mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Lou Stella
5505 lines
289 KiB
JSON
5505 lines
289 KiB
JSON
{
|
|
"blockly": false,
|
|
"blockly_xml": "<xml></xml>",
|
|
"category": "Onboarding",
|
|
"coa": {
|
|
"data": {
|
|
"clean": true,
|
|
"code_block": "\"\"\"\nThe hunting Playbook queries a number of internal security technologies in order to determine if any of the artifacts present in your data source have been observed in your environment.\n\"\"\"\n\ndef get_specific_assets(action, include_products=None):\n \n supported_assets = phantom.get_assets(action=action)\n # phantom.debug(\"Action Supported Assets\")\n # phantom.debug(supported_assets)\n \n if not supported_assets:\n # no supported products configured\n return []\n \n if not include_products:\n # no product filters, so return whatever we found\n return [x['name'] for x in supported_assets]\n \n if include_products:\n \n if (type(include_products) != list):\n phantom.debug(\"Please specify a list for filter_products\")\n return []\n \n # make the product names sent to this funcion lower\n include_products = [x.lower() for x in include_products]\n \n # get products that are configured and asked for\n assets_matched = [x['name'] for x in supported_assets if x['product_name'].lower() in include_products]\n # phantom.debug(\"Action Supported Matches\")\n # phantom.debug(assets_matched)\n return assets_matched\n \n # should not reach here\n return []",
|
|
"description": "Hunt for internal sightings of malicious files or connections to malicious domains or IP addresses.",
|
|
"joint": {
|
|
"cells": [
|
|
{
|
|
"attrs": {
|
|
".connection": {
|
|
"stroke": "#6C7A89",
|
|
"stroke-width": 2
|
|
},
|
|
".marker-target": {
|
|
"d": "M 10 0 L 0 5 L 10 10 z",
|
|
"fill": "#6a6c8a",
|
|
"stroke": "#6a6c8a"
|
|
},
|
|
".tool-remove": {
|
|
"position": 0.5
|
|
}
|
|
},
|
|
"connector": {
|
|
"args": {
|
|
"radius": 5
|
|
},
|
|
"name": "rounded"
|
|
},
|
|
"endDirections": [
|
|
"left"
|
|
],
|
|
"id": "370dd52c-9988-4e95-bfa0-7326d1710717",
|
|
"router": {
|
|
"name": "metro"
|
|
},
|
|
"source": {
|
|
"id": "316c9705-7ae6-421d-8e39-09ed4d5eaf72",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"startDirections": [
|
|
"right"
|
|
],
|
|
"target": {
|
|
"id": "2c95ee18-c36d-40b4-9a1d-889badec9d4f",
|
|
"selector": ".port-body[type=\"input\"]"
|
|
},
|
|
"type": "link",
|
|
"z": 4
|
|
},
|
|
{
|
|
"attrs": {
|
|
".connection": {
|
|
"stroke": "#6C7A89",
|
|
"stroke-width": 2
|
|
},
|
|
".marker-target": {
|
|
"d": "M 10 0 L 0 5 L 10 10 z",
|
|
"fill": "#6a6c8a",
|
|
"stroke": "#6a6c8a"
|
|
},
|
|
".tool-remove": {
|
|
"position": 0.5
|
|
}
|
|
},
|
|
"connector": {
|
|
"args": {
|
|
"radius": 5
|
|
},
|
|
"name": "rounded"
|
|
},
|
|
"endDirections": [
|
|
"left"
|
|
],
|
|
"id": "c3529b6a-3e65-4955-ba02-34c06302327a",
|
|
"router": {
|
|
"name": "metro"
|
|
},
|
|
"source": {
|
|
"id": "2c95ee18-c36d-40b4-9a1d-889badec9d4f",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"startDirections": [
|
|
"right"
|
|
],
|
|
"target": {
|
|
"id": "8656f57d-779a-4133-a244-5191a6714a83",
|
|
"selector": ".port-body[type=\"input\"]"
|
|
},
|
|
"type": "link",
|
|
"z": 29
|
|
},
|
|
{
|
|
"attrs": {
|
|
".connection": {
|
|
"stroke": "#6C7A89",
|
|
"stroke-width": 2
|
|
},
|
|
".marker-target": {
|
|
"d": "M 10 0 L 0 5 L 10 10 z",
|
|
"fill": "#6a6c8a",
|
|
"stroke": "#6a6c8a"
|
|
},
|
|
".tool-remove": {
|
|
"position": 0.5
|
|
}
|
|
},
|
|
"connector": {
|
|
"args": {
|
|
"radius": 5
|
|
},
|
|
"name": "rounded"
|
|
},
|
|
"endDirections": [
|
|
"left"
|
|
],
|
|
"id": "6d247fbe-3ded-4151-ad4a-93302a55e32b",
|
|
"router": {
|
|
"name": "metro"
|
|
},
|
|
"source": {
|
|
"id": "316c9705-7ae6-421d-8e39-09ed4d5eaf72",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"startDirections": [
|
|
"right"
|
|
],
|
|
"target": {
|
|
"id": "ed123d2f-999b-4cdc-b141-a48f7da89227",
|
|
"selector": ".port-body[type=\"input\"]"
|
|
},
|
|
"type": "link",
|
|
"z": 69
|
|
},
|
|
{
|
|
"attrs": {
|
|
".connection": {
|
|
"stroke": "#6C7A89",
|
|
"stroke-width": 2
|
|
},
|
|
".marker-target": {
|
|
"d": "M 10 0 L 0 5 L 10 10 z",
|
|
"fill": "#6a6c8a",
|
|
"stroke": "#6a6c8a"
|
|
},
|
|
".tool-remove": {
|
|
"position": 0.5
|
|
}
|
|
},
|
|
"connector": {
|
|
"args": {
|
|
"radius": 5
|
|
},
|
|
"name": "rounded"
|
|
},
|
|
"endDirections": [
|
|
"left"
|
|
],
|
|
"id": "1b0673da-2779-464c-a51c-2563217414a2",
|
|
"router": {
|
|
"name": "metro"
|
|
},
|
|
"source": {
|
|
"id": "8656f57d-779a-4133-a244-5191a6714a83",
|
|
"port": "out-1",
|
|
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"startDirections": [
|
|
"right"
|
|
],
|
|
"target": {
|
|
"id": "666fe7a3-1c31-4238-ba36-ea3cfd8d2884",
|
|
"selector": ".port-body[type=\"input\"]"
|
|
},
|
|
"type": "link",
|
|
"z": 177
|
|
},
|
|
{
|
|
"attrs": {
|
|
".connection": {
|
|
"stroke": "#6C7A89",
|
|
"stroke-width": 2
|
|
},
|
|
".marker-target": {
|
|
"d": "M 10 0 L 0 5 L 10 10 z",
|
|
"fill": "#6a6c8a",
|
|
"stroke": "#6a6c8a"
|
|
},
|
|
".tool-remove": {
|
|
"position": 0.5
|
|
}
|
|
},
|
|
"connector": {
|
|
"args": {
|
|
"radius": 5
|
|
},
|
|
"name": "rounded"
|
|
},
|
|
"endDirections": [
|
|
"left"
|
|
],
|
|
"id": "5191bf3b-fdaa-4f48-ac52-4e7419e69664",
|
|
"router": {
|
|
"name": "metro"
|
|
},
|
|
"source": {
|
|
"id": "666fe7a3-1c31-4238-ba36-ea3cfd8d2884",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"startDirections": [
|
|
"right"
|
|
],
|
|
"target": {
|
|
"id": "65cec994-6cd3-47da-849a-f015982d8a23",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"type": "link",
|
|
"vertices": [
|
|
{
|
|
"x": 1600,
|
|
"y": 80
|
|
}
|
|
],
|
|
"z": 202
|
|
},
|
|
{
|
|
"attrs": {
|
|
".connection": {
|
|
"stroke": "#6C7A89",
|
|
"stroke-width": 2
|
|
},
|
|
".marker-target": {
|
|
"d": "M 10 0 L 0 5 L 10 10 z",
|
|
"fill": "#6a6c8a",
|
|
"stroke": "#6a6c8a"
|
|
},
|
|
".tool-remove": {
|
|
"position": 0.5
|
|
}
|
|
},
|
|
"connector": {
|
|
"args": {
|
|
"radius": 5
|
|
},
|
|
"name": "rounded"
|
|
},
|
|
"endDirections": [
|
|
"left"
|
|
],
|
|
"id": "f6873242-210c-4a03-9461-9a251503c199",
|
|
"router": {
|
|
"name": "metro"
|
|
},
|
|
"source": {
|
|
"id": "5578c85f-4a27-401e-be14-7793e82b92c5",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"startDirections": [
|
|
"right"
|
|
],
|
|
"target": {
|
|
"id": "7ca41dcf-c8bd-46f4-bb7d-6df6d254c01f",
|
|
"selector": ".port-body[type=\"input\"]"
|
|
},
|
|
"type": "link",
|
|
"z": 609
|
|
},
|
|
{
|
|
"attrs": {
|
|
".connection": {
|
|
"stroke": "#6C7A89",
|
|
"stroke-width": 2
|
|
},
|
|
".marker-target": {
|
|
"d": "M 10 0 L 0 5 L 10 10 z",
|
|
"fill": "#6a6c8a",
|
|
"stroke": "#6a6c8a"
|
|
},
|
|
".tool-remove": {
|
|
"position": 0.5
|
|
}
|
|
},
|
|
"connector": {
|
|
"args": {
|
|
"radius": 5
|
|
},
|
|
"name": "rounded"
|
|
},
|
|
"endDirections": [
|
|
"left"
|
|
],
|
|
"id": "6011a55b-8289-4934-9db9-70b4416ebd1f",
|
|
"router": {
|
|
"name": "metro"
|
|
},
|
|
"source": {
|
|
"id": "7ca41dcf-c8bd-46f4-bb7d-6df6d254c01f",
|
|
"port": "out-1",
|
|
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"startDirections": [
|
|
"right"
|
|
],
|
|
"target": {
|
|
"id": "9052a241-042b-4189-b56d-fcc0bf461cc6",
|
|
"selector": ".port-body[type=\"input\"]"
|
|
},
|
|
"type": "link",
|
|
"z": 616
|
|
},
|
|
{
|
|
"attrs": {
|
|
".connection": {
|
|
"stroke": "#6C7A89",
|
|
"stroke-width": 2
|
|
},
|
|
".marker-target": {
|
|
"d": "M 10 0 L 0 5 L 10 10 z",
|
|
"fill": "#6a6c8a",
|
|
"stroke": "#6a6c8a"
|
|
},
|
|
".tool-remove": {
|
|
"position": 0.5
|
|
}
|
|
},
|
|
"connector": {
|
|
"args": {
|
|
"radius": 5
|
|
},
|
|
"name": "rounded"
|
|
},
|
|
"endDirections": [
|
|
"left"
|
|
],
|
|
"id": "e75dcbfb-0575-442a-a3ec-468a815144a2",
|
|
"router": {
|
|
"name": "metro"
|
|
},
|
|
"source": {
|
|
"id": "9052a241-042b-4189-b56d-fcc0bf461cc6",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"startDirections": [
|
|
"right"
|
|
],
|
|
"target": {
|
|
"id": "93d4e099-5891-4c2b-b6db-ac512e981f06",
|
|
"selector": ".port-body[type=\"input\"]"
|
|
},
|
|
"type": "link",
|
|
"z": 686
|
|
},
|
|
{
|
|
"attrs": {
|
|
".connection": {
|
|
"stroke": "#6C7A89",
|
|
"stroke-width": 2
|
|
},
|
|
".marker-target": {
|
|
"d": "M 10 0 L 0 5 L 10 10 z",
|
|
"fill": "#6a6c8a",
|
|
"stroke": "#6a6c8a"
|
|
},
|
|
".tool-remove": {
|
|
"position": 0.5
|
|
}
|
|
},
|
|
"connector": {
|
|
"args": {
|
|
"radius": 5
|
|
},
|
|
"name": "rounded"
|
|
},
|
|
"endDirections": [
|
|
"left"
|
|
],
|
|
"id": "282072cb-d450-40c0-b142-6727d131f38a",
|
|
"router": {
|
|
"name": "metro"
|
|
},
|
|
"source": {
|
|
"id": "93d4e099-5891-4c2b-b6db-ac512e981f06",
|
|
"port": "out-1",
|
|
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"startDirections": [
|
|
"right"
|
|
],
|
|
"target": {
|
|
"id": "e07929c3-d5ce-44c1-b08d-3b4fede3bc59",
|
|
"selector": ".port-body[type=\"input\"]"
|
|
},
|
|
"type": "link",
|
|
"z": 713
|
|
},
|
|
{
|
|
"attrs": {
|
|
".connection": {
|
|
"stroke": "#6C7A89",
|
|
"stroke-width": 2
|
|
},
|
|
".marker-target": {
|
|
"d": "M 10 0 L 0 5 L 10 10 z",
|
|
"fill": "#6a6c8a",
|
|
"stroke": "#6a6c8a"
|
|
},
|
|
".tool-remove": {
|
|
"position": 0.5
|
|
}
|
|
},
|
|
"connector": {
|
|
"args": {
|
|
"radius": 5
|
|
},
|
|
"name": "rounded"
|
|
},
|
|
"endDirections": [
|
|
"left"
|
|
],
|
|
"id": "8346a4a6-4ca6-429c-a9ed-df734d719534",
|
|
"router": {
|
|
"name": "metro"
|
|
},
|
|
"source": {
|
|
"id": "316c9705-7ae6-421d-8e39-09ed4d5eaf72",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"startDirections": [
|
|
"right"
|
|
],
|
|
"target": {
|
|
"id": "8c6c1d82-e40b-4f58-b6c0-cc8c40791cae",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"type": "link",
|
|
"z": 864
|
|
},
|
|
{
|
|
"attrs": {
|
|
".connection": {
|
|
"stroke": "#6C7A89",
|
|
"stroke-width": 2
|
|
},
|
|
".marker-target": {
|
|
"d": "M 10 0 L 0 5 L 10 10 z",
|
|
"fill": "#6a6c8a",
|
|
"stroke": "#6a6c8a"
|
|
},
|
|
".tool-remove": {
|
|
"position": 0.5
|
|
}
|
|
},
|
|
"connector": {
|
|
"args": {
|
|
"radius": 5
|
|
},
|
|
"name": "rounded"
|
|
},
|
|
"endDirections": [
|
|
"left"
|
|
],
|
|
"id": "028d5235-a996-48e5-9f5e-05042bf25230",
|
|
"router": {
|
|
"name": "metro"
|
|
},
|
|
"source": {
|
|
"id": "ed123d2f-999b-4cdc-b141-a48f7da89227",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"startDirections": [
|
|
"right"
|
|
],
|
|
"target": {
|
|
"id": "c79812bd-7079-4317-a492-d36f2de1ac83",
|
|
"selector": ".port-body[type=\"input\"]"
|
|
},
|
|
"type": "link",
|
|
"z": 918
|
|
},
|
|
{
|
|
"attrs": {
|
|
".connection": {
|
|
"stroke": "#6C7A89",
|
|
"stroke-width": 2
|
|
},
|
|
".marker-target": {
|
|
"d": "M 10 0 L 0 5 L 10 10 z",
|
|
"fill": "#6a6c8a",
|
|
"stroke": "#6a6c8a"
|
|
},
|
|
".tool-remove": {
|
|
"position": 0.5
|
|
}
|
|
},
|
|
"connector": {
|
|
"args": {
|
|
"radius": 5
|
|
},
|
|
"name": "rounded"
|
|
},
|
|
"endDirections": [
|
|
"left"
|
|
],
|
|
"id": "e397dbe7-376c-4760-bdd8-a4cbf8ff7cc0",
|
|
"router": {
|
|
"name": "metro"
|
|
},
|
|
"source": {
|
|
"id": "c79812bd-7079-4317-a492-d36f2de1ac83",
|
|
"port": "out-1",
|
|
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"startDirections": [
|
|
"right"
|
|
],
|
|
"target": {
|
|
"id": "5578c85f-4a27-401e-be14-7793e82b92c5",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"type": "link",
|
|
"z": 1009
|
|
},
|
|
{
|
|
"0": "S",
|
|
"1": "T",
|
|
"2": "A",
|
|
"3": "R",
|
|
"4": "T",
|
|
"active": false,
|
|
"angle": 0,
|
|
"attrs": {
|
|
".background": {
|
|
"fill": "#000000",
|
|
"stroke": "#5C6773"
|
|
},
|
|
".color-band": {
|
|
"fill": "#3C444D"
|
|
},
|
|
".outPorts>.port-out": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".outPorts>.port-out>.port-body": {
|
|
"port": {
|
|
"id": "out",
|
|
"type": "out"
|
|
}
|
|
},
|
|
".title": {
|
|
"ref-x": 33,
|
|
"ref-y": 8,
|
|
"text": "START"
|
|
},
|
|
"g.delete": {
|
|
"display": "none"
|
|
},
|
|
"g.error": {
|
|
"opacity": 0
|
|
},
|
|
"g.icon image": {
|
|
"ref-x": 13,
|
|
"xlink:href": "/inc/coa/img/block_icon_start.svg"
|
|
},
|
|
"g.notes": {
|
|
"display": "block"
|
|
}
|
|
},
|
|
"block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'hunt_domain_1' block\n hunt_domain_1(container=container)\n\n # call 'hunt_file_1' block\n hunt_file_1(container=container)\n\n # call 'run_query_1' block\n run_query_1(container=container)\n\n return",
|
|
"callback_code": "# read-only block view not available",
|
|
"callback_start": 1,
|
|
"callsback": false,
|
|
"connected_to_start": true,
|
|
"connection_name": "",
|
|
"connection_type": "",
|
|
"custom_callback": "",
|
|
"custom_code": "",
|
|
"custom_join": "",
|
|
"custom_name": "",
|
|
"description": "",
|
|
"has_custom": false,
|
|
"has_custom_block": false,
|
|
"has_custom_callback": false,
|
|
"has_custom_join": false,
|
|
"id": "316c9705-7ae6-421d-8e39-09ed4d5eaf72",
|
|
"inPorts": [],
|
|
"join_code": "# read-only block view not available",
|
|
"join_optional": [],
|
|
"join_start": 1,
|
|
"line_end": 64,
|
|
"line_start": 50,
|
|
"name": "",
|
|
"notes": "",
|
|
"number": 0,
|
|
"order": 1,
|
|
"outPorts": [
|
|
"out"
|
|
],
|
|
"ports": {
|
|
"groups": {
|
|
"in": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "left"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "left"
|
|
}
|
|
},
|
|
"out": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "right"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "right"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"position": {
|
|
"x": 120,
|
|
"y": 60
|
|
},
|
|
"previous_function": "",
|
|
"previous_name": "",
|
|
"show_number": true,
|
|
"size": {
|
|
"height": 54,
|
|
"width": 80
|
|
},
|
|
"status": "",
|
|
"title": "START",
|
|
"type": "coa.StartEnd",
|
|
"warn": false,
|
|
"z": 1197
|
|
},
|
|
{
|
|
"0": "E",
|
|
"1": "N",
|
|
"2": "D",
|
|
"active": false,
|
|
"angle": 0,
|
|
"attrs": {
|
|
".background": {
|
|
"fill": "#000000",
|
|
"stroke": "#5C6773"
|
|
},
|
|
".color-band": {
|
|
"fill": "#3C444D"
|
|
},
|
|
".inPorts>.port-in": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".inPorts>.port-in>.port-body": {
|
|
"port": {
|
|
"id": "in",
|
|
"type": "in"
|
|
}
|
|
},
|
|
".title": {
|
|
"text": "END"
|
|
},
|
|
"g.delete": {
|
|
"display": "none"
|
|
},
|
|
"g.error": {
|
|
"opacity": 0
|
|
},
|
|
"g.icon image": {
|
|
"xlink:href": "/inc/coa/img/block_icon_end.svg"
|
|
},
|
|
"g.notes": {
|
|
"display": "block"
|
|
}
|
|
},
|
|
"block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return",
|
|
"callback_code": "# read-only block view not available",
|
|
"callback_start": 1,
|
|
"callsback": false,
|
|
"connected_to_start": true,
|
|
"connection_name": "get system info, detonate file, run query",
|
|
"connection_type": "action",
|
|
"custom_callback": "",
|
|
"custom_code": "",
|
|
"custom_join": "",
|
|
"custom_name": "",
|
|
"description": "",
|
|
"has_custom": false,
|
|
"has_custom_block": false,
|
|
"has_custom_callback": false,
|
|
"has_custom_join": false,
|
|
"id": "65cec994-6cd3-47da-849a-f015982d8a23",
|
|
"inPorts": [
|
|
"in"
|
|
],
|
|
"join_code": "# read-only block view not available",
|
|
"join_optional": [],
|
|
"join_start": 1,
|
|
"line_end": 373,
|
|
"line_start": 360,
|
|
"name": "",
|
|
"notes": "",
|
|
"number": 0,
|
|
"order": 13,
|
|
"outPorts": [],
|
|
"ports": {
|
|
"groups": {
|
|
"in": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "left"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "left"
|
|
}
|
|
},
|
|
"out": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "right"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "right"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"position": {
|
|
"x": 1660,
|
|
"y": 340
|
|
},
|
|
"previous_function": "",
|
|
"previous_name": "",
|
|
"show_number": true,
|
|
"size": {
|
|
"height": 54,
|
|
"width": 80
|
|
},
|
|
"status": "",
|
|
"title": "END",
|
|
"type": "coa.StartEnd",
|
|
"warn": false,
|
|
"z": 1273
|
|
},
|
|
{
|
|
"action": "get system info",
|
|
"action_type": "investigate",
|
|
"active": false,
|
|
"active_keys": {},
|
|
"active_values": {
|
|
"ip_hostname": "filtered-artifact:*.cef.sourceAddress"
|
|
},
|
|
"angle": 0,
|
|
"app": "",
|
|
"approver": "",
|
|
"assets": [
|
|
{
|
|
"action": "",
|
|
"active": true,
|
|
"app_name": "",
|
|
"app_version": "",
|
|
"appid": "",
|
|
"config_type": "asset",
|
|
"fields": {
|
|
"ip_hostname": "filtered-artifact:*.cef.sourceAddress",
|
|
"sensor_id": ""
|
|
},
|
|
"has_app": true,
|
|
"id": "-",
|
|
"loaded": false,
|
|
"missing": false,
|
|
"name": "carbonblack",
|
|
"output": [
|
|
{
|
|
"contains": [
|
|
"carbon black sensor id"
|
|
],
|
|
"data_path": "action_result.parameter.sensor_id",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"contains": [
|
|
"host name",
|
|
"ip"
|
|
],
|
|
"data_path": "action_result.parameter.ip_hostname",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.status",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.message",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.systemvolume_total_size",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"column_name": "OS",
|
|
"column_order": 4,
|
|
"data_path": "action_result.data.*.os_environment_display_string",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.systemvolume_free_size",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.physical_memory_size",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.shard_id",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.clock_delta",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.supports_cblr",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.sensor_uptime",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"column_name": "Is Isolated?",
|
|
"column_order": 2,
|
|
"data_path": "action_result.data.*.is_isolating",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"column_name": "Sensor ID",
|
|
"column_order": 5,
|
|
"contains": [
|
|
"carbon black sensor id"
|
|
],
|
|
"data_path": "action_result.data.*.id",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.build_id",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.uptime",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"column_name": "DNS Name",
|
|
"column_order": 3,
|
|
"data_path": "action_result.data.*.computer_dns_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.last_update",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.power_state",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.next_checkin_time",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"column_name": "Status",
|
|
"column_order": 2,
|
|
"data_path": "action_result.data.*.status",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.num_eventlog_bytes",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.sensor_health_status",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.sensor_health_message",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.build_version_string",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.computer_sid",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.node_id",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.cookie",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"column_name": "Name",
|
|
"column_order": 0,
|
|
"contains": [
|
|
"host name"
|
|
],
|
|
"data_path": "action_result.data.*.computer_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.license_expiration",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"column_name": "Supports Isolation?",
|
|
"column_order": 4,
|
|
"data_path": "action_result.data.*.supports_isolation",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.parity_host_id",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.supports_2nd_gen_modloads",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.network_adapters",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"column_name": "IP Addresses",
|
|
"column_order": 1,
|
|
"data_path": "action_result.data.*.ips",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"column_name": "Isolation Enabled?",
|
|
"column_order": 3,
|
|
"data_path": "action_result.data.*.network_isolation_enabled",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.registration_time",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.restart_queued",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.num_storefiles_bytes",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.os_environment_id",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.boot_id",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.last_checkin_time",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.group_id",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.display",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.uninstall",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.event_log_flush_time",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.emet_telemetry_path",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.emet_version",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.emet_report_setting",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.emet_exploit_action",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.emet_is_gpo",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.emet_dump_flags",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.summary.total_endpoints",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "summary.total_objects",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "summary.total_objects_successful",
|
|
"data_type": "numeric"
|
|
}
|
|
],
|
|
"product_name": "",
|
|
"product_vendor": "",
|
|
"type": "endpoint"
|
|
}
|
|
],
|
|
"attrs": {
|
|
".action": {
|
|
"text": "get system info"
|
|
},
|
|
".background": {
|
|
"fill": "#000000",
|
|
"stroke": "#5C6773"
|
|
},
|
|
".border": {
|
|
"stroke": "#5094D4"
|
|
},
|
|
".color-band": {
|
|
"fill": "#3C444D"
|
|
},
|
|
".inPorts>.port-in": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".inPorts>.port-in>.port-body": {
|
|
"port": {
|
|
"id": "in",
|
|
"type": "in"
|
|
}
|
|
},
|
|
".message": {
|
|
"fill": "#FFFFFF",
|
|
"font-size": 12,
|
|
"font-weight": 300,
|
|
"opacity": 0,
|
|
"ref": ".background",
|
|
"ref-x": 5,
|
|
"ref-y": 105,
|
|
"text": "Configuring now"
|
|
},
|
|
".outPorts>.port-out": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".outPorts>.port-out>.port-body": {
|
|
"port": {
|
|
"id": "out",
|
|
"type": "out"
|
|
}
|
|
},
|
|
".title": {
|
|
"text": "Investigate"
|
|
},
|
|
"g.approver image": {
|
|
"opacity": 1
|
|
},
|
|
"g.code image": {
|
|
"opacity": 1,
|
|
"xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg"
|
|
},
|
|
"g.delete": {
|
|
"display": "none"
|
|
},
|
|
"g.error": {
|
|
"opacity": 0
|
|
},
|
|
"g.icon image": {
|
|
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
|
|
},
|
|
"g.notes": {
|
|
"display": "block"
|
|
},
|
|
"g.notes image": {
|
|
"opacity": 1
|
|
},
|
|
"g.timer image": {
|
|
"opacity": 1
|
|
},
|
|
"rect.warn-background": {
|
|
"fill": "#5094D4"
|
|
},
|
|
"text.icon": {
|
|
"fill": "#5094D4"
|
|
}
|
|
},
|
|
"block_code": "# read-only block view not available",
|
|
"callback_code": "",
|
|
"callback_start": 1,
|
|
"callsback": true,
|
|
"color": "#654796",
|
|
"connected_to_start": false,
|
|
"connection_name": "hunt domain",
|
|
"connection_type": "action",
|
|
"custom_callback": "",
|
|
"custom_code": "def get_system_info_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n assets = get_specific_assets(\"get system info\", [\"Carbon Black\"])\n \n if (not assets):\n phantom.debug(\"Carbon Black::get system info not found returning.\")\n \n # collect data for 'get_system_info_1' call\n filtered_container_data = phantom.collect2(container=container, datapath=['filtered-artifact:*.cef.sourceAddress', 'filtered-artifact:*.id'], filter_artifacts=filtered_artifacts)\n\n parameters = []\n \n # build parameters list for 'get_system_info_1' call\n for filtered_container_item in filtered_container_data:\n if filtered_container_item[0]:\n parameters.append({\n 'ip_hostname': filtered_container_item[0],\n })\n\n if parameters:\n phantom.act(\"get system info\", parameters=parameters, assets=assets, name=\"get_system_info_1\") \n else:\n phantom.error(\"'get_system_info_1' will not be executed due to lack of parameters\")\n \n return",
|
|
"custom_join": "",
|
|
"custom_name": "",
|
|
"delay": "0",
|
|
"description": "",
|
|
"has_custom": true,
|
|
"has_custom_block": true,
|
|
"has_custom_callback": false,
|
|
"has_custom_join": false,
|
|
"id": "666fe7a3-1c31-4238-ba36-ea3cfd8d2884",
|
|
"inPorts": [
|
|
"in"
|
|
],
|
|
"join_code": "",
|
|
"join_optional": [],
|
|
"join_start": 1,
|
|
"line_end": 110,
|
|
"line_start": 84,
|
|
"message": "Configuring now",
|
|
"name": "get system info",
|
|
"notes": "",
|
|
"number": 1,
|
|
"order": 3,
|
|
"outPorts": [
|
|
"out"
|
|
],
|
|
"ports": {
|
|
"groups": {
|
|
"in": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "left"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "left"
|
|
}
|
|
},
|
|
"out": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "right"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "right"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"position": {
|
|
"x": 640,
|
|
"y": 40
|
|
},
|
|
"previous_block_type": "",
|
|
"previous_function": "",
|
|
"previous_name": "get_system_info_1",
|
|
"required_params": {},
|
|
"reviewer": "",
|
|
"showNumber": false,
|
|
"show_number": false,
|
|
"size": {
|
|
"height": 112,
|
|
"width": 168
|
|
},
|
|
"state": "asset",
|
|
"status": "",
|
|
"title": "Investigate",
|
|
"type": "coa.Action",
|
|
"warn": false,
|
|
"z": 1320
|
|
},
|
|
{
|
|
"attrs": {
|
|
".connection": {
|
|
"stroke": "#6C7A89",
|
|
"stroke-width": 2
|
|
},
|
|
".marker-target": {
|
|
"d": "M 10 0 L 0 5 L 10 10 z",
|
|
"fill": "#6a6c8a",
|
|
"stroke": "#6a6c8a"
|
|
}
|
|
},
|
|
"connector": {
|
|
"args": {
|
|
"radius": 5
|
|
},
|
|
"name": "rounded"
|
|
},
|
|
"endDirections": [
|
|
"left"
|
|
],
|
|
"id": "1f411c3a-1b14-4e69-9501-b9110eb433be",
|
|
"router": {
|
|
"name": "metro"
|
|
},
|
|
"source": {
|
|
"id": "e07929c3-d5ce-44c1-b08d-3b4fede3bc59",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"startDirections": [
|
|
"right"
|
|
],
|
|
"target": {
|
|
"id": "65cec994-6cd3-47da-849a-f015982d8a23",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"type": "link",
|
|
"vertices": [
|
|
{
|
|
"x": 1620,
|
|
"y": 220
|
|
}
|
|
],
|
|
"z": 1336
|
|
},
|
|
{
|
|
"attrs": {
|
|
".connection": {
|
|
"stroke": "#6C7A89",
|
|
"stroke-width": 2
|
|
},
|
|
".marker-target": {
|
|
"d": "M 10 0 L 0 5 L 10 10 z",
|
|
"fill": "#6a6c8a",
|
|
"stroke": "#6a6c8a"
|
|
}
|
|
},
|
|
"connector": {
|
|
"args": {
|
|
"radius": 5
|
|
},
|
|
"name": "rounded"
|
|
},
|
|
"endDirections": [
|
|
"left"
|
|
],
|
|
"id": "b859523d-1b6a-4d34-898d-3e5d5372a8ef",
|
|
"router": {
|
|
"name": "metro"
|
|
},
|
|
"source": {
|
|
"id": "8c6c1d82-e40b-4f58-b6c0-cc8c40791cae",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"startDirections": [
|
|
"right"
|
|
],
|
|
"target": {
|
|
"id": "65cec994-6cd3-47da-849a-f015982d8a23",
|
|
"port": null,
|
|
"selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
|
|
},
|
|
"type": "link",
|
|
"z": 1337
|
|
},
|
|
{
|
|
"active": false,
|
|
"angle": 0,
|
|
"attrs": {
|
|
".background": {
|
|
"fill": "#000000",
|
|
"stroke": "#5C6773",
|
|
"transform": "rotate(45 30 70)"
|
|
},
|
|
".border": {
|
|
"stroke": "#5094D4",
|
|
"transform": "rotate(45 30 70)"
|
|
},
|
|
".inPorts>.port-0>.port-body": {
|
|
"port": {
|
|
"id": "in",
|
|
"type": "in"
|
|
}
|
|
},
|
|
".number": {
|
|
"text": 4
|
|
},
|
|
".outPorts>.port-0": {
|
|
"port": {
|
|
"id": "out-1",
|
|
"type": "out"
|
|
},
|
|
"ref-x": 83,
|
|
"ref-y": 40
|
|
},
|
|
".outPorts>.port-0>.port-body": {
|
|
"port": {
|
|
"id": "out-1",
|
|
"type": "out"
|
|
}
|
|
},
|
|
"g.delete": {
|
|
"display": "none"
|
|
},
|
|
"g.error": {
|
|
"opacity": 0
|
|
},
|
|
"g.notes": {
|
|
"display": "block"
|
|
},
|
|
"g.notes image": {
|
|
"opacity": 1
|
|
}
|
|
},
|
|
"block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_4() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"hunt_file_1:action_result.data.*.binary.total_results\", \">\", 0],\n [\"artifact:*.cef.fileHash\", \"==\", \"hunt_file_1:action_result.parameter.hash\"],\n ],\n logical_operator='and',\n name=\"filter_4:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n file_reputation_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
|
|
"callback_code": "",
|
|
"callback_start": 1,
|
|
"callsback": false,
|
|
"connected_to_start": true,
|
|
"connection_name": "hunt file",
|
|
"connection_type": "action",
|
|
"custom_callback": "",
|
|
"custom_code": "",
|
|
"custom_join": "",
|
|
"custom_name": "",
|
|
"description": "",
|
|
"hasElse": false,
|
|
"has_custom": false,
|
|
"has_custom_block": false,
|
|
"has_custom_callback": false,
|
|
"has_custom_join": false,
|
|
"id": "c79812bd-7079-4317-a492-d36f2de1ac83",
|
|
"inPorts": [
|
|
"in"
|
|
],
|
|
"join_code": "",
|
|
"join_optional": [],
|
|
"join_start": 1,
|
|
"line_end": 130,
|
|
"line_start": 110,
|
|
"name": "filter",
|
|
"notes": "",
|
|
"number": 4,
|
|
"order": 4,
|
|
"outPorts": [
|
|
"out-1"
|
|
],
|
|
"outputs": [
|
|
{
|
|
"conditions": [
|
|
{
|
|
"comparison": ">",
|
|
"data_type": "",
|
|
"param": "hunt_file_1:action_result.data.*.binary.total_results",
|
|
"value": "0"
|
|
},
|
|
{
|
|
"comparison": "==",
|
|
"data_type": "",
|
|
"param": "artifact:*.cef.fileHash",
|
|
"value": "hunt_file_1:action_result.parameter.hash"
|
|
}
|
|
],
|
|
"display": "If",
|
|
"logic": "and",
|
|
"type": "if"
|
|
}
|
|
],
|
|
"ports": {
|
|
"groups": {
|
|
"in": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "left"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "left"
|
|
}
|
|
},
|
|
"out": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "right"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "right"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"position": {
|
|
"x": 500,
|
|
"y": 180
|
|
},
|
|
"previous_block_type": "",
|
|
"previous_function": "",
|
|
"previous_name": "filter_4",
|
|
"show_number": true,
|
|
"size": {
|
|
"height": 82,
|
|
"width": 82
|
|
},
|
|
"state": "filter",
|
|
"status": "",
|
|
"type": "coa.Filter",
|
|
"warn": false,
|
|
"z": 1343
|
|
},
|
|
{
|
|
"active": false,
|
|
"angle": 0,
|
|
"attrs": {
|
|
".background": {
|
|
"fill": "#000000",
|
|
"stroke": "#5C6773",
|
|
"transform": "rotate(45 30 70)"
|
|
},
|
|
".border": {
|
|
"stroke": "#5094D4",
|
|
"transform": "rotate(45 30 70)"
|
|
},
|
|
".inPorts>.port-0>.port-body": {
|
|
"port": {
|
|
"id": "in",
|
|
"type": "in"
|
|
}
|
|
},
|
|
".number": {
|
|
"text": 2
|
|
},
|
|
".outPorts>.port-0": {
|
|
"port": {
|
|
"id": "out-1",
|
|
"type": "out"
|
|
},
|
|
"ref-x": 83,
|
|
"ref-y": 40
|
|
},
|
|
".outPorts>.port-0>.port-body": {
|
|
"port": {
|
|
"id": "out-1",
|
|
"type": "out"
|
|
}
|
|
},
|
|
"g.delete": {
|
|
"display": "none"
|
|
},
|
|
"g.error": {
|
|
"opacity": 0
|
|
},
|
|
"g.notes": {
|
|
"display": "block"
|
|
},
|
|
"g.notes image": {
|
|
"opacity": 1
|
|
}
|
|
},
|
|
"block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"action_result.summary.positives\", \"==\", 0],\n [\"artifact:*.cef.fileHash\", \"==\", \"file_reputation_1:action_result.parameter.hash\"],\n ],\n logical_operator='and',\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n get_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
|
|
"callback_code": "",
|
|
"callback_start": 1,
|
|
"callsback": false,
|
|
"connected_to_start": true,
|
|
"connection_name": "file reputation",
|
|
"connection_type": "action",
|
|
"custom_callback": "",
|
|
"custom_code": "",
|
|
"custom_join": "",
|
|
"custom_name": "",
|
|
"description": "",
|
|
"hasElse": false,
|
|
"has_custom": false,
|
|
"has_custom_block": false,
|
|
"has_custom_callback": false,
|
|
"has_custom_join": false,
|
|
"id": "7ca41dcf-c8bd-46f4-bb7d-6df6d254c01f",
|
|
"inPorts": [
|
|
"in"
|
|
],
|
|
"join_code": "",
|
|
"join_optional": [],
|
|
"join_start": 1,
|
|
"line_end": 150,
|
|
"line_start": 130,
|
|
"name": "filter",
|
|
"notes": "",
|
|
"number": 2,
|
|
"order": 5,
|
|
"outPorts": [
|
|
"out-1"
|
|
],
|
|
"outputs": [
|
|
{
|
|
"conditions": [
|
|
{
|
|
"comparison": "==",
|
|
"data_type": "",
|
|
"param": "action_result.summary.positives",
|
|
"value": "0"
|
|
},
|
|
{
|
|
"comparison": "==",
|
|
"data_type": "",
|
|
"param": "artifact:*.cef.fileHash",
|
|
"value": "file_reputation_1:action_result.parameter.hash"
|
|
}
|
|
],
|
|
"display": "If",
|
|
"logic": "and",
|
|
"type": "if"
|
|
}
|
|
],
|
|
"ports": {
|
|
"groups": {
|
|
"in": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "left"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "left"
|
|
}
|
|
},
|
|
"out": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "right"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "right"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"position": {
|
|
"x": 880,
|
|
"y": 180
|
|
},
|
|
"previous_block_type": "",
|
|
"previous_function": "",
|
|
"previous_name": "filter_2",
|
|
"show_number": true,
|
|
"size": {
|
|
"height": 82,
|
|
"width": 82
|
|
},
|
|
"state": "filter",
|
|
"status": "",
|
|
"type": "coa.Filter",
|
|
"warn": false,
|
|
"z": 1345
|
|
},
|
|
{
|
|
"action": "get file",
|
|
"action_type": "investigate",
|
|
"active": false,
|
|
"active_keys": {},
|
|
"active_values": {
|
|
"hash": "filtered-artifact:*.cef.fileHash"
|
|
},
|
|
"angle": 0,
|
|
"app": "",
|
|
"approver": "",
|
|
"assets": [
|
|
{
|
|
"action": "",
|
|
"active": true,
|
|
"app_name": "",
|
|
"app_version": "",
|
|
"appid": "",
|
|
"config_type": "asset",
|
|
"fields": {
|
|
"hash": "filtered-artifact:*.cef.fileHash"
|
|
},
|
|
"has_app": true,
|
|
"id": "-",
|
|
"loaded": false,
|
|
"missing": false,
|
|
"name": "carbonblack",
|
|
"output": [
|
|
{
|
|
"data_path": "action_result.data.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"column_name": "Vault ID",
|
|
"column_order": 1,
|
|
"contains": [
|
|
"vault id"
|
|
],
|
|
"data_path": "action_result.data.*.vault_id",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"column_name": "MD5",
|
|
"column_order": 0,
|
|
"contains": [
|
|
"md5",
|
|
"hash"
|
|
],
|
|
"data_path": "action_result.data.*.file_details.md5",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.icon",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.group",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.signed",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.os_type",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.endpoint",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.is_64bit",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.file_desc",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.last_seen",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.timestamp",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.cb_version",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.host_count",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.watchlists.*.wid",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.watchlists.*.value",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.company_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.file_version",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.orig_mod_len",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.product_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.digsig_result",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.internal_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.copied_mod_len",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.legal_copyright",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.product_version",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.digsig_publisher",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.digsig_sign_time",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.observed_filename",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.original_filename",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.digsig_result_code",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.is_executable_image",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.file_details.server_added_timestamp",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.status",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.message",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.summary.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"vault id"
|
|
],
|
|
"data_path": "action_result.summary.vault_id",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.summary.file_type",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"md5"
|
|
],
|
|
"data_path": "action_result.parameter.hash",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "summary.total_objects",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "summary.total_objects_successful",
|
|
"data_type": "numeric"
|
|
}
|
|
],
|
|
"product_name": "",
|
|
"product_vendor": "",
|
|
"type": "endpoint"
|
|
}
|
|
],
|
|
"attrs": {
|
|
".action": {
|
|
"text": "get file"
|
|
},
|
|
".background": {
|
|
"fill": "#000000",
|
|
"stroke": "#5C6773"
|
|
},
|
|
".border": {
|
|
"stroke": "#5094D4"
|
|
},
|
|
".color-band": {
|
|
"fill": "#3C444D"
|
|
},
|
|
".inPorts>.port-in": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".inPorts>.port-in>.port-body": {
|
|
"port": {
|
|
"id": "in",
|
|
"type": "in"
|
|
}
|
|
},
|
|
".message": {
|
|
"fill": "#FFFFFF",
|
|
"font-size": 12,
|
|
"font-weight": 300,
|
|
"opacity": 0,
|
|
"ref": ".background",
|
|
"ref-x": 5,
|
|
"ref-y": 105,
|
|
"text": "Configuring now"
|
|
},
|
|
".outPorts>.port-out": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".outPorts>.port-out>.port-body": {
|
|
"port": {
|
|
"id": "out",
|
|
"type": "out"
|
|
}
|
|
},
|
|
".title": {
|
|
"text": "Investigate"
|
|
},
|
|
"g.approver image": {
|
|
"opacity": 1
|
|
},
|
|
"g.code image": {
|
|
"opacity": 1,
|
|
"xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg"
|
|
},
|
|
"g.delete": {
|
|
"display": "none"
|
|
},
|
|
"g.error": {
|
|
"opacity": 0
|
|
},
|
|
"g.icon image": {
|
|
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
|
|
},
|
|
"g.notes": {
|
|
"display": "block"
|
|
},
|
|
"g.notes image": {
|
|
"opacity": 1
|
|
},
|
|
"g.timer image": {
|
|
"opacity": 1
|
|
},
|
|
"rect.warn-background": {
|
|
"fill": "#5094D4"
|
|
},
|
|
"text.icon": {
|
|
"fill": "#5094D4"
|
|
}
|
|
},
|
|
"block_code": "# read-only block view not available",
|
|
"callback_code": "",
|
|
"callback_start": 1,
|
|
"callsback": true,
|
|
"color": "#654796",
|
|
"connected_to_start": true,
|
|
"connection_name": "file reputation",
|
|
"connection_type": "action",
|
|
"custom_callback": "",
|
|
"custom_code": "def get_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n assets = get_specific_assets(\"get file\", [\"Carbon Black\"])\n \n if (not assets):\n phantom.debug(\"Carbon Black::get file not found returning.\")\n \n # collect data for 'get_file_2' call\n filtered_container_data = phantom.collect2(container=container, datapath=['filtered-artifact:*.cef.fileHash', 'filtered-artifact:*.id'], filter_artifacts=filtered_artifacts)\n\n parameters = []\n \n # build parameters list for 'get_file_2' call\n for filtered_container_item in filtered_container_data:\n if filtered_container_item[0]:\n parameters.append({\n 'hash': filtered_container_item[0],\n })\n\n if parameters:\n phantom.act(\"get file\", parameters=parameters, assets=assets, callback=filter_3, name=\"get_file_2\") \n else:\n phantom.error(\"'get_file_2' will not be executed due to lack of parameters\")\n \n return",
|
|
"custom_join": "",
|
|
"custom_name": "",
|
|
"delay": "0",
|
|
"description": "",
|
|
"has_custom": true,
|
|
"has_custom_block": true,
|
|
"has_custom_callback": false,
|
|
"has_custom_join": false,
|
|
"id": "9052a241-042b-4189-b56d-fcc0bf461cc6",
|
|
"inPorts": [
|
|
"in"
|
|
],
|
|
"join_code": "",
|
|
"join_optional": [],
|
|
"join_start": 1,
|
|
"line_end": 205,
|
|
"line_start": 179,
|
|
"message": "Configuring now",
|
|
"name": "get file",
|
|
"notes": "",
|
|
"number": 2,
|
|
"order": 7,
|
|
"outPorts": [
|
|
"out"
|
|
],
|
|
"ports": {
|
|
"groups": {
|
|
"in": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "left"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "left"
|
|
}
|
|
},
|
|
"out": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "right"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "right"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"position": {
|
|
"x": 1020,
|
|
"y": 180
|
|
},
|
|
"previous_block_type": "",
|
|
"previous_function": "",
|
|
"previous_name": "get_file_2",
|
|
"required_params": {
|
|
"hash": true
|
|
},
|
|
"reviewer": "",
|
|
"showNumber": false,
|
|
"show_number": false,
|
|
"size": {
|
|
"height": 112,
|
|
"width": 168
|
|
},
|
|
"state": "asset",
|
|
"status": "",
|
|
"title": "Investigate",
|
|
"type": "coa.Action",
|
|
"warn": false,
|
|
"z": 1350
|
|
},
|
|
{
|
|
"action": "detonate file",
|
|
"action_type": "investigate",
|
|
"active": false,
|
|
"active_keys": {},
|
|
"active_values": {
|
|
"file_name": "",
|
|
"force_analysis": "",
|
|
"private": "",
|
|
"vault_id": "get_file_2:filtered-action_result.data.*.vault_id",
|
|
"vm": ""
|
|
},
|
|
"angle": 0,
|
|
"app": "",
|
|
"approver": "",
|
|
"assets": [
|
|
{
|
|
"action": "",
|
|
"active": true,
|
|
"app_name": "",
|
|
"app_version": "",
|
|
"appid": "",
|
|
"config_type": "asset",
|
|
"fields": {
|
|
"file_name": "",
|
|
"force_analysis": "",
|
|
"private": "",
|
|
"vault_id": "get_file_2:filtered-action_result.data.*.vault_id",
|
|
"vm": ""
|
|
},
|
|
"has_app": true,
|
|
"id": "-",
|
|
"loaded": false,
|
|
"missing": false,
|
|
"name": "threatgrid",
|
|
"output": [
|
|
{
|
|
"contains": [
|
|
"threatgrid task id"
|
|
],
|
|
"data_path": "action_result.summary.id",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"url"
|
|
],
|
|
"data_path": "action_result.summary.results_url",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"file name"
|
|
],
|
|
"data_path": "action_result.summary.target",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"md5"
|
|
],
|
|
"data_path": "action_result.data.*.report.disk.mbr.hashes.curr.md5",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"sha1"
|
|
],
|
|
"data_path": "action_result.data.*.report.disk.mbr.hashes.curr.sha1",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"sha256"
|
|
],
|
|
"data_path": "action_result.data.*.report.disk.mbr.hashes.curr.sha256",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"md5"
|
|
],
|
|
"data_path": "action_result.data.*.report.disk.mbr.hashes.orig.md5",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"sha1"
|
|
],
|
|
"data_path": "action_result.data.*.report.disk.mbr.hashes.orig.sha1",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"sha256"
|
|
],
|
|
"data_path": "action_result.data.*.report.disk.mbr.hashes.orig.sha256",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.disk.mbr.changed",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.disk.mbr.contents.curr",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.disk.mbr.contents.orig",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.disk.partition_tables.curr.*.size",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.disk.partition_tables.curr.*.type",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.disk.partition_tables.curr.*.start",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.disk.partition_tables.orig.*.size",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.disk.partition_tables.orig.*.type",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.disk.partition_tables.orig.*.start",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.disk.partition_tables.changed",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.iocs.*.ioc",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"url"
|
|
],
|
|
"data_path": "action_result.data.*.report.iocs.*.data.*.URL",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.iocs.*.data.*.Method",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.iocs.*.data.*.Network_Stream",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.iocs.*.hits",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.iocs.*.tags",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.iocs.*.title",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.iocs.*.category",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.iocs.*.severity",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.iocs.*.truncated",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.iocs.*.confidence",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.iocs.*.description",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.status.id",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.status.vm",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"md5"
|
|
],
|
|
"data_path": "action_result.data.*.report.status.md5",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"sha1"
|
|
],
|
|
"data_path": "action_result.data.*.report.status.sha1",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.status.origin",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"sha256"
|
|
],
|
|
"data_path": "action_result.data.*.report.status.sha256",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"url"
|
|
],
|
|
"data_path": "action_result.data.*.report.status.done_url",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.status.running_on",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.status.vm_runtime",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.status.original_filename",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.status.analysis_started_at",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.status.analysis_submitted_at",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.new",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"contains": [
|
|
"pid"
|
|
],
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.pid",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.kpid",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.proc",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.time",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.monitored",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.process_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.tid",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.upid",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.uthread",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.dll_path",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.shell_info",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.command_line",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.desktop_info",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.runtime_data",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.window_title",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.image_pathname",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.current_directory",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.analyzed_because",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_read.*.key_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_read.*.key_value",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.access",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.options",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.dst",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.src",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.uid",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.bytes",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.ts_end",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.history",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.packets",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.service",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.session",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"contains": [
|
|
"port"
|
|
],
|
|
"data_path": "action_result.data.*.report.network.*.dst_port",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.duration",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"contains": [
|
|
"port"
|
|
],
|
|
"data_path": "action_result.data.*.report.network.*.src_port",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.ts_begin",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.transport",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.bytes_orig",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.bytes_resp",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.conn_state",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.bytes_missed",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.packets_orig",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.packets_resp",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.bytes_payload",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.bytes_orig_payload",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.network.*.bytes_resp_payload",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.version",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"md5"
|
|
],
|
|
"data_path": "action_result.data.*.report.metadata.malware_desc.*.md5",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"sha1"
|
|
],
|
|
"data_path": "action_result.data.*.report.metadata.malware_desc.*.sha1",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.malware_desc.*.size",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.malware_desc.*.type",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.malware_desc.*.magic",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"md5"
|
|
],
|
|
"data_path": "action_result.data.*.report.metadata.malware_desc.*.sha256",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.malware_desc.*.filename",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.sandcastle_env.vm",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.sandcastle_env.vm_id",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.sandcastle_env.run_time",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.sandcastle_env.current_os",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.sandcastle_env.sandcastle",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.sandcastle_env.analysis_end",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.sandcastle_env.analysis_start",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.sandcastle_env.controlsubject",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.sandcastle_env.sample_executed",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.general_details.sandbox_id",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.general_details.report_created",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.metadata.general_details.sandbox_version",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.versions.file.js",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.versions.file.pe",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.versions.file.ini",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.versions.file.lnk",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.versions.file.pdf",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.versions.file.rtf",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.versions.file.txt",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.versions.file.html",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.versions.file.version",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.versions.network.version",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.versions.version",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.created-time",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.entropy",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.exports",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.company_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.copyright",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.file_description",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.file_version",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.internal_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.original_file_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.product_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.product_version",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.checksum",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.header_relocations",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_code_segment",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_instruction_pointer",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_stack_pointer",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_stack_segment",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.pages",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.size_in_paragraphs",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.import_hash",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.number_of_symbols",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.actual_checksum",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.claimed_checksum",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.entrypoint_address",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.file_alignment",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.linker_major_version",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.linker_minor_version",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.loader_flag",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.number_of_rva_and_sizes",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.reserved_field",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.section_alignment",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.size",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.subsystem",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.signed",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.timestamp",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.imports.*.dll",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.imports.*.entries",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.internal_checksum_match",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.codepage",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.language",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.locale",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.offset",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.path",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.resource_sha256",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.size",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.sublanguage",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.type",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.address",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.characteristics",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.data_pointer",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.entropy",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.entropy_type",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"url"
|
|
],
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.Sections.InternetShortcut.Properties.URL",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.section",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.section_hash",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.size",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.virtual_size",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.signatures",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.tag_attrs",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.tags",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.forensics.urls",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.magic-type",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"md5"
|
|
],
|
|
"data_path": "action_result.data.*.report.artifacts.*.md5",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.mime-type",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.origin",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.path",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.relation.network",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.relation.process",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"sha1"
|
|
],
|
|
"data_path": "action_result.data.*.report.artifacts.*.sha1",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"sha256"
|
|
],
|
|
"data_path": "action_result.data.*.report.artifacts.*.sha256",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.size",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.artifacts.*.type",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.report.annotations.network.*.ts",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.status.id",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.status.os",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"md5"
|
|
],
|
|
"data_path": "action_result.data.*.status.md5",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"sha1"
|
|
],
|
|
"data_path": "action_result.data.*.status.sha1",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.status.login",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.status.state",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"sha256"
|
|
],
|
|
"data_path": "action_result.data.*.status.sha256",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.status.status",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.status.filename",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.status.started_at",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.status.completed_at",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.status.submitted_at",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.status.submission_id",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.threat.bis",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.threat.count",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.threat.score",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.threat.sample",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.threat.max-severity",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.threat.max-confidence",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.status",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.message",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"file name"
|
|
],
|
|
"data_path": "action_result.parameter.file_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.parameter.force_analysis",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"contains": [
|
|
"vault id",
|
|
"pe file",
|
|
"pdf"
|
|
],
|
|
"data_path": "action_result.parameter.vault_id",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.parameter.vm",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.parameter.private",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "summary.total_objects",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "summary.total_objects_successful",
|
|
"data_type": "numeric"
|
|
}
|
|
],
|
|
"product_name": "",
|
|
"product_vendor": "",
|
|
"type": "sandbox"
|
|
}
|
|
],
|
|
"attrs": {
|
|
".action": {
|
|
"text": "detonate file"
|
|
},
|
|
".background": {
|
|
"fill": "#000000",
|
|
"stroke": "#5C6773"
|
|
},
|
|
".border": {
|
|
"stroke": "#5094D4"
|
|
},
|
|
".color-band": {
|
|
"fill": "#3C444D"
|
|
},
|
|
".inPorts>.port-in": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".inPorts>.port-in>.port-body": {
|
|
"port": {
|
|
"id": "in",
|
|
"type": "in"
|
|
}
|
|
},
|
|
".message": {
|
|
"fill": "#FFFFFF",
|
|
"font-size": 12,
|
|
"font-weight": 300,
|
|
"opacity": 0,
|
|
"ref": ".background",
|
|
"ref-x": 5,
|
|
"ref-y": 105,
|
|
"text": "Configuring now"
|
|
},
|
|
".outPorts>.port-out": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".outPorts>.port-out>.port-body": {
|
|
"port": {
|
|
"id": "out",
|
|
"type": "out"
|
|
}
|
|
},
|
|
".title": {
|
|
"text": "Investigate"
|
|
},
|
|
"g.approver image": {
|
|
"opacity": 1
|
|
},
|
|
"g.code image": {
|
|
"opacity": 1,
|
|
"xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg"
|
|
},
|
|
"g.delete": {
|
|
"display": "none"
|
|
},
|
|
"g.error": {
|
|
"opacity": 0
|
|
},
|
|
"g.icon image": {
|
|
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
|
|
},
|
|
"g.notes": {
|
|
"display": "block"
|
|
},
|
|
"g.notes image": {
|
|
"opacity": 1
|
|
},
|
|
"g.timer image": {
|
|
"opacity": 1
|
|
},
|
|
"rect.warn-background": {
|
|
"fill": "#5094D4"
|
|
},
|
|
"text.icon": {
|
|
"fill": "#5094D4"
|
|
}
|
|
},
|
|
"block_code": "# read-only block view not available",
|
|
"callback_code": "",
|
|
"callback_start": 1,
|
|
"callsback": true,
|
|
"color": "#654796",
|
|
"connected_to_start": true,
|
|
"connection_name": "get file",
|
|
"connection_type": "action",
|
|
"custom_callback": "",
|
|
"custom_code": "def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n assets = get_specific_assets(\"detonate file\", [\"Threat Grid\"])\n \n if (not assets):\n phantom.debug(\"Threat Grid::detonate file not found returning.\")\n \n # collect data for 'detonate_file_1' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"get_file_2:filtered-action_result.data.*.vault_id\", \"get_file_2:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n parameters = []\n \n # build parameters list for 'detonate_file_1' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'vault_id': filtered_results_item_1[0],\n 'file_name': \"\",\n 'vm': \"\",\n 'force_analysis': \"\",\n 'private': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n if parameters:\n phantom.act(\"detonate file\", parameters=parameters, assets=assets, name=\"detonate_file_1\") \n else:\n phantom.error(\"'detonate_file_1' will not be executed due to lack of parameters\")\n \n return",
|
|
"custom_join": "",
|
|
"custom_name": "",
|
|
"delay": "0",
|
|
"description": "",
|
|
"has_custom": true,
|
|
"has_custom_block": true,
|
|
"has_custom_callback": false,
|
|
"has_custom_join": false,
|
|
"id": "e07929c3-d5ce-44c1-b08d-3b4fede3bc59",
|
|
"inPorts": [
|
|
"in"
|
|
],
|
|
"join_code": "",
|
|
"join_optional": [],
|
|
"join_start": 1,
|
|
"line_end": 237,
|
|
"line_start": 205,
|
|
"message": "Configuring now",
|
|
"name": "detonate file",
|
|
"notes": "",
|
|
"number": 1,
|
|
"order": 8,
|
|
"outPorts": [
|
|
"out"
|
|
],
|
|
"ports": {
|
|
"groups": {
|
|
"in": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "left"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "left"
|
|
}
|
|
},
|
|
"out": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "right"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "right"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"position": {
|
|
"x": 1400,
|
|
"y": 180
|
|
},
|
|
"previous_block_type": "",
|
|
"previous_function": "",
|
|
"previous_name": "detonate_file_1",
|
|
"required_params": {
|
|
"vault_id": true
|
|
},
|
|
"reviewer": "",
|
|
"showNumber": false,
|
|
"show_number": false,
|
|
"size": {
|
|
"height": 112,
|
|
"width": 168
|
|
},
|
|
"state": "asset",
|
|
"status": "",
|
|
"title": "Investigate",
|
|
"type": "coa.Action",
|
|
"warn": false,
|
|
"z": 1351
|
|
},
|
|
{
|
|
"active": false,
|
|
"angle": 0,
|
|
"attrs": {
|
|
".background": {
|
|
"fill": "#000000",
|
|
"stroke": "#5C6773",
|
|
"transform": "rotate(45 30 70)"
|
|
},
|
|
".border": {
|
|
"stroke": "#5094D4",
|
|
"transform": "rotate(45 30 70)"
|
|
},
|
|
".inPorts>.port-0>.port-body": {
|
|
"port": {
|
|
"id": "in",
|
|
"type": "in"
|
|
}
|
|
},
|
|
".number": {
|
|
"text": 3
|
|
},
|
|
".outPorts>.port-0": {
|
|
"port": {
|
|
"id": "out-1",
|
|
"type": "out"
|
|
},
|
|
"ref-x": 83,
|
|
"ref-y": 40
|
|
},
|
|
".outPorts>.port-0>.port-body": {
|
|
"port": {
|
|
"id": "out-1",
|
|
"type": "out"
|
|
}
|
|
},
|
|
"g.delete": {
|
|
"display": "none"
|
|
},
|
|
"g.error": {
|
|
"opacity": 0
|
|
},
|
|
"g.notes": {
|
|
"display": "block"
|
|
},
|
|
"g.notes image": {
|
|
"opacity": 1
|
|
}
|
|
},
|
|
"block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"get_file_2:action_result.data.*.vault_id\", \"!=\", \"\"],\n ],\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n detonate_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
|
|
"callback_code": "",
|
|
"callback_start": 1,
|
|
"callsback": false,
|
|
"connected_to_start": true,
|
|
"connection_name": "get file",
|
|
"connection_type": "action",
|
|
"custom_callback": "",
|
|
"custom_code": "",
|
|
"custom_join": "",
|
|
"custom_name": "",
|
|
"description": "",
|
|
"hasElse": false,
|
|
"has_custom": false,
|
|
"has_custom_block": false,
|
|
"has_custom_callback": false,
|
|
"has_custom_join": false,
|
|
"id": "93d4e099-5891-4c2b-b6db-ac512e981f06",
|
|
"inPorts": [
|
|
"in"
|
|
],
|
|
"join_code": "",
|
|
"join_optional": [],
|
|
"join_start": 1,
|
|
"line_end": 255,
|
|
"line_start": 237,
|
|
"name": "filter",
|
|
"notes": "",
|
|
"number": 3,
|
|
"order": 9,
|
|
"outPorts": [
|
|
"out-1"
|
|
],
|
|
"outputs": [
|
|
{
|
|
"conditions": [
|
|
{
|
|
"comparison": "!=",
|
|
"data_type": "",
|
|
"param": "get_file_2:action_result.data.*.vault_id",
|
|
"value": ""
|
|
}
|
|
],
|
|
"display": "If",
|
|
"logic": "and",
|
|
"type": "if"
|
|
}
|
|
],
|
|
"ports": {
|
|
"groups": {
|
|
"in": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "left"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "left"
|
|
}
|
|
},
|
|
"out": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "right"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "right"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"position": {
|
|
"x": 1260,
|
|
"y": 180
|
|
},
|
|
"previous_block_type": "",
|
|
"previous_function": "",
|
|
"previous_name": "filter_3",
|
|
"show_number": true,
|
|
"size": {
|
|
"height": 82,
|
|
"width": 82
|
|
},
|
|
"state": "filter",
|
|
"status": "",
|
|
"type": "coa.Filter",
|
|
"warn": false,
|
|
"z": 1352
|
|
},
|
|
{
|
|
"action": "file reputation",
|
|
"action_type": "investigate",
|
|
"active": false,
|
|
"active_keys": {},
|
|
"active_values": {
|
|
"hash": "artifact:*.cef.fileHash"
|
|
},
|
|
"angle": 0,
|
|
"app": "",
|
|
"approver": "",
|
|
"assets": [
|
|
{
|
|
"action": "",
|
|
"active": true,
|
|
"app_name": "",
|
|
"app_version": "",
|
|
"appid": "",
|
|
"config_type": "asset",
|
|
"fields": {
|
|
"hash": "artifact:*.cef.fileHash"
|
|
},
|
|
"has_app": true,
|
|
"id": "-",
|
|
"loaded": false,
|
|
"missing": false,
|
|
"name": "reversinglabs",
|
|
"output": [
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"sha256",
|
|
"sha1",
|
|
"md5"
|
|
],
|
|
"data_path": "action_result.parameter.hash",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.message",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.status",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.status",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"sha1"
|
|
],
|
|
"data_path": "action_result.data.*.sha1",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.first_seen_on",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.last_scanned_on",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.last_seen_on",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.single_scan",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.first_scanned_on",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.sample_type",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.sample_size",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.xref.*.scanner_match",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.xref.*.scanner_count",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.xref.*.results.*.result",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.xref.*.results.*.scanner",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.xref.*.scanned_on",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.xref.*.scanners.*.timestamp",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.xref.*.scanners.*.version",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.xref.*.scanners.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.sha384",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"sha256"
|
|
],
|
|
"data_path": "action_result.data.*.sha256",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.sha512",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.ripemd160",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"md5"
|
|
],
|
|
"data_path": "action_result.data.*.md5",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.summary.positives",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.summary.total_scans",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "summary.total_positives",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "summary.total_objects",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "summary.total_objects_successful",
|
|
"data_type": "numeric"
|
|
}
|
|
],
|
|
"product_name": "",
|
|
"product_vendor": "",
|
|
"type": "reputation"
|
|
}
|
|
],
|
|
"attrs": {
|
|
".action": {
|
|
"text": "file reputation"
|
|
},
|
|
".background": {
|
|
"fill": "#000000",
|
|
"stroke": "#5C6773"
|
|
},
|
|
".border": {
|
|
"stroke": "#5094D4"
|
|
},
|
|
".color-band": {
|
|
"fill": "#3C444D"
|
|
},
|
|
".inPorts>.port-in": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".inPorts>.port-in>.port-body": {
|
|
"port": {
|
|
"id": "in",
|
|
"type": "in"
|
|
}
|
|
},
|
|
".message": {
|
|
"fill": "#FFFFFF",
|
|
"font-size": 12,
|
|
"font-weight": 300,
|
|
"opacity": 0,
|
|
"ref": ".background",
|
|
"ref-x": 5,
|
|
"ref-y": 105,
|
|
"text": "Configuring now"
|
|
},
|
|
".outPorts>.port-out": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".outPorts>.port-out>.port-body": {
|
|
"port": {
|
|
"id": "out",
|
|
"type": "out"
|
|
}
|
|
},
|
|
".title": {
|
|
"text": "Investigate"
|
|
},
|
|
"g.approver image": {
|
|
"opacity": 1
|
|
},
|
|
"g.code image": {
|
|
"opacity": 1,
|
|
"xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg"
|
|
},
|
|
"g.delete": {
|
|
"display": "none"
|
|
},
|
|
"g.error": {
|
|
"opacity": 0
|
|
},
|
|
"g.icon image": {
|
|
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
|
|
},
|
|
"g.notes": {
|
|
"display": "block"
|
|
},
|
|
"g.notes image": {
|
|
"opacity": 1
|
|
},
|
|
"g.timer image": {
|
|
"opacity": 1
|
|
},
|
|
"rect.warn-background": {
|
|
"fill": "#5094D4"
|
|
},
|
|
"text.icon": {
|
|
"fill": "#5094D4"
|
|
}
|
|
},
|
|
"block_code": "# read-only block view not available",
|
|
"callback_code": "",
|
|
"callback_start": 1,
|
|
"callsback": true,
|
|
"color": "#654796",
|
|
"connected_to_start": true,
|
|
"connection_name": "hunt file",
|
|
"connection_type": "action",
|
|
"custom_callback": "",
|
|
"custom_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n assets = get_specific_assets(\"file reputation\", [\"TitaniumCloud\"])\n \n if (not assets):\n phantom.debug(\"ReversingLabs/TitaniumCloud::file reputation not found returning.\")\n\n # collect data for 'file_reputation_1' call\n container_data = phantom.collect2(container=container, datapath=['filtered-artifact:*.cef.fileHash', 'filtered-artifact:*.id'], filter_artifacts=filtered_artifacts)\n \n phantom.debug(container_data)\n\n parameters = []\n \n # build parameters list for 'file_reputation_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'hash': container_item[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n if parameters:\n phantom.act(\"file reputation\", parameters=parameters, assets=assets, name=\"file_reputation_1\", callback=filter_2) \n else:\n phantom.error(\"'file_reputation_1' will not be executed due to lack of parameters\")\n \n return",
|
|
"custom_join": "",
|
|
"custom_name": "",
|
|
"delay": "0",
|
|
"description": "",
|
|
"has_custom": true,
|
|
"has_custom_block": true,
|
|
"has_custom_callback": false,
|
|
"has_custom_join": false,
|
|
"id": "5578c85f-4a27-401e-be14-7793e82b92c5",
|
|
"inPorts": [
|
|
"in"
|
|
],
|
|
"join_code": "",
|
|
"join_optional": [],
|
|
"join_start": 1,
|
|
"line_end": 285,
|
|
"line_start": 255,
|
|
"message": "Configuring now",
|
|
"name": "file reputation",
|
|
"notes": "",
|
|
"number": 1,
|
|
"order": 10,
|
|
"outPorts": [
|
|
"out"
|
|
],
|
|
"ports": {
|
|
"groups": {
|
|
"in": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "left"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "left"
|
|
}
|
|
},
|
|
"out": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "right"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "right"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"position": {
|
|
"x": 640,
|
|
"y": 180
|
|
},
|
|
"previous_block_type": "",
|
|
"previous_function": "",
|
|
"previous_name": "file_reputation_1",
|
|
"required_params": {
|
|
"hash": true
|
|
},
|
|
"reviewer": "",
|
|
"showNumber": false,
|
|
"show_number": false,
|
|
"size": {
|
|
"height": 112,
|
|
"width": 168
|
|
},
|
|
"state": "asset",
|
|
"status": "",
|
|
"title": "Investigate",
|
|
"type": "coa.Action",
|
|
"warn": false,
|
|
"z": 1353
|
|
},
|
|
{
|
|
"action": "run query",
|
|
"action_type": "investigate",
|
|
"active": false,
|
|
"active_keys": {},
|
|
"active_values": {
|
|
"display": "adsf",
|
|
"query": "dfaf"
|
|
},
|
|
"angle": 0,
|
|
"app": "",
|
|
"approver": "",
|
|
"assets": [
|
|
{
|
|
"action": "",
|
|
"active": true,
|
|
"app_name": "",
|
|
"app_version": "",
|
|
"appid": "",
|
|
"config_type": "asset",
|
|
"fields": {
|
|
"display": "adsf",
|
|
"query": "dfaf"
|
|
},
|
|
"has_app": true,
|
|
"id": "-",
|
|
"loaded": false,
|
|
"missing": false,
|
|
"name": "splunk_entr",
|
|
"output": [
|
|
{
|
|
"column_name": "Host",
|
|
"column_order": "0",
|
|
"contains": [
|
|
"host name"
|
|
],
|
|
"data_path": "action_result.data.*.host",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"column_name": "Time",
|
|
"column_order": "1",
|
|
"contains": [],
|
|
"data_path": "action_result.data.*._time",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"column_name": "Raw",
|
|
"column_order": "2",
|
|
"contains": [],
|
|
"data_path": "action_result.data.*._raw",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*._cd",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*._si",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*._bkt",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.index",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.source",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*._serial",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.linecount",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*._indextime",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.sourcetype",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*._sourcetype",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"host name"
|
|
],
|
|
"data_path": "action_result.data.*.splunk_server",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.status",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.message",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.summary.total_events",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"contains": [
|
|
"splunk query"
|
|
],
|
|
"data_path": "action_result.parameter.query",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.parameter.display",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "summary.total_objects",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "summary.total_objects_successful",
|
|
"data_type": "numeric"
|
|
}
|
|
],
|
|
"product_name": "",
|
|
"product_vendor": "",
|
|
"type": "siem"
|
|
}
|
|
],
|
|
"attrs": {
|
|
".action": {
|
|
"text": "run query"
|
|
},
|
|
".background": {
|
|
"fill": "#000000",
|
|
"stroke": "#5C6773"
|
|
},
|
|
".border": {
|
|
"stroke": "#5094D4"
|
|
},
|
|
".color-band": {
|
|
"fill": "#3C444D"
|
|
},
|
|
".inPorts>.port-in": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".inPorts>.port-in>.port-body": {
|
|
"port": {
|
|
"id": "in",
|
|
"type": "in"
|
|
}
|
|
},
|
|
".message": {
|
|
"fill": "#FFFFFF",
|
|
"font-size": 12,
|
|
"font-weight": 300,
|
|
"opacity": 0,
|
|
"ref": ".background",
|
|
"ref-x": 5,
|
|
"ref-y": 105,
|
|
"text": "Configuring now"
|
|
},
|
|
".outPorts>.port-out": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".outPorts>.port-out>.port-body": {
|
|
"port": {
|
|
"id": "out",
|
|
"type": "out"
|
|
}
|
|
},
|
|
".title": {
|
|
"text": "Investigate"
|
|
},
|
|
"g.approver image": {
|
|
"opacity": 1
|
|
},
|
|
"g.code image": {
|
|
"opacity": 1,
|
|
"xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg"
|
|
},
|
|
"g.delete": {
|
|
"display": "none"
|
|
},
|
|
"g.error": {
|
|
"opacity": 0
|
|
},
|
|
"g.icon image": {
|
|
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
|
|
},
|
|
"g.notes": {
|
|
"display": "block"
|
|
},
|
|
"g.notes image": {
|
|
"opacity": 1
|
|
},
|
|
"g.timer image": {
|
|
"opacity": 1
|
|
},
|
|
"rect.warn-background": {
|
|
"fill": "#5094D4"
|
|
},
|
|
"text.icon": {
|
|
"fill": "#5094D4"
|
|
}
|
|
},
|
|
"block_code": "# read-only block view not available",
|
|
"callback_code": "",
|
|
"callback_start": 1,
|
|
"callsback": true,
|
|
"color": "#654796",
|
|
"connected_to_start": true,
|
|
"connection_name": "",
|
|
"connection_type": "",
|
|
"custom_callback": "",
|
|
"custom_code": "def run_query_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n\n assets = get_specific_assets(\"run query\", [\"Splunk Enterprise\", \"Carbon Black\"])\n \n if (not assets):\n phantom.debug(\"Did not find any asset configured, supporting run query\")\n return\n \n container_data_src = phantom.collect2(container=container, datapath=['artifact:*.cef.sourceAddress', 'artifact:*.id'])\n container_data_dst = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'run_query_1' call\n \n phantom.debug(\"Got the following assets:\")\n phantom.debug(','.join([x for x in assets]))\n \n for container_item in container_data_src:\n if container_item[0]:\n parameters.append({\n 'query': container_item[0],\n 'display': \"\",\n 'type': \"process\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n \n for container_item in container_data_dst:\n if container_item[0]:\n parameters.append({\n 'query': container_item[0],\n 'display': \"\",\n 'type': \"process\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n \n if (parameters):\n phantom.act(\"run query\", parameters=parameters, assets=assets, name=\"run_query_1\")\n else:\n phantom.error(\"'run_query_1' will not be executed due to lack of parameters\")\n \n return",
|
|
"custom_join": "",
|
|
"custom_name": "",
|
|
"delay": "0",
|
|
"description": "",
|
|
"has_custom": true,
|
|
"has_custom_block": true,
|
|
"has_custom_callback": false,
|
|
"has_custom_join": false,
|
|
"id": "8c6c1d82-e40b-4f58-b6c0-cc8c40791cae",
|
|
"inPorts": [
|
|
"in"
|
|
],
|
|
"join_code": "",
|
|
"join_optional": [],
|
|
"join_start": 1,
|
|
"line_end": 330,
|
|
"line_start": 285,
|
|
"message": "Configuring now",
|
|
"name": "run query",
|
|
"notes": "",
|
|
"number": 1,
|
|
"order": 11,
|
|
"outPorts": [
|
|
"out"
|
|
],
|
|
"ports": {
|
|
"groups": {
|
|
"in": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "left"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "left"
|
|
}
|
|
},
|
|
"out": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "right"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "right"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"position": {
|
|
"x": 260,
|
|
"y": 320
|
|
},
|
|
"previous_block_type": "",
|
|
"previous_function": "",
|
|
"previous_name": "run_query_1",
|
|
"required_params": {
|
|
"query": true
|
|
},
|
|
"reviewer": "",
|
|
"showNumber": false,
|
|
"show_number": false,
|
|
"size": {
|
|
"height": 112,
|
|
"width": 168
|
|
},
|
|
"state": "asset",
|
|
"status": "",
|
|
"title": "Investigate",
|
|
"type": "coa.Action",
|
|
"warn": false,
|
|
"z": 1355
|
|
},
|
|
{
|
|
"action": "hunt file",
|
|
"action_type": "investigate",
|
|
"active": false,
|
|
"active_keys": {},
|
|
"active_values": {
|
|
"hash": "artifact:*.cef.fileHash",
|
|
"range": "",
|
|
"type": ""
|
|
},
|
|
"angle": 0,
|
|
"app": "",
|
|
"approver": "",
|
|
"assets": [
|
|
{
|
|
"action": "",
|
|
"active": true,
|
|
"app_name": "",
|
|
"app_version": "",
|
|
"appid": "",
|
|
"config_type": "asset",
|
|
"fields": {
|
|
"hash": "artifact:*.cef.fileHash",
|
|
"range": "",
|
|
"type": ""
|
|
},
|
|
"has_app": true,
|
|
"id": "-",
|
|
"loaded": false,
|
|
"missing": false,
|
|
"name": "carbonblack",
|
|
"output": [
|
|
{
|
|
"data_path": "action_result.status",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"hash",
|
|
"md5"
|
|
],
|
|
"data_path": "action_result.parameter.hash",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"carbon black query type"
|
|
],
|
|
"data_path": "action_result.parameter.type",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.parameter.range",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.message",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.summary.device_count",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.terms",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.total_results",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.parent_name.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.parent_name.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.parent_name.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.parent_name.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.process_name.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.process_name.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.process_name.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.process_name.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.group.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.group.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.group.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.group.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.path_full.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.path_full.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.path_full.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.path_full.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.process_md5.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.process_md5.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.process_md5.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.process_md5.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.hostname.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.hostname.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.hostname.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.hostname.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.host_type.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.host_type.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.host_type.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.host_type.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.hour_of_day.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.hour_of_day.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.start.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.start.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.day_of_week.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.day_of_week.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.username_full.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.username_full.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.username_full.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.facets.username_full.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.modload_count",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"contains": [
|
|
"carbon black sensor id"
|
|
],
|
|
"data_path": "action_result.data.*.process.results.*.sensor_id",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.process_md5",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.parent_unique_id",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.cmdline",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.filemod_count",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"contains": [
|
|
"carbon black process id"
|
|
],
|
|
"data_path": "action_result.data.*.process.results.*.id",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.parent_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.parent_md5",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.group",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"host name"
|
|
],
|
|
"data_path": "action_result.data.*.process.results.*.hostname",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.last_update",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.start",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.netconn_count",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"contains": [
|
|
"pid"
|
|
],
|
|
"data_path": "action_result.data.*.process.results.*.process_pid",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"contains": [
|
|
"user name"
|
|
],
|
|
"data_path": "action_result.data.*.process.results.*.username",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"process name"
|
|
],
|
|
"data_path": "action_result.data.*.process.results.*.process_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"file path"
|
|
],
|
|
"data_path": "action_result.data.*.process.results.*.path",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.regmod_count",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.parent_pid",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.crossproc_count",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.segment_id",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.host_type",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.os_type",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.childproc_count",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.results.*.unique_id",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.elapsed",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.process.start",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.terms",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.total_results",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.highlights.*.ids",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.highlights.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.host_count.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.host_count.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.hostname.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.hostname.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.hostname.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.hostname.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.group.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.group.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.group.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.group.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.file_version_facet.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.file_version_facet.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.digsig_result.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.digsig_result.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.digsig_result.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.company_name_facet.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.company_name_facet.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.product_name_facet.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.product_name_facet.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.host_count",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.digsig_result",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.observed_filename",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.product_version",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"column_name": "Signed",
|
|
"column_order": 1,
|
|
"data_path": "action_result.data.*.binary.results.*.signed",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.is_executable_image",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.orig_mod_len",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.is_64bit",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.group",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.file_version",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.company_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.internal_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.product_name",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.digsig_result_code",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.timestamp",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.copied_mod_len",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.server_added_timestamp",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.md5",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.endpoint",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.watchlists.*.wid",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.watchlists.*.value",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.legal_copyright",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"file name"
|
|
],
|
|
"data_path": "action_result.data.*.binary.results.*.original_filename",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.cb_version",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.os_type",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.file_desc",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.results.*.last_seen",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.elapsed",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "action_result.data.*.binary.start",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "summary.total_objects",
|
|
"data_type": "numeric"
|
|
},
|
|
{
|
|
"data_path": "summary.total_objects_successful",
|
|
"data_type": "numeric"
|
|
}
|
|
],
|
|
"product_name": "",
|
|
"product_vendor": "",
|
|
"type": "endpoint"
|
|
}
|
|
],
|
|
"attrs": {
|
|
".action": {
|
|
"text": "hunt file"
|
|
},
|
|
".background": {
|
|
"fill": "#000000",
|
|
"stroke": "#5C6773"
|
|
},
|
|
".border": {
|
|
"stroke": "#5094D4"
|
|
},
|
|
".color-band": {
|
|
"fill": "#3C444D"
|
|
},
|
|
".inPorts>.port-in": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".inPorts>.port-in>.port-body": {
|
|
"port": {
|
|
"id": "in",
|
|
"type": "in"
|
|
}
|
|
},
|
|
".message": {
|
|
"fill": "#FFFFFF",
|
|
"font-size": 12,
|
|
"font-weight": 300,
|
|
"opacity": 0,
|
|
"ref": ".background",
|
|
"ref-x": 5,
|
|
"ref-y": 105,
|
|
"text": "Configuring now"
|
|
},
|
|
".outPorts>.port-out": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".outPorts>.port-out>.port-body": {
|
|
"port": {
|
|
"id": "out",
|
|
"type": "out"
|
|
}
|
|
},
|
|
".title": {
|
|
"text": "Investigate"
|
|
},
|
|
"g.approver image": {
|
|
"opacity": 1
|
|
},
|
|
"g.code image": {
|
|
"opacity": 1,
|
|
"xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg"
|
|
},
|
|
"g.delete": {
|
|
"display": "none"
|
|
},
|
|
"g.error": {
|
|
"opacity": 0
|
|
},
|
|
"g.icon image": {
|
|
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
|
|
},
|
|
"g.notes": {
|
|
"display": "block"
|
|
},
|
|
"g.notes image": {
|
|
"opacity": 1
|
|
},
|
|
"g.timer image": {
|
|
"opacity": 1
|
|
},
|
|
"rect.warn-background": {
|
|
"fill": "#5094D4"
|
|
},
|
|
"text.icon": {
|
|
"fill": "#5094D4"
|
|
}
|
|
},
|
|
"block_code": "# read-only block view not available",
|
|
"callback_code": "",
|
|
"callback_start": 1,
|
|
"callsback": true,
|
|
"color": "#654796",
|
|
"connected_to_start": true,
|
|
"connection_name": "",
|
|
"connection_type": "",
|
|
"custom_callback": "",
|
|
"custom_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n\n assets = get_specific_assets(\"hunt file\", [\"Carbon Black\"])\n \n if (not assets):\n phantom.debug(\"Carbon Black::hunt file not found returning.\")\n \n # collect data for 'hunt_file_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'hunt_file_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'hash': container_item[0],\n 'range': \"\",\n 'type': \"binary\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n if parameters:\n phantom.act(\"hunt file\", parameters=parameters, assets=assets, name=\"hunt_file_1\", callback=filter_4) \n else:\n phantom.error(\"'hunt_file_1' will not be executed due to lack of parameters\")\n \n return",
|
|
"custom_join": "",
|
|
"custom_name": "",
|
|
"delay": "0",
|
|
"description": "",
|
|
"has_custom": true,
|
|
"has_custom_block": true,
|
|
"has_custom_callback": false,
|
|
"has_custom_join": false,
|
|
"id": "ed123d2f-999b-4cdc-b141-a48f7da89227",
|
|
"inPorts": [
|
|
"in"
|
|
],
|
|
"join_code": "",
|
|
"join_optional": [],
|
|
"join_start": 1,
|
|
"line_end": 360,
|
|
"line_start": 330,
|
|
"message": "Configuring now",
|
|
"name": "hunt file",
|
|
"notes": "",
|
|
"number": 1,
|
|
"order": 12,
|
|
"outPorts": [
|
|
"out"
|
|
],
|
|
"ports": {
|
|
"groups": {
|
|
"in": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "left"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "left"
|
|
}
|
|
},
|
|
"out": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "right"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "right"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"position": {
|
|
"x": 260,
|
|
"y": 180
|
|
},
|
|
"previous_block_type": "",
|
|
"previous_function": "",
|
|
"previous_name": "hunt_file_1",
|
|
"required_params": {
|
|
"hash": true
|
|
},
|
|
"reviewer": "",
|
|
"showNumber": false,
|
|
"show_number": false,
|
|
"size": {
|
|
"height": 112,
|
|
"width": 168
|
|
},
|
|
"state": "asset",
|
|
"status": "",
|
|
"title": "Investigate",
|
|
"type": "coa.Action",
|
|
"warn": false,
|
|
"z": 1356
|
|
},
|
|
{
|
|
"action": "hunt domain",
|
|
"action_type": "investigate",
|
|
"active": false,
|
|
"active_keys": {},
|
|
"active_values": {
|
|
"count_only": "True",
|
|
"domain": "artifact:*.cef.destinationDnsDomain"
|
|
},
|
|
"angle": 0,
|
|
"app": "",
|
|
"approver": "",
|
|
"assets": [
|
|
{
|
|
"action": "",
|
|
"active": true,
|
|
"app_name": "",
|
|
"app_version": "",
|
|
"appid": "",
|
|
"config_type": "asset",
|
|
"fields": {
|
|
"count_only": "True",
|
|
"domain": "artifact:*.cef.destinationDnsDomain"
|
|
},
|
|
"has_app": true,
|
|
"id": "-",
|
|
"loaded": false,
|
|
"missing": false,
|
|
"name": "falconhostapi",
|
|
"output": [
|
|
{
|
|
"data_path": "action_result.message",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"column_name": "Falcon Device ID",
|
|
"column_order": 0,
|
|
"contains": [
|
|
"falcon device id"
|
|
],
|
|
"data_path": "action_result.data.*.device_id",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.status",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"contains": [
|
|
"domain"
|
|
],
|
|
"data_path": "action_result.parameter.domain",
|
|
"data_type": "string"
|
|
},
|
|
{
|
|
"data_path": "action_result.parameter.count_only",
|
|
"data_type": "boolean"
|
|
},
|
|
{
|
|
"data_path": "action_result.summary.device_count",
|
|
"data_type": "numeric"
|
|
}
|
|
],
|
|
"product_name": "",
|
|
"product_vendor": "",
|
|
"type": "endpoint"
|
|
}
|
|
],
|
|
"attrs": {
|
|
".action": {
|
|
"text": "hunt domain"
|
|
},
|
|
".background": {
|
|
"fill": "#000000",
|
|
"stroke": "#5C6773"
|
|
},
|
|
".border": {
|
|
"stroke": "#5094D4"
|
|
},
|
|
".color-band": {
|
|
"fill": "#3C444D"
|
|
},
|
|
".inPorts>.port-in": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".inPorts>.port-in>.port-body": {
|
|
"port": {
|
|
"id": "in",
|
|
"type": "in"
|
|
}
|
|
},
|
|
".message": {
|
|
"fill": "#FFFFFF",
|
|
"font-size": 12,
|
|
"font-weight": 300,
|
|
"opacity": 0,
|
|
"ref": ".background",
|
|
"ref-x": 5,
|
|
"ref-y": 105,
|
|
"text": "Configuring now"
|
|
},
|
|
".outPorts>.port-out": {
|
|
"ref": ".background",
|
|
"ref-x": 0.5
|
|
},
|
|
".outPorts>.port-out>.port-body": {
|
|
"port": {
|
|
"id": "out",
|
|
"type": "out"
|
|
}
|
|
},
|
|
".title": {
|
|
"text": "Investigate"
|
|
},
|
|
"g.approver image": {
|
|
"opacity": 1
|
|
},
|
|
"g.code image": {
|
|
"opacity": 1,
|
|
"xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg"
|
|
},
|
|
"g.delete": {
|
|
"display": "none"
|
|
},
|
|
"g.error": {
|
|
"opacity": 0
|
|
},
|
|
"g.icon image": {
|
|
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
|
|
},
|
|
"g.notes": {
|
|
"display": "block"
|
|
},
|
|
"g.notes image": {
|
|
"opacity": 1
|
|
},
|
|
"g.timer image": {
|
|
"opacity": 1
|
|
},
|
|
"rect.warn-background": {
|
|
"fill": "#5094D4"
|
|
},
|
|
"text.icon": {
|
|
"fill": "#5094D4"
|
|
}
|
|
},
|
|
"block_code": "# read-only block view not available",
|
|
"callback_code": "",
|
|
"callback_start": 1,
|
|
"callsback": true,
|
|
"color": "#654796",
|
|
"connected_to_start": true,
|
|
"connection_name": "",
|
|
"connection_type": "",
|
|
"custom_callback": "",
|
|
"custom_code": "def hunt_domain_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n\n assets = get_specific_assets(\"hunt domain\", [\"Falcon Host API\"])\n \n if (not assets):\n phantom.debug(\"hunt domain/Falcon Host API not found returning.\")\n\n # collect data for 'hunt_domain_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationDnsDomain', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'hunt_domain_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'domain': container_item[0],\n 'count_only': True,\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n if parameters:\n phantom.act(\"hunt domain\", parameters=parameters, assets=assets, callback=filter_1, name=\"hunt_domain_1\") \n else:\n phantom.error(\"'hunt_domain_1' will not be executed due to lack of parameters\")\n \n return",
|
|
"custom_join": "",
|
|
"custom_name": "",
|
|
"delay": "0",
|
|
"description": "",
|
|
"has_custom": true,
|
|
"has_custom_block": true,
|
|
"has_custom_callback": false,
|
|
"has_custom_join": false,
|
|
"id": "2c95ee18-c36d-40b4-9a1d-889badec9d4f",
|
|
"inPorts": [
|
|
"in"
|
|
],
|
|
"join_code": "",
|
|
"join_optional": [],
|
|
"join_start": 1,
|
|
"line_end": 179,
|
|
"line_start": 150,
|
|
"message": "Configuring now",
|
|
"name": "hunt domain",
|
|
"notes": "",
|
|
"number": 1,
|
|
"order": 6,
|
|
"outPorts": [
|
|
"out"
|
|
],
|
|
"ports": {
|
|
"groups": {
|
|
"in": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "left"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "left"
|
|
}
|
|
},
|
|
"out": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "right"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "right"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"position": {
|
|
"x": 260,
|
|
"y": 40
|
|
},
|
|
"previous_block_type": "",
|
|
"previous_function": "",
|
|
"previous_name": "hunt_domain_1",
|
|
"required_params": {
|
|
"domain": true
|
|
},
|
|
"reviewer": "",
|
|
"showNumber": false,
|
|
"show_number": false,
|
|
"size": {
|
|
"height": 112,
|
|
"width": 168
|
|
},
|
|
"state": "asset",
|
|
"status": "",
|
|
"title": "Investigate",
|
|
"type": "coa.Action",
|
|
"warn": false,
|
|
"z": 1357
|
|
},
|
|
{
|
|
"active": false,
|
|
"angle": 0,
|
|
"attrs": {
|
|
".background": {
|
|
"fill": "#000000",
|
|
"stroke": "#5C6773",
|
|
"transform": "rotate(45 30 70)"
|
|
},
|
|
".border": {
|
|
"stroke": "#5094D4",
|
|
"transform": "rotate(45 30 70)"
|
|
},
|
|
".inPorts>.port-0>.port-body": {
|
|
"port": {
|
|
"id": "in",
|
|
"type": "in"
|
|
}
|
|
},
|
|
".number": {
|
|
"text": 1
|
|
},
|
|
".outPorts>.port-0": {
|
|
"port": {
|
|
"id": "out-1",
|
|
"type": "out"
|
|
},
|
|
"ref-x": 83,
|
|
"ref-y": 40
|
|
},
|
|
".outPorts>.port-0>.port-body": {
|
|
"port": {
|
|
"id": "out-1",
|
|
"type": "out"
|
|
}
|
|
},
|
|
"g.delete": {
|
|
"display": "none"
|
|
},
|
|
"g.error": {
|
|
"opacity": 0
|
|
},
|
|
"g.notes": {
|
|
"display": "block"
|
|
},
|
|
"g.notes image": {
|
|
"opacity": 1
|
|
}
|
|
},
|
|
"block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"hunt_domain_1:action_result.summary.device_count\", \">\", 0],\n [\"artifact:*.cef.destinationDnsDomain\", \"==\", \"hunt_domain_1:action_result.parameter.domain\"],\n ],\n logical_operator='and',\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n get_system_info_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
|
|
"callback_code": "",
|
|
"callback_start": 1,
|
|
"callsback": false,
|
|
"connected_to_start": false,
|
|
"connection_name": "hunt domain",
|
|
"connection_type": "action",
|
|
"custom_callback": "",
|
|
"custom_code": "",
|
|
"custom_join": "",
|
|
"custom_name": "",
|
|
"description": "",
|
|
"hasElse": false,
|
|
"has_custom": false,
|
|
"has_custom_block": false,
|
|
"has_custom_callback": false,
|
|
"has_custom_join": false,
|
|
"id": "8656f57d-779a-4133-a244-5191a6714a83",
|
|
"inPorts": [
|
|
"in"
|
|
],
|
|
"join_code": "",
|
|
"join_optional": [],
|
|
"join_start": 1,
|
|
"line_end": 84,
|
|
"line_start": 64,
|
|
"name": "filter",
|
|
"notes": "",
|
|
"number": 1,
|
|
"order": 2,
|
|
"outPorts": [
|
|
"out-1"
|
|
],
|
|
"outputs": [
|
|
{
|
|
"conditions": [
|
|
{
|
|
"comparison": ">",
|
|
"data_type": "",
|
|
"param": "hunt_domain_1:action_result.summary.device_count",
|
|
"value": "0"
|
|
},
|
|
{
|
|
"comparison": "==",
|
|
"data_type": "",
|
|
"param": "artifact:*.cef.destinationDnsDomain",
|
|
"value": "hunt_domain_1:action_result.parameter.domain"
|
|
}
|
|
],
|
|
"display": "If",
|
|
"logic": "and",
|
|
"type": "if"
|
|
}
|
|
],
|
|
"ports": {
|
|
"groups": {
|
|
"in": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "left"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "left"
|
|
}
|
|
},
|
|
"out": {
|
|
"attrs": {
|
|
".port-body": {
|
|
"fill": "#fff",
|
|
"magnet": true,
|
|
"r": 10,
|
|
"stroke": "#000"
|
|
},
|
|
".port-label": {
|
|
"fill": "#000"
|
|
}
|
|
},
|
|
"label": {
|
|
"position": {
|
|
"args": {
|
|
"y": 10
|
|
},
|
|
"name": "right"
|
|
}
|
|
},
|
|
"position": {
|
|
"name": "right"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"position": {
|
|
"x": 500,
|
|
"y": 40
|
|
},
|
|
"previous_block_type": "",
|
|
"previous_function": "",
|
|
"previous_name": "filter_1",
|
|
"show_number": true,
|
|
"size": {
|
|
"height": 82,
|
|
"width": 82
|
|
},
|
|
"state": "filter",
|
|
"status": "",
|
|
"type": "coa.Filter",
|
|
"warn": false,
|
|
"z": 1358
|
|
}
|
|
]
|
|
},
|
|
"notes": ""
|
|
},
|
|
"python_version": "3",
|
|
"schema": 4,
|
|
"version": "4.10.0.40961"
|
|
},
|
|
"create_time": "2021-01-21T18:16:11.375283+00:00",
|
|
"draft_mode": false,
|
|
"labels": [
|
|
"events"
|
|
],
|
|
"tags": [],
|
|
"misc": {
|
|
"apps_list": [
|
|
"Splunk",
|
|
"Carbon Black Response",
|
|
"Falcon Host API",
|
|
"ReversingLabs",
|
|
"Threat Grid"
|
|
]
|
|
}
|
|
} |