"type": "code",
|
|
"userCode": "\n import re\n process_network_observables__observable_array = []\n i = 0\n \n ################################################################################\n # This returns network connection information from stdout as text, with lines separated by newlines (\\n).\n # For example:\n #\n # Proto Local Address Foreign Address State Owning Process Id Owning Process Name Process Start Time (UTC-8)\n # ----- ------------- --------------- ----- ----------------- ------------------- --------------------------\n # TCP :::49689 :::0 Listen 920 C:\\Windows\\system32\\lsass.exe 10/25/2024 10:28:22 AM \n # TCP :::49675 :::0 Listen 2060 C:\\Windows\\system32\\svchost.exe 10/25/2024 10:28:13 AM \n # TCP :::49669 :::0 Listen 2164 C:\\Windows\\System32\\spoolsv.exe 10/25/2024 10:28:13 AM \n # TCP :::49666 :::0 Listen 1056 C:\\Windows\\system32\\svchost.exe 10/25/2024 10:28:13 AM \n # TCP :::49665 :::0 Listen 1116 C:\\Windows\\System32\\svchost.exe 10/25/2024 10:28:12 AM \n # TCP :::49664 :::0 Listen 768 10/25/2024 10:28:12 AM \n # TCP :::3389 :::0 Listen 1048 C:\\Windows\\System32\\svchost.exe 10/25/2024 10:28:13 AM \n # TCP :::445 :::0 Listen 4 10/25/2024 10:28:13 AM \n # TCP :::135 :::0 Listen 352 C:\\Windows\\system32\\svchost.exe 10/25/2024 10:28:12 AM \n # TCP 0.0.0.0:58808 0.0.0.0:0 Bound 1056 C:\\Windows\\system32\\svchost.exe 11/23/2024 9:31:16 PM \n # TCP 10.1.19.4:59929 54.241.197.58:443 Established 4 2/24/2025 2:34:34 PM \n # TCP 10.1.19.4:58808 13.64.180.106:443 Established 1056 C:\\Windows\\system32\\svchost.exe 11/23/2024 9:31:16 PM \n # TCP 0.0.0.0:49689 0.0.0.0:0 Listen 920 C:\\Windows\\system32\\lsass.exe 10/25/2024 10:28:22 AM \n # TCP 0.0.0.0:49679 0.0.0.0:0 Listen 904 10/25/2024 10:28:13 AM \n # TCP 0.0.0.0:49675 0.0.0.0:0 Listen 2060 C:\\Windows\\system32\\svchost.exe 10/25/2024 10:28:13 AM \n # TCP 0.0.0.0:49669 0.0.0.0:0 Listen 2164 C:\\Windows\\System32\\spoolsv.exe 10/25/2024 10:28:13 AM \n # UDP ::1:60661 *:* Listen 5472 C:\\Windows\\system32\\svchost.exe 10/26/2024 9:03:09 AM \n # UDP fe80::9c8b:6e28:cc9:6e2e%2:60660 *:* Listen 5472 C:\\Windows\\system32\\svchost.exe 10/26/2024 9:03:09 AM \n # UDP :::5355 *:* Listen 1488 C:\\Windows\\System32\\svchost.exe 2/25/2025 6:52:43 AM \n # UDP :::5353 *:* Listen 1488 C:\\Windows\\System32\\svchost.exe 2/25/2025 6:52:43 AM \n\n for system in run_admin_command_netstat_result_item_3:\n device_id = run_admin_command_netstat_parameter_device_id[i]\n hostname = query_device_result_item_0[i]\n \n observable = {\n \"source\": \"Crowdstrike OAuth API\",\n \"type\": \"Endpoint\",\n \"activity_name\": \"Network Connections Collection\",\n \"uid\": device_id,\n \"hostname\": hostname,\n \"status\": run_admin_command_netstat_result_item_1[i],\n \"status_detail\": run_admin_command_netstat_result_message[i],\n \"network_artifacts\": []\n }\n\n phantom.debug(f\"system -> {system}\")\n \n stdout = system[0][\"resources\"][0][\"stdout\"]\n if stdout:\n # Skip header lines and read each one, extracting fields via REGEX (for lack of a better way).\n for line in stdout.split('\\n')[3:]: \n line_groups = re.search('^(\\w+)\\s+(.*?)\\s+(.*?)\\s+(\\w+)\\s+(\\d+)\\s(.*?)\\s(\\d.*?)\\s+$', line)\n \n if line_groups:\n proto = line_groups.group(1)\n local_address = line_groups.group(2)\n foreign_address = line_groups.group(3)\n state = line_groups.group(4)\n process_id = line_groups.group(5)\n process_path = line_groups.group(6)\n start_time = line_groups.group(7)\n \n observable['network_artifacts'].append(\n {\n \"protocol_name\": proto,\n \"local_address\": local_address,\n \"foreign_address\": foreign_address,\n \"state\": state,\n \"start_time\": start_time,\n \"process\": [\n {\n \"pid\": process_id,\n \"path\": process_path\n }\n ]\n }\n ) \n\n #phantom.debug(observable)\n process_network_observables__observable_array.append(observable)\n i+=1\n \n",
|
|
"warnings": {},
|
|
"x": 1.4210854715202004e-14,
|
|
"y": 1020
|
|
},
|
|
"2": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "input filter",
|
|
"customNameId": 0,
|
|
"description": "Determines if the provided inputs are present in the dataset.",
|
|
"join": [],
|
|
"note": "Determines if the provided inputs are present in the dataset."
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "playbook_input:device",
|
|
"value": ""
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "input device present",
|
|
"logic": "and"
|
|
}
|
|
],
|
|
"functionId": 1,
|
|
"functionName": "input_filter",
|
|
"id": "2",
|
|
"type": "filter"
|
|
},
|
|
"errors": {},
|
|
"id": "2",
|
|
"type": "filter",
|
|
"warnings": {},
|
|
"x": 400,
|
|
"y": 148
|
|
},
|
|
"20": {
|
|
"data": {
|
|
"action": "get system info",
|
|
"actionType": "investigate",
|
|
"advanced": {
|
|
"customName": "get system info",
|
|
"customNameId": 0,
|
|
"description": "Get information from the endpoint.",
|
|
"join": [],
|
|
"note": "Get information from the endpoint."
|
|
},
|
|
"connector": "CrowdStrike OAuth API",
|
|
"connectorConfigs": [
|
|
"crowdstrike_oauth_api"
|
|
],
|
|
"connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "get_system_info",
|
|
"id": "20",
|
|
"loop": {
|
|
"enabled": false,
|
|
"exitAfterUnit": "m",
|
|
"exitAfterValue": 10,
|
|
"exitConditionEnabled": false,
|
|
"exitLoopAfter": 2,
|
|
"pauseUnit": "m",
|
|
"pauseValue": 2
|
|
},
|
|
"parameters": {
|
|
"id": "query_device:action_result.data.*.device_id"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "id"
|
|
}
|
|
],
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "20",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": 680,
|
|
"y": 680
|
|
},
|
|
"21": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "process system observables",
|
|
"customNameId": 0,
|
|
"description": "Format a normalized output for the endpoint.",
|
|
"join": [],
|
|
"note": "Format a normalized output for the endpoint."
|
|
},
|
|
"functionId": 2,
|
|
"functionName": "process_system_observables",
|
|
"id": "21",
|
|
"inputParameters": [
|
|
"get_system_info:action_result.status",
|
|
"get_system_info:action_result.message",
|
|
"get_system_info:action_result.data"
|
|
],
|
|
"outputVariables": [
|
|
"observable_array"
|
|
],
|
|
"type": "code"
|
|
},
|
|
"errors": {},
|
|
"id": "21",
|
|
"type": "code",
|
|
"userCode": " process_system_observables__observable_array = []\n i = 0\n \n for system in get_system_info_result_item_2:\n data = system[0]\n if data:\n observable = {\n \"source\": \"Crowdstrike OAuth API\", \n \"type\": \"Endpoint\", \n \"activity_name\": \"System Collection\",\n \"uid\": data['device_id'],\n \"hostname\": data['hostname'],\n \"status\": get_system_info_result_item_0[i],\n \"status_detail\": get_system_info_result_message[i],\n \"endpoint_artifacts\": [\n {\n \"agents\": [\n {\n \"type\": \"Endpoint Detection and Response\",\n \"type_id\": 1,\n \"uid\": data['cid'],\n \"vendor_name\": \"Crowdstrike\",\n \"version\": data['agent_version'] \n }\n ],\n \"ip\": data['local_ip'],\n \"external_ip\": data['external_ip'],\n \"mac\": data['mac_address'],\n \"domain\": data['machine_domain'],\n \"type\": data['product_type_desc'],\n \"last_seen\": data['last_seen'],\n \"last_reboot\": data['last_reboot'],\n \"last_login_user_sid\": data.get('last_login_user_sid', ''),\n \"last_login_timestamp\": data.get('last_login_timestamp', ''),\n \"operating_system\": {\n \"build:\": data['os_build'],\n \"kernel_release\": data['kernel_version'],\n \"name\": data['os_product_name'],\n \"type\": data['platform_name'],\n \"version\": data['os_version']\n },\n \"hw_info\": {\n \"bios_manufacturer\": data['bios_manufacturer'],\n \"bios_version\": data['bios_version'],\n \"serial_number\": data['serial_number'],\n \"chassis\": data['chassis_type_desc']\n }\n }\n ]\n }\n \n policies = []\n for policy in data['policies']:\n policies.append(\n {\n \"name\": policy['policy_type'],\n \"uid\": policy['policy_id'],\n \"is_applied\": policy['applied']\n }\n )\n observable['endpoint_artifacts'][0]['agents'][0]['policies'] = policies\n \n #phantom.debug(f\"---> OBSERVABLE: {observable}\")\n process_system_observables__observable_array.append(observable)\n i+=1\n\n",
|
|
"warnings": {},
|
|
"x": 680,
|
|
"y": 1020
|
|
},
|
|
"23": {
|
|
"data": {
|
|
"action": "delete session",
|
|
"actionType": "generic",
|
|
"advanced": {
|
|
"customName": "delete session",
|
|
"customNameId": 0,
|
|
"description": "Deletes the Real Time Response (RTR) session on CS Falcon.",
|
|
"join": [],
|
|
"note": "Deletes the Real Time Response (RTR) session on CS Falcon."
|
|
},
|
|
"connector": "CrowdStrike OAuth API",
|
|
"connectorConfigs": [
|
|
"crowdstrike_oauth_api"
|
|
],
|
|
"connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "delete_session",
|
|
"id": "23",
|
|
"loop": {
|
|
"enabled": false,
|
|
"exitAfterUnit": "m",
|
|
"exitAfterValue": 10,
|
|
"exitConditionEnabled": false,
|
|
"exitLoopAfter": 2,
|
|
"pauseUnit": "m",
|
|
"pauseValue": 2
|
|
},
|
|
"parameters": {
|
|
"session_id": "create_session:action_result.summary.session_id"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "session_id"
|
|
}
|
|
],
|
|
"tab": "byAction",
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "23",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": 180,
|
|
"y": 1260
|
|
},
|
|
"24": {
|
|
"data": {
|
|
"action": "run admin command",
|
|
"actionType": "generic",
|
|
"advanced": {
|
|
"customName": "run admin command services",
|
|
"customNameId": 0,
|
|
"description": "Runs a set of Powershell commands to gather details about the services on the endpoint. This requires that the host response policy permits it on the CrowdStrike side.",
|
|
"join": [],
|
|
"note": "Runs a set of Powershell commands to gather details about the services on the endpoint. This requires that the host response policy permits it on the CrowdStrike side."
|
|
},
|
|
"connector": "CrowdStrike OAuth API",
|
|
"connectorConfigs": [
|
|
"crowdstrike_oauth_api"
|
|
],
|
|
"connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
|
|
"connectorVersion": "v1",
|
|
"functionId": 3,
|
|
"functionName": "run_admin_command_services",
|
|
"id": "24",
|
|
"loop": {
|
|
"enabled": false,
|
|
"exitAfterUnit": "m",
|
|
"exitAfterValue": 10,
|
|
"exitConditionEnabled": false,
|
|
"exitLoopAfter": 2,
|
|
"pauseUnit": "m",
|
|
"pauseValue": 2
|
|
},
|
|
"parameters": {
|
|
"command": "runscript",
|
|
"data": "-Raw=```Get-Service | Select-Object -Property Name, DisplayName, Status, ServiceType, StartType | ConvertTo-Json```",
|
|
"device_id": "query_device:action_result.data.*.device_id",
|
|
"session_id": "create_session:action_result.data.*.resources.*.session_id"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "command"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "device_id"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "session_id"
|
|
}
|
|
],
|
|
"tab": "byAction",
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "24",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": -320,
|
|
"y": 840
|
|
},
|
|
"25": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "process service observables",
|
|
"customNameId": 0,
|
|
"description": "Format a normalized output for each service",
|
|
"join": [],
|
|
"note": "Format a normalized output for each service"
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "process_service_observables",
|
|
"id": "25",
|
|
"inputParameters": [
|
|
"query_device:action_result.data.*.device_id",
|
|
"query_device:action_result.data.*.hostname",
|
|
"run_admin_command_services:action_result.data.*.resources",
|
|
"run_admin_command_services:action_result.status",
|
|
"run_admin_command_services:action_result.message"
|
|
],
|
|
"outputVariables": [
|
|
"observable_array"
|
|
],
|
|
"type": "code"
|
|
},
|
|
"errors": {},
|
|
"id": "25",
|
|
"type": "code",
|
|
"userCode": "\n import json\n \n # Ref: https://learn.microsoft.com/en-us/dotnet/api/system.serviceprocess.servicestartmode?view=net-9.0-pp\n ocsf_start_type_mapping = {\n \"0\": { \"id\": \"1\", \"type\": \"Boot\" }, # Boot -> Boot\n \"1\": { \"id\": \"2\", \"type\": \"System\" }, # System -> System\n \"2\": { \"id\": \"3\", \"type\": \"Auto\" }, # Automatic -> Auto\n \"3\": { \"id\": \"4\", \"type\": \"Demand\" }, # Manual -> Demand\n \"4\": { \"id\": \"5\", \"type\": \"Disabled\" } # Disabled -> Disabled\n }\n \n # Ref: https://learn.microsoft.com/en-us/dotnet/api/system.serviceprocess.servicetype?view=net-9.0-pp\n ocsf_service_type_mapping = {\n # Unused for now. OCSF doesn't seem to properly support BITWISE ENUMs yet.\n # See \"service_type_id\" at https://schema.ocsf.io/1.4.0/objects/win/win_service\n }\n \n process_service_observables__observable_array = []\n for device_id, hostname, services, status, messsage in zip(query_device_result_item_0, query_device_result_item_1, run_admin_command_services_result_item_0, run_admin_command_services_result_item_1, run_admin_command_services_result_message):\n \n observable = {\n \"source\": \"Crowdstrike OAuth API\",\n \"type\": \"Endpoint\",\n \"activity_name\": \"Services Collection\",\n \"uid\": device_id,\n \"hostname\": hostname,\n \"status\": status,\n \"status_detail\": messsage,\n \"service_artifacts\": []\n }\n \n if services[0] and services[0][\"stdout\"]:\n services_json = json.loads(services[0][\"stdout\"])\n for service in services_json:\n start_type = ocsf_start_type_mapping.get(str(service[\"StartType\"]))\n \n observable[\"service_artifacts\"].append({\n \"type_id\": 3, \n \"type\": \"Service\",\n \"name\": service[\"Name\"],\n \"display_name\": service[\"DisplayName\"],\n \"service_start_type_id\": start_type[\"id\"],\n \"service_start_type\": start_type[\"type\"], \n \"service_type_id\": service[\"ServiceType\"], # No mapping to OCSF yet, see comment above.\n })\n \n process_service_observables__observable_array.append(observable)\n \n #phantom.debug(process_service_observables__observable_array)\n \n",
|
|
"warnings": {},
|
|
"x": -320,
|
|
"y": 1020
|
|
},
|
|
"7": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "format fql",
|
|
"customNameId": 0,
|
|
"description": "Format the FQL query to get the input device information using its ID or hostname.",
|
|
"join": [],
|
|
"note": "Format the FQL query to get the input device information using its ID or hostname."
|
|
},
|
|
"functionId": 2,
|
|
"functionName": "format_fql",
|
|
"id": "7",
|
|
"parameters": [
|
|
"playbook_input:device"
|
|
],
|
|
"template": "%%\nhostname:['{0}'],device_id:['{0}']\n%%",
|
|
"type": "format"
|
|
},
|
|
"errors": {},
|
|
"id": "7",
|
|
"type": "format",
|
|
"warnings": {},
|
|
"x": 340,
|
|
"y": 328
|
|
},
|
|
"8": {
|
|
"data": {
|
|
"action": "query device",
|
|
"actionType": "investigate",
|
|
"advanced": {
|
|
"customName": "query device",
|
|
"customNameId": 0,
|
|
"description": "Get information about the device to unquarantine using its hostname or device id.",
|
|
"join": [],
|
|
"note": "Get information about the device to unquarantine using its hostname or device id."
|
|
},
|
|
"connector": "CrowdStrike OAuth API",
|
|
"connectorConfigs": [
|
|
"crowdstrike_oauth_api"
|
|
],
|
|
"connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "query_device",
|
|
"id": "8",
|
|
"loop": {
|
|
"enabled": false,
|
|
"exitAfterUnit": "m",
|
|
"exitAfterValue": 10,
|
|
"exitConditionEnabled": false,
|
|
"exitLoopAfter": 2,
|
|
"pauseUnit": "m",
|
|
"pauseValue": 2
|
|
},
|
|
"parameters": {
|
|
"filter": "format_fql:formatted_data.*",
|
|
"limit": 50
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "numeric",
|
|
"default": 50,
|
|
"field": "limit"
|
|
}
|
|
],
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "8",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": 340,
|
|
"y": 504
|
|
}
|
|
},
|
|
"notes": "Inputs: device (CrowdStrike Device ID or Hostname)\nInteractions: CrowdStrike OAuth API\nActions: unquarantine device\nOutputs: observables, markdown report"
|
|
},
|
|
"input_spec": [
|
|
{
|
|
"contains": [
|
|
"host name"
|
|
],
|
|
"description": "Device ID or hostname of the host to quarantine",
|
|
"name": "device"
|
|
}
|
|
],
|
|
"output_spec": [
|
|
{
|
|
"contains": [],
|
|
"datapaths": [
|
|
"process_process_observables:custom_function:observable_array"
|
|
],
|
|
"deduplicate": false,
|
|
"description": "An array of process observable dictionaries",
|
|
"metadata": {},
|
|
"name": "process_observable"
|
|
},
|
|
{
|
|
"contains": [],
|
|
"datapaths": [
|
|
"process_network_observables:custom_function:observable_array"
|
|
],
|
|
"deduplicate": false,
|
|
"description": "An array of network connection observable dictionaries",
|
|
"metadata": {},
|
|
"name": "network_observable"
|
|
},
|
|
{
|
|
"contains": [],
|
|
"datapaths": [
|
|
"process_system_observables:custom_function:observable_array"
|
|
],
|
|
"deduplicate": false,
|
|
"description": "An array of endpoint observable dictionaries",
|
|
"metadata": {},
|
|
"name": "endpoint_observable"
|
|
},
|
|
{
|
|
"contains": [],
|
|
"datapaths": [
|
|
"process_service_observables:custom_function:observable_array"
|
|
],
|
|
"deduplicate": false,
|
|
"description": "An array of service observable dictionaries",
|
|
"metadata": {},
|
|
"name": "service_observable"
|
|
}
|
|
],
|
|
"playbook_trigger": "artifact_created",
|
|
"playbook_type": "data",
|
|
"python_version": "3.13",
|
|
"schema": "5.0.15",
|
|
"version": "6.3.1.178"
|
|
},
|
|
"create_time": "2025-05-01T17:39:10.288392+00:00",
|
|
"draft_mode": false,
|
|
"labels": [
|
|
"*"
|
|
],
|
|
"tags": [
|
|
"CrowdStrike_OAuth_API",
|
|
"host name",
|
|
"enrichment",
|
|
"D3-NTA",
|
|
"D3-PA",
|
|
"D3-AI"
|
|
]
|
|
} |