mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
ljstella
697 lines
31 KiB
JSON
697 lines
31 KiB
JSON
{
|
|
"blockly": false,
|
|
"blockly_xml": "<xml></xml>",
|
|
"category": "File Restore",
|
|
"coa": {
|
|
"data": {
|
|
"description": "Accepts a hostname or device id as well as a file path as input and restores the file from the File Vault to a device in Crowdstrike. We then generate an observable report as well as a Markdown formatted report. Both reports can be customized based on user preference.",
|
|
"edges": [
|
|
{
|
|
"id": "port_0_to_port_2",
|
|
"sourceNode": "0",
|
|
"sourcePort": "0_out",
|
|
"targetNode": "2",
|
|
"targetPort": "2_in"
|
|
},
|
|
{
|
|
"id": "port_5_to_port_1",
|
|
"sourceNode": "5",
|
|
"sourcePort": "5_out",
|
|
"targetNode": "1",
|
|
"targetPort": "1_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_2_to_port_7",
|
|
"sourceNode": "2",
|
|
"sourcePort": "2_out",
|
|
"targetNode": "7",
|
|
"targetPort": "7_in"
|
|
},
|
|
{
|
|
"id": "port_7_to_port_8",
|
|
"sourceNode": "7",
|
|
"sourcePort": "7_out",
|
|
"targetNode": "8",
|
|
"targetPort": "8_in"
|
|
},
|
|
{
|
|
"id": "port_9_to_port_5",
|
|
"sourceNode": "9",
|
|
"sourcePort": "9_out",
|
|
"targetNode": "5",
|
|
"targetPort": "5_in"
|
|
},
|
|
{
|
|
"id": "port_15_to_port_9",
|
|
"sourceNode": "15",
|
|
"sourcePort": "15_out",
|
|
"targetNode": "9",
|
|
"targetPort": "9_in"
|
|
},
|
|
{
|
|
"id": "port_16_to_port_15",
|
|
"sourceNode": "16",
|
|
"sourcePort": "16_out",
|
|
"targetNode": "15",
|
|
"targetPort": "15_in"
|
|
},
|
|
{
|
|
"id": "port_19_to_port_11",
|
|
"sourceNode": "19",
|
|
"sourcePort": "19_out",
|
|
"targetNode": "11",
|
|
"targetPort": "11_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_18_to_port_19",
|
|
"sourceNode": "18",
|
|
"sourcePort": "18_out",
|
|
"targetNode": "19",
|
|
"targetPort": "19_in"
|
|
},
|
|
{
|
|
"id": "port_8_to_port_18",
|
|
"sourceNode": "8",
|
|
"sourcePort": "8_out",
|
|
"targetNode": "18",
|
|
"targetPort": "18_in"
|
|
},
|
|
{
|
|
"id": "port_11_to_port_29",
|
|
"sourceNode": "11",
|
|
"sourcePort": "11_out",
|
|
"targetNode": "29",
|
|
"targetPort": "29_in"
|
|
},
|
|
{
|
|
"id": "port_29_to_port_16",
|
|
"sourceNode": "29",
|
|
"sourcePort": "29_out",
|
|
"targetNode": "16",
|
|
"targetPort": "16_in"
|
|
}
|
|
],
|
|
"hash": "3339fe23d90ca191d7151a1b509f9bc5879ea2da",
|
|
"nodes": {
|
|
"0": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_start",
|
|
"id": "0",
|
|
"type": "start"
|
|
},
|
|
"errors": {},
|
|
"id": "0",
|
|
"type": "start",
|
|
"warnings": {},
|
|
"x": 19.999999999999986,
|
|
"y": -6.394884621840902e-14
|
|
},
|
|
"1": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_finish",
|
|
"id": "1",
|
|
"type": "end"
|
|
},
|
|
"errors": {},
|
|
"id": "1",
|
|
"type": "end",
|
|
"warnings": {},
|
|
"x": 19.999999999999986,
|
|
"y": 2080
|
|
},
|
|
"11": {
|
|
"data": {
|
|
"action": "create session",
|
|
"actionType": "generic",
|
|
"advanced": {
|
|
"customName": "create session",
|
|
"customNameId": 0,
|
|
"description": "Creates a Real Time Response (RTR) session to interact with the endpoint",
|
|
"join": [],
|
|
"note": "Creates a Real Time Response (RTR) session to interact with the endpoint"
|
|
},
|
|
"connector": "CrowdStrike OAuth API",
|
|
"connectorConfigs": [
|
|
"crowdstrike_oauth_api"
|
|
],
|
|
"connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "create_session",
|
|
"id": "11",
|
|
"loop": {
|
|
"enabled": false,
|
|
"exitAfterUnit": "m",
|
|
"exitAfterValue": 10,
|
|
"exitConditionEnabled": false,
|
|
"exitLoopAfter": 2,
|
|
"pauseUnit": "m",
|
|
"pauseValue": 2
|
|
},
|
|
"parameters": {
|
|
"device_id": "query_device:action_result.data.*.device_id"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "device_id"
|
|
}
|
|
],
|
|
"tab": "byAction",
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "11",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": 1.4210854715202004e-14,
|
|
"y": 1036
|
|
},
|
|
"15": {
|
|
"data": {
|
|
"action": "delete session",
|
|
"actionType": "generic",
|
|
"advanced": {
|
|
"customName": "delete session",
|
|
"customNameId": 0,
|
|
"description": "Closes a Real Time Response (RTR) session to interact with the endpoint",
|
|
"join": [],
|
|
"note": "Closes a Real Time Response (RTR) session to interact with the endpoint"
|
|
},
|
|
"connector": "CrowdStrike OAuth API",
|
|
"connectorConfigs": [
|
|
"crowdstrike_oauth_api"
|
|
],
|
|
"connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "delete_session",
|
|
"id": "15",
|
|
"loop": {
|
|
"enabled": false,
|
|
"exitAfterUnit": "m",
|
|
"exitAfterValue": 10,
|
|
"exitConditionEnabled": false,
|
|
"exitLoopAfter": 2,
|
|
"pauseUnit": "m",
|
|
"pauseValue": 2
|
|
},
|
|
"parameters": {
|
|
"session_id": "create_session:action_result.summary.session_id"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "session_id"
|
|
}
|
|
],
|
|
"tab": "byAction",
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "15",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": 1.4210854715202004e-14,
|
|
"y": 1536
|
|
},
|
|
"16": {
|
|
"data": {
|
|
"action": "run admin command",
|
|
"actionType": "generic",
|
|
"advanced": {
|
|
"customName": "run admin command put",
|
|
"customNameId": 0,
|
|
"description": "Run the put admin command via Real Time Response (RTR)",
|
|
"join": [],
|
|
"note": "Run the put admin command via Real Time Response (RTR)"
|
|
},
|
|
"connector": "CrowdStrike OAuth API",
|
|
"connectorConfigs": [
|
|
"crowdstrike_oauth_api"
|
|
],
|
|
"connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "run_admin_command_put",
|
|
"id": "16",
|
|
"loop": {
|
|
"enabled": false,
|
|
"exitAfterUnit": "m",
|
|
"exitAfterValue": 10,
|
|
"exitConditionEnabled": false,
|
|
"exitLoopAfter": 2,
|
|
"pauseUnit": "m",
|
|
"pauseValue": 2
|
|
},
|
|
"parameters": {
|
|
"command": "put",
|
|
"data": "artifact:*.cef.fileName",
|
|
"device_id": "query_device:action_result.data.*.device_id",
|
|
"session_id": "create_session:action_result.summary.session_id"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "command"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "device_id"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "session_id"
|
|
}
|
|
],
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "16",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": 1.4210854715202004e-14,
|
|
"y": 1360
|
|
},
|
|
"18": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "filter file artifacts",
|
|
"customNameId": 0,
|
|
"description": "Filter to ensure the requested file to restore was found in the vent artifacts. This playbook assumes the file to restore has been previously collected by the CrowdStrike_OAuth_API_File_Collection input playbook.\n",
|
|
"join": [],
|
|
"note": "Filter to ensure the requested file to restore was found in the vent artifacts. This playbook assumes the file to restore has been previously collected by the CrowdStrike_OAuth_API_File_Collection input playbook.\n"
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "==",
|
|
"param": "artifact:*.label",
|
|
"value": "collected_file"
|
|
},
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "in",
|
|
"param": "playbook_input:file",
|
|
"value": "artifact:*.cef.fileName"
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "file artifact exists",
|
|
"logic": "and"
|
|
}
|
|
],
|
|
"functionId": 2,
|
|
"functionName": "filter_file_artifacts_0",
|
|
"id": "18",
|
|
"type": "filter"
|
|
},
|
|
"errors": {},
|
|
"id": "18",
|
|
"type": "filter",
|
|
"warnings": {},
|
|
"x": 60,
|
|
"y": 680
|
|
},
|
|
"19": {
|
|
"data": {
|
|
"action": "upload put file",
|
|
"actionType": "generic",
|
|
"advanced": {
|
|
"customName": "upload put file",
|
|
"customNameId": 0,
|
|
"description": "Upload the file to restore from the SOAR Vault to Crowdstrike.",
|
|
"join": [],
|
|
"note": "Upload the file to restore from the SOAR Vault to Crowdstrike."
|
|
},
|
|
"connector": "CrowdStrike OAuth API",
|
|
"connectorConfigs": [
|
|
"crowdstrike_oauth_api"
|
|
],
|
|
"connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "upload_put_file",
|
|
"id": "19",
|
|
"loop": {
|
|
"enabled": false,
|
|
"exitAfterUnit": "m",
|
|
"exitAfterValue": 10,
|
|
"exitConditionEnabled": false,
|
|
"exitLoopAfter": 2,
|
|
"pauseUnit": "m",
|
|
"pauseValue": 2
|
|
},
|
|
"parameters": {
|
|
"comment": "File restored from Splunk SOAR",
|
|
"description": "File restored from Splunk SOAR via the CrowdStrike_OAuth_API_File_Restore playbook.",
|
|
"file_name": "filtered-data:filter_file_artifacts_0:condition_1:artifact:*.cef.fileName",
|
|
"vault_id": "filtered-data:filter_file_artifacts_0:condition_1:artifact:*.cef.vaultId"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "vault_id"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "description"
|
|
}
|
|
],
|
|
"tab": "byAction",
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "19",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": 1.4210854715202004e-14,
|
|
"y": 860
|
|
},
|
|
"2": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "input filter",
|
|
"customNameId": 0,
|
|
"description": "Determines if the provided inputs are present in the dataset.",
|
|
"join": [],
|
|
"note": "Determines if the provided inputs are present in the dataset."
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "playbook_input:device",
|
|
"value": ""
|
|
},
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "playbook_input:file",
|
|
"value": ""
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "input device and file present",
|
|
"logic": "and"
|
|
}
|
|
],
|
|
"functionId": 1,
|
|
"functionName": "input_filter",
|
|
"id": "2",
|
|
"type": "filter"
|
|
},
|
|
"errors": {},
|
|
"id": "2",
|
|
"type": "filter",
|
|
"warnings": {},
|
|
"x": 60,
|
|
"y": 148
|
|
},
|
|
"29": {
|
|
"data": {
|
|
"action": "run admin command",
|
|
"actionType": "generic",
|
|
"advanced": {
|
|
"customName": "run admin command cd",
|
|
"customNameId": 0,
|
|
"description": "Run the cd admin command via Real Time Response (RTR) to set the working directory properly for the following put command.",
|
|
"join": [],
|
|
"note": "Run the cd admin command via Real Time Response (RTR) to set the working directory properly for the following put command."
|
|
},
|
|
"connector": "CrowdStrike OAuth API",
|
|
"connectorConfigs": [
|
|
"crowdstrike_oauth_api"
|
|
],
|
|
"connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
|
|
"connectorVersion": "v1",
|
|
"functionId": 2,
|
|
"functionName": "run_admin_command_cd",
|
|
"id": "29",
|
|
"loop": {
|
|
"enabled": false,
|
|
"exitAfterUnit": "m",
|
|
"exitAfterValue": 10,
|
|
"exitConditionEnabled": false,
|
|
"exitLoopAfter": 2,
|
|
"pauseUnit": "m",
|
|
"pauseValue": 2
|
|
},
|
|
"parameters": {
|
|
"command": "cd",
|
|
"data": "filtered-data:filter_file_artifacts_0:condition_1:artifact:*.cef.filePath",
|
|
"device_id": "query_device:action_result.data.*.device_id",
|
|
"session_id": "create_session:action_result.summary.session_id"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "command"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "device_id"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "session_id"
|
|
}
|
|
],
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "29",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": 1.4210854715202004e-14,
|
|
"y": 1212
|
|
},
|
|
"5": {
|
|
"customCode": null,
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "host observables",
|
|
"customNameId": 0,
|
|
"description": "Format a normalized output for each host",
|
|
"join": [],
|
|
"note": "Format a normalized output for each host."
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "host_observables",
|
|
"id": "5",
|
|
"inputParameters": [
|
|
"create_session:action_result.parameter.device_id",
|
|
"query_device:action_result.data.*.hostname",
|
|
"run_admin_command_put:action_result.parameter.data",
|
|
"run_admin_command_cd:action_result.parameter.data",
|
|
"run_admin_command_put:action_result.status",
|
|
"run_admin_command_put:action_result.message"
|
|
],
|
|
"outputVariables": [
|
|
"observable_array"
|
|
],
|
|
"type": "code"
|
|
},
|
|
"errors": {},
|
|
"id": "5",
|
|
"type": "code",
|
|
"userCode": " \n host_observables__observable_array = []\n \n for device_id, hostname, file_name, file_path, status, status_message in zip(create_session_parameter_device_id, query_device_result_item_0, run_admin_command_put_parameter_data, run_admin_command_cd_parameter_data, run_admin_command_put_result_item_1, run_admin_command_put_result_message):\n # Initialize the observable dictionary\n observable = {\n \"source\": \"Crowdstrike OAuth API\", \n \"type\": \"Endpoint\", \n \"activity_name\": \"File Restore\",\n \"uid\": device_id,\n \"hostname\": hostname,\n \"status\": status,\n \"status_detail\": status_message,\n \"file_artifacts\": {\n \"name\": file_name,\n \"path\": file_path\n },\n \"d3fend\": {\n \"d3f_tactic\": \"Restore\",\n \"d3f_technique\": \"D3-RF\",\n \"version\": \"1.0.0\"\n }\n }\n\n # Add the observable to the array\n host_observables__observable_array.append(observable)\n \n # Debug output for verification\n phantom.debug(host_observables__observable_array)\n \n",
|
|
"warnings": {},
|
|
"x": 1.4210854715202004e-14,
|
|
"y": 1900
|
|
},
|
|
"7": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "format fql",
|
|
"customNameId": 0,
|
|
"description": "Format the FQL query to get the input device information using its ID or hostname.",
|
|
"join": [],
|
|
"note": "Format the FQL query to get the input device information using its ID or hostname."
|
|
},
|
|
"functionId": 2,
|
|
"functionName": "format_fql",
|
|
"id": "7",
|
|
"parameters": [
|
|
"playbook_input:device"
|
|
],
|
|
"template": "%%\nhostname:['{0}'],device_id:['{0}']\n%%",
|
|
"type": "format"
|
|
},
|
|
"errors": {},
|
|
"id": "7",
|
|
"type": "format",
|
|
"warnings": {},
|
|
"x": 1.4210854715202004e-14,
|
|
"y": 328
|
|
},
|
|
"8": {
|
|
"data": {
|
|
"action": "query device",
|
|
"actionType": "investigate",
|
|
"advanced": {
|
|
"customName": "query device",
|
|
"customNameId": 0,
|
|
"description": "Get information about the device using its hostname or device id.",
|
|
"join": [],
|
|
"note": "Get information about the device using its hostname or device id."
|
|
},
|
|
"connector": "CrowdStrike OAuth API",
|
|
"connectorConfigs": [
|
|
"crowdstrike_oauth_api"
|
|
],
|
|
"connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "query_device",
|
|
"id": "8",
|
|
"loop": {
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "==",
|
|
"param": "",
|
|
"value": ""
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"display": "If",
|
|
"logic": "and",
|
|
"type": "if"
|
|
}
|
|
],
|
|
"enabled": false,
|
|
"exitAfterUnit": "m",
|
|
"exitAfterValue": 10,
|
|
"exitConditionEnabled": false,
|
|
"exitLoopAfter": 2,
|
|
"pauseUnit": "m",
|
|
"pauseValue": 2
|
|
},
|
|
"parameters": {
|
|
"filter": "format_fql:formatted_data.*",
|
|
"limit": 50
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "numeric",
|
|
"default": 50,
|
|
"field": "limit"
|
|
}
|
|
],
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "8",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": 1.4210854715202004e-14,
|
|
"y": 504
|
|
},
|
|
"9": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "format file restore report",
|
|
"customNameId": 0,
|
|
"description": "Format a summary table with the information gathered from the playbook.",
|
|
"join": [],
|
|
"note": "Format a summary table with the information gathered from the playbook."
|
|
},
|
|
"functionId": 3,
|
|
"functionName": "format_file_restore_report",
|
|
"id": "9",
|
|
"parameters": [
|
|
"query_device:action_result.data.*.device_id",
|
|
"run_admin_command_put:action_result.parameter.data",
|
|
"run_admin_command_put:action_result.status"
|
|
],
|
|
"template": "Endpoint Files were restored by Splunk SOAR. The table below summarizes the information gathered.\n\n| Device ID | File Path | Restore Status |\n| --- | --- | --- |\n%%\n| {0} | {1} | {2} |\n%%",
|
|
"type": "format"
|
|
},
|
|
"errors": {},
|
|
"id": "9",
|
|
"type": "format",
|
|
"warnings": {},
|
|
"x": 1.4210854715202004e-14,
|
|
"y": 1712
|
|
}
|
|
},
|
|
"notes": "Inputs: \ndevice (CrowdStrike Device ID or Hostname)\npath (File path)\nInteractions: CrowdStrike OAuth API\nActions: create session, run admin command, delete session\nOutputs: observables, markdown report"
|
|
},
|
|
"input_spec": [
|
|
{
|
|
"contains": [
|
|
"host name"
|
|
],
|
|
"description": "Device ID or hostname of the host where the file should be restored.",
|
|
"name": "device"
|
|
},
|
|
{
|
|
"contains": [
|
|
"file name"
|
|
],
|
|
"description": "Name of the file on the endpoint to restore. Assumes a file is present in the File Vault and a matching file_collected artifact exists with the same name from a previous File Collection run.",
|
|
"name": "file"
|
|
}
|
|
],
|
|
"output_spec": [
|
|
{
|
|
"contains": [],
|
|
"datapaths": [
|
|
"host_observables:custom_function:observable_array"
|
|
],
|
|
"deduplicate": false,
|
|
"description": "An array of observable dictionaries",
|
|
"metadata": {},
|
|
"name": "observable"
|
|
},
|
|
{
|
|
"contains": [],
|
|
"datapaths": [
|
|
"format_file_restore_report:formatted_data"
|
|
],
|
|
"deduplicate": false,
|
|
"description": "A report of the devices that were isolated via Splunk SOAR.",
|
|
"metadata": {},
|
|
"name": "markdown_report"
|
|
}
|
|
],
|
|
"playbook_trigger": "artifact_created",
|
|
"playbook_type": "data",
|
|
"python_version": "3.13",
|
|
"schema": "5.0.15",
|
|
"version": "6.3.1.178"
|
|
},
|
|
"create_time": "2025-04-09T16:44:19.014187+00:00",
|
|
"draft_mode": false,
|
|
"labels": [
|
|
"*"
|
|
],
|
|
"tags": [
|
|
"CrowdStrike_OAuth_API",
|
|
"host name",
|
|
"D3-RF"
|
|
]
|
|
} |