admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
gitlab_release_testing_2
splunk-security_content/playbooks/crowdstrike_malware_triage.json
T
Lou Stella 3b58b30516 Adding custom functions & playbooks 
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00

9687 lines
488 KiB
JSON
Raw Permalink Blame History

{
"blockly": false,
"blockly_xml": "<xml></xml>",
"category": "Use Cases",
"misc": { "apps_list": ["CrowdStrike OAuth API"] },
"coa": {
"data": {
"clean": true,
"code_block": "",
"description": "Enrich and respond to a CrowdStrike Falcon detection involving a potentially malicious executable on an endpoint. Check for previous sightings of the same executable, hunt across other endpoints for the file, gather details about all processes associated with the file, and collect all the gathered information into a prompt for an analyst to review. Based on the analyst's choice, the file can be added to the custom indicators list in CrowdStrike with a detection policy of \"detect\" or \"none\", and the endpoint can be optionally quarantined from the network.",
"hash": "79619e5a31b4302e5150a07fe13c32a2f669f176",
"joint": {
"cells": [
{
"0": "S",
"1": "T",
"2": "A",
"3": "R",
"4": "T",
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"ref-x": 33,
"ref-y": 8,
"text": "START"
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.icon image": {
"ref-x": 13,
"xlink:href": "/inc/coa/img/block_icon_start.svg"
},
"g.notes": {
"display": "block"
}
},
"block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'if_sha256_exists' block\n if_sha256_exists(container=container)\n\n return",
"callback_code": "# read-only block view not available",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "",
"connection_type": "",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "",
"description": "",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "4fa5d104-e7c6-43d9-8485-4172636299a6",
"inPorts": [],
"join_code": "# read-only block view not available",
"join_optional": [],
"join_start": 1,
"line_end": 16,
"line_start": 8,
"name": "",
"notes": "",
"number": 0,
"order": 1,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": -560,
"y": 80
},
"previous_function": "",
"previous_name": "",
"show_number": true,
"size": {
"height": 54,
"width": 80
},
"status": "",
"title": "START",
"type": "coa.StartEnd",
"warn": false,
"z": 26
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "e7df7f9c-7de3-4800-bb0c-a06f4b930e17",
"router": {
"name": "metro"
},
"source": {
"id": "4fa5d104-e7c6-43d9-8485-4172636299a6",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "9438c5bf-bef5-455c-bf2a-8c3edd0e080f",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 27
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "9a480146-1bcb-4d7e-ba1d-3737838fa170",
"router": {
"name": "metro"
},
"source": {
"id": "c5d59d69-49e7-4433-a650-d1b0b98e74be",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "0484d948-e831-4efc-b3a4-5f7f6ffb9441",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 45
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "9d7d3005-2b76-4c46-9a3e-0340a7b15461",
"router": {
"name": "metro"
},
"source": {
"id": "a03011e0-61d6-4949-b0c2-03e18b844dba",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "278bf5f1-38a2-4a6c-924e-4f37b28fa60e",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 62
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "e98a19a1-65ba-40d6-a3c3-49f6f9c63478",
"router": {
"name": "metro"
},
"source": {
"id": "9438c5bf-bef5-455c-bf2a-8c3edd0e080f",
"port": "out-2",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "c0ae58bf-47b9-4b4d-92bf-0172765aafc6",
"selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 67
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "abd2b302-0df4-4795-be1b-bf5ca53710b7",
"router": {
"name": "metro"
},
"source": {
"id": "9438c5bf-bef5-455c-bf2a-8c3edd0e080f",
"port": "out-1",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "ffbb7b76-3326-4a51-aeb9-b60c5a82893a",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 68
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "12e9a5e5-83c1-4056-9fcc-99bfafcb07ae",
"router": {
"name": "metro"
},
"source": {
"id": "ffbb7b76-3326-4a51-aeb9-b60c5a82893a",
"port": "out-1",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "c5d59d69-49e7-4433-a650-d1b0b98e74be",
"selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 72
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "98bee464-56d3-471d-a0c8-c0d7fe380b87",
"router": {
"name": "metro"
},
"source": {
"id": "0484d948-e831-4efc-b3a4-5f7f6ffb9441",
"port": "out-1",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "6d11a3cf-6f79-4280-a83c-ff518a10f734",
"selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 77
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "46b3bc83-60ee-493f-bb85-519eca01c1f1",
"router": {
"name": "metro"
},
"source": {
"id": "0484d948-e831-4efc-b3a4-5f7f6ffb9441",
"port": "out-2",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "44f59298-23fc-4206-b2bb-672cb157944e",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 90
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "6de32435-c2b3-46d4-8e2b-cfed0ad4d5d2",
"router": {
"name": "metro"
},
"source": {
"id": "44f59298-23fc-4206-b2bb-672cb157944e",
"port": "out-2",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "0ab1d7d6-afc7-4a0d-b9f4-8079cf67c624",
"selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 96
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "c973bc87-1068-4a4f-b77d-da57579d114c",
"router": {
"name": "metro"
},
"source": {
"id": "44f59298-23fc-4206-b2bb-672cb157944e",
"port": "out-2",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "a03011e0-61d6-4949-b0c2-03e18b844dba",
"selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 99
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "438d8d1b-db6f-4005-a9dc-6b4f0dddfb55",
"router": {
"name": "metro"
},
"source": {
"id": "44f59298-23fc-4206-b2bb-672cb157944e",
"port": "out-3",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(3) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "b827b91f-97e9-4a99-983a-bdb0b4eb98ce",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 101
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "d8de0ef2-d498-41d4-9c74-7b84550458d6",
"router": {
"name": "metro"
},
"source": {
"id": "44f59298-23fc-4206-b2bb-672cb157944e",
"port": "out-1",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "ea7fbdda-bb34-4d57-9973-03db50614381",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 108
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "4a76ade7-9d28-4cec-873a-2a41e5d65816",
"router": {
"name": "metro"
},
"source": {
"id": "005c6087-3fe9-4e37-89f7-f170dd34412b",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "09fbbded-a2ad-433f-968d-40f3ae3c189e",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 123
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "2976e19a-9a82-4e59-90de-8990cae42c3c",
"router": {
"name": "metro"
},
"source": {
"id": "ea7fbdda-bb34-4d57-9973-03db50614381",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "44aeff0b-c413-4567-8916-e979e6c31fe0",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 129
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "dda15c41-a25c-4a4b-a82a-cff5f5d6c1c1",
"router": {
"name": "metro"
},
"source": {
"id": "0484d948-e831-4efc-b3a4-5f7f6ffb9441",
"port": "out-1",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "2d0844c0-d8d8-4435-9b26-38ea0b6f2c3b",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 135
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "009d45df-a04f-4b81-9b48-7fd11e7519c7",
"router": {
"name": "metro"
},
"source": {
"id": "2d0844c0-d8d8-4435-9b26-38ea0b6f2c3b",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "583356d6-13eb-45bf-9d38-5cbe82358374",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 137
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "37948fb9-ef42-475e-897b-b5d7ab70c787",
"router": {
"name": "metro"
},
"source": {
"id": "583356d6-13eb-45bf-9d38-5cbe82358374",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "09fbbded-a2ad-433f-968d-40f3ae3c189e",
"selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 142
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "77f22435-3a23-40cc-8db2-fb8a0d58d71c",
"router": {
"name": "metro"
},
"source": {
"id": "09fbbded-a2ad-433f-968d-40f3ae3c189e",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "e6b6bdfa-6ec1-40a6-96fd-1f9b535b2087",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 158
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "7e7cfb9e-a76f-454a-8bb3-75834b3c43b5",
"router": {
"name": "metro"
},
"source": {
"id": "e6b6bdfa-6ec1-40a6-96fd-1f9b535b2087",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "f39ff0a8-97cc-494b-b692-346dd89eab7a",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 169
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "f7faed44-e0ab-47b7-ac8e-0f9d359172e4",
"router": {
"name": "metro"
},
"source": {
"id": "e6b6bdfa-6ec1-40a6-96fd-1f9b535b2087",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "d5f48d34-ef50-4204-956c-7023b9846414",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 171
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "d6bcabed-8255-4f1c-be0f-56ba3de1a048",
"router": {
"name": "metro"
},
"source": {
"id": "f39ff0a8-97cc-494b-b692-346dd89eab7a",
"port": "out-3",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(3) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "da97de34-c6e5-47a8-bfcb-0a7ee4cca2a1",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 185
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "9317d7f4-b334-4bf2-858d-a5e7342316a9",
"router": {
"name": "metro"
},
"source": {
"id": "da97de34-c6e5-47a8-bfcb-0a7ee4cca2a1",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "d04015bf-190d-415d-8fab-06f8f1276751",
"selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 187
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "4c25afd4-6695-4f80-aff8-3e10cb1c2c87",
"router": {
"name": "metro"
},
"source": {
"id": "f39ff0a8-97cc-494b-b692-346dd89eab7a",
"port": "out-1",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "d6ae9b4a-a027-4ce4-b4ea-15a67a35668d",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 191
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "211f8472-10ee-4574-acca-42911a6f30fa",
"router": {
"name": "metro"
},
"source": {
"id": "f39ff0a8-97cc-494b-b692-346dd89eab7a",
"port": "out-2",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "0f9d0bb7-4931-4e17-b50f-03ff0551c70d",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 194
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "e77c9eac-4850-48f5-8d35-895a8d05e027",
"router": {
"name": "metro"
},
"source": {
"id": "0f9d0bb7-4931-4e17-b50f-03ff0551c70d",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "a8b369f1-2a55-4e49-85da-a66c35534861",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 207
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "ab597937-b68a-4157-9f2e-5f751fdbc2e2",
"router": {
"name": "metro"
},
"source": {
"id": "d5f48d34-ef50-4204-956c-7023b9846414",
"port": "out-2",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "e67e9ce0-f06d-4687-b3ed-d5d24860ed82",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 214
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "e0fef39f-1fc8-4576-9c72-4174b190b878",
"router": {
"name": "metro"
},
"source": {
"id": "d5f48d34-ef50-4204-956c-7023b9846414",
"port": "out-1",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "8f1bc7f0-5b9e-4e9c-9159-ee6a2b73c0e5",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 216
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "f59e09bf-d4fd-453b-b411-73cebcf84946",
"router": {
"name": "metro"
},
"source": {
"id": "a8b369f1-2a55-4e49-85da-a66c35534861",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "a51b3d43-d32c-4e5a-8e14-0a18c119d81a",
"selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 221
},
{
"0": "E",
"1": "N",
"2": "D",
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".title": {
"text": "END"
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_end.svg"
},
"g.notes": {
"display": "block"
}
},
"block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return",
"callback_code": "# read-only block view not available",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "create detect indicator",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "",
"description": "",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "a51b3d43-d32c-4e5a-8e14-0a18c119d81a",
"inPorts": [
"in"
],
"join_code": "# read-only block view not available",
"join_optional": [],
"join_start": 1,
"line_end": 792,
"line_start": 779,
"name": "",
"notes": "",
"number": 0,
"order": 33,
"outPorts": [],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1760,
"y": 80
},
"previous_function": "",
"previous_name": "",
"show_number": true,
"size": {
"height": 54,
"width": 80
},
"status": "",
"title": "END",
"type": "coa.StartEnd",
"warn": false,
"z": 228
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "68b66efc-be78-468d-bb79-c78cea946d63",
"router": {
"name": "metro"
},
"source": {
"id": "6d11a3cf-6f79-4280-a83c-ff518a10f734",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "005c6087-3fe9-4e37-89f7-f170dd34412b",
"selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 241
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#637282",
"transform": "rotate(45 30 70)"
},
".inPorts>.port-0>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".number": {
"text": 2
},
".outPorts>.port-0": {
"port": {
"id": "out-1",
"type": "out"
},
"ref-x": 83,
"ref-y": 40
},
".outPorts>.port-0>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
".outPorts>.port-1": {
"port": {
"id": "out-2",
"type": "out"
},
"ref-x": 41,
"ref-y": 82
},
".outPorts>.port-1>.port-body": {
"port": {
"id": "out-2",
"type": "out"
}
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def if_sha256_exists(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('if_sha256_exists() called')\n\n # check for 'if' condition 1\n matched = phantom.decision(\n container=container,\n conditions=[\n [\"artifact:*.cef.fileHashSha256\", \"!=\", \"\"],\n ])\n\n # call connected blocks if condition 1 matched\n if matched:\n filter_main_artifact(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n # call connected blocks for 'else' condition 2\n ignore_if_no_sha256(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "",
"connection_type": "",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "if sha256 exists",
"description": "Ensure that the event has at least one artifact with a SHA256 file hash before attempting to process the event.",
"hasElse": true,
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "9438c5bf-bef5-455c-bf2a-8c3edd0e080f",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 66,
"line_start": 46,
"name": "decision",
"notes": "Ensure that the event has at least one artifact with a SHA256 file hash before attempting to process the event.",
"number": 2,
"order": 3,
"outPorts": [
"out-1",
"out-2"
],
"outputs": [
{
"conditions": [
{
"comparison": "!=",
"data_type": "",
"param": "artifact:*.cef.fileHashSha256",
"value": ""
}
],
"display": "If",
"logic": "and",
"type": "if"
},
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "",
"value": ""
}
],
"display": "Else",
"logic": "and",
"type": "else"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": -420,
"y": 60
},
"previous_function": "",
"previous_name": "if_sha256_exists",
"show_number": true,
"size": {
"height": 82,
"width": 82
},
"state": "decision",
"status": "",
"type": "coa.Decision",
"warn": "",
"z": 252
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773",
"transform": "rotate(45 30 70)"
},
".inPorts>.port-0>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".number": {
"text": 1
},
".outPorts>.port-0": {
"port": {
"id": "out-1",
"type": "out"
},
"ref-x": 83,
"ref-y": 40
},
".outPorts>.port-0>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def filter_main_artifact(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_main_artifact() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.label\", \"==\", \"event\"],\n ],\n name=\"filter_main_artifact:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n get_indicator_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "",
"connection_type": "",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "filter main artifact",
"description": "Only process the main detection artifact, not any sub event artifacts.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "ffbb7b76-3326-4a51-aeb9-b60c5a82893a",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 208,
"line_start": 191,
"name": "filter",
"notes": "Only process the main detection artifact, not any sub event artifacts.",
"number": 1,
"order": 10,
"outPorts": [
"out-1"
],
"outputs": [
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "artifact:*.label",
"value": "event"
}
],
"display": "If",
"logic": "and",
"type": "if"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": -280,
"y": 60
},
"previous_function": "",
"previous_name": "filter_main_artifact",
"show_number": true,
"size": {
"height": 82,
"width": 82
},
"state": "filter",
"status": "",
"type": "coa.Filter",
"warn": false,
"z": 253
},
{
"active": false,
"angle": 0,
"api": "add comment",
"attrs": {
".api": {
"text": "ignore if no sha256"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "API"
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def ignore_if_no_sha256(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('ignore_if_no_sha256() called')\n\n phantom.comment(container=container, comment=\"Ignoring alert because no SHA256 file hash was found\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"color": "",
"configured": [
{
"addCommentComment": "Ignoring alert because no SHA256 file hash was found",
"key": "add-comment"
}
],
"connected_to_start": true,
"connection_name": "",
"connection_type": "",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "ignore if no sha256",
"description": "End the playbook if no SHA256 file hash is found in any of the artifacts.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "c0ae58bf-47b9-4b4d-92bf-0172765aafc6",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 76,
"line_start": 69,
"message": "Configuring now",
"name": "add comment",
"notes": "End the playbook if no SHA256 file hash is found in any of the artifacts.",
"number": 1,
"order": 4,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": -140,
"y": 200
},
"previous_function": "",
"previous_name": "ignore_if_no_sha256",
"show_number": false,
"size": {
"height": 100,
"width": 180
},
"state": "api",
"status": "",
"title": "API",
"type": "coa.API",
"warn": false,
"z": 255
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#637282",
"transform": "rotate(45 30 70)"
},
".inPorts>.port-0>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".number": {
"text": 4
},
".outPorts>.port-0": {
"port": {
"id": "out-1",
"type": "out"
},
"ref-x": 83,
"ref-y": 40
},
".outPorts>.port-0>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
".outPorts>.port-1": {
"port": {
"id": "out-2",
"type": "out"
},
"ref-x": 41,
"ref-y": 82
},
".outPorts>.port-1>.port-body": {
"port": {
"id": "out-2",
"type": "out"
}
},
".outPorts>.port-2": {
"port": {
"id": "out-3",
"type": "out"
},
"ref-x": 41,
"ref-y": -2
},
".outPorts>.port-2>.port-body": {
"port": {
"id": "out-3",
"type": "out"
}
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def indicator_policy_decision(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('indicator_policy_decision() called')\n\n # check for 'if' condition 1\n matched = phantom.decision(\n container=container,\n action_results=results,\n conditions=[\n [\"get_indicator_2:action_result.data.*.resources.*.policy\", \"==\", \"none\"],\n ])\n\n # call connected blocks if condition 1 matched\n if matched:\n detection_policy_none(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n # check for 'elif' condition 2\n matched = phantom.decision(\n container=container,\n action_results=results,\n conditions=[\n [\"get_indicator_2:action_result.data.*.resources.*.policy\", \"==\", \"detect\"],\n ])\n\n # call connected blocks if condition 2 matched\n if matched:\n escalate_severity_to_high(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n format_repeat_note(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n # call connected blocks for 'else' condition 3\n comment_unexpected_policy(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "get indicator",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "indicator policy decision",
"description": "Handle the Indicator differently if the policy is \"detect\", \"none\", or other.",
"hasElse": true,
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "44f59298-23fc-4206-b2bb-672cb157944e",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 246,
"line_start": 211,
"name": "decision",
"notes": "Handle the Indicator differently if the policy is \"detect\", \"none\", or other.",
"number": 4,
"order": 11,
"outPorts": [
"out-1",
"out-2",
"out-3"
],
"outputs": [
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "get_indicator_2:action_result.data.*.resources.*.policy",
"value": "none"
}
],
"display": "If",
"logic": "and",
"type": "if"
},
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "get_indicator_2:action_result.data.*.resources.*.policy",
"value": "detect"
}
],
"display": "Else If",
"logic": "and",
"type": "elif"
},
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "",
"value": ""
}
],
"display": "Else",
"logic": "and",
"type": "else"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 180,
"y": 340
},
"previous_function": "",
"previous_name": "indicator_policy_decision",
"show_number": true,
"size": {
"height": 82,
"width": 82
},
"state": "decision",
"status": "",
"type": "coa.Decision",
"warn": "",
"z": 258
},
{
"active": false,
"angle": 0,
"api": "set status",
"attrs": {
".api": {
"text": "close event"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "API"
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def close_event(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('close_event() called')\n\n phantom.set_status(container=container, status=\"Closed\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"color": "",
"configured": [
{
"key": "set-status",
"setStatusStatus": "Closed",
"setStatusStatus_display": "Closed"
}
],
"connected_to_start": true,
"connection_name": "get indicator",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "close event",
"description": "Close the event because the Indicator policy is \"none\", meaning the detection is a false positive.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "44aeff0b-c413-4567-8916-e979e6c31fe0",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 357,
"line_start": 350,
"message": "Configuring now",
"name": "set status",
"notes": "Close the event because the Indicator policy is \"none\", meaning the detection is a false positive.",
"number": 8,
"order": 16,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 560,
"y": 340
},
"previous_function": "",
"previous_name": "close_event",
"show_number": false,
"size": {
"height": 100,
"width": 180
},
"state": "api",
"status": "",
"title": "API",
"type": "coa.API",
"warn": false,
"z": 260
},
{
"active": false,
"angle": 0,
"api": "set severity",
"attrs": {
".api": {
"text": "escalate severity to high"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "API"
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def escalate_severity_to_high(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('escalate_severity_to_high() called')\n\n phantom.set_severity(container=container, severity=\"High\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"color": "",
"configured": [
{
"key": "set-severity",
"setSeveritySeverity": "High",
"setSeveritySeverity_display": "High"
}
],
"connected_to_start": true,
"connection_name": "get indicator",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "escalate severity to high",
"description": "Escalate the event because the Indicator policy is \"detect\", meaning the event is a true positive.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "0ab1d7d6-afc7-4a0d-b9f4-8079cf67c624",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 136,
"line_start": 129,
"message": "Configuring now",
"name": "set severity",
"notes": "Escalate the event because the Indicator policy is \"detect\", meaning the event is a true positive.",
"number": 3,
"order": 7,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 320,
"y": 480
},
"previous_function": "",
"previous_name": "escalate_severity_to_high",
"show_number": false,
"size": {
"height": 100,
"width": 180
},
"state": "api",
"status": "",
"title": "API",
"type": "coa.API",
"warn": false,
"z": 261
},
{
"action": "get process detail",
"action_type": "investigate",
"active": false,
"active_keys": {},
"active_values": {
"falcon_process_id": "list_processes_with_hash:action_result.data.*.falcon_process_id"
},
"angle": 0,
"app": "CrowdStrike OAuth API",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"approver": "",
"assets": [
{
"action": "get process detail",
"actions": [
"update indicator",
"delete indicator",
"upload indicator",
"list processes",
"on poll",
"list put files",
"list custom indicators",
"get indicator",
"upload put file",
"hunt domain",
"hunt file",
"get process detail",
"get system info",
"set status",
"get session file",
"list incidents",
"list incident behaviors",
"get incident details",
"list crowdscores",
"get role",
"list roles",
"get user roles",
"list users",
"update incident",
"get incident behaviors",
"list session files",
"get command details",
"run admin command",
"run command",
"list sessions",
"delete session",
"create session",
"remove hosts",
"assign hosts",
"unquarantine device",
"quarantine device",
"list groups",
"query device",
"test connectivity"
],
"active": true,
"app_name": "CrowdStrike OAuth API",
"app_version": "2.0.5",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"asset_name": "crowdstrike_oauth",
"config_type": "asset",
"count": 0,
"fields": {
"falcon_process_id": "list_processes_with_hash:action_result.data.*.falcon_process_id"
},
"has_app": true,
"id": 19,
"loaded": false,
"missing": false,
"name": "crowdstrike_oauth",
"output": [
{
"column_name": "Status",
"column_order": 1,
"data_path": "action_result.status",
"data_type": "string",
"example_values": [
"success",
"failed"
]
},
{
"column_name": "Falcon Process ID",
"column_order": 0,
"contains": [
"falcon process id"
],
"data_path": "action_result.parameter.falcon_process_id",
"data_type": "string",
"example_values": [
"pid:07c312fabcb8473454d0a16f118928fg:16716090292999"
]
},
{
"data_path": "summary.total_objects",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "summary.total_objects_successful",
"data_type": "numeric",
"example_values": [
1
]
},
{
"column_name": "Command Line",
"column_order": 2,
"data_path": "action_result.data.*.command_line",
"data_type": "string",
"example_values": [
"C:\test\test.exe"
]
},
{
"column_name": "Crowdstrike Device ID",
"column_order": 6,
"contains": [
"crowdstrike device id"
],
"data_path": "action_result.data.*.device_id",
"data_type": "string",
"example_values": [
"07c312fabcb8473454d0a16f118928fg"
]
},
{
"column_name": "File Name",
"column_order": 3,
"contains": [
"file name"
],
"data_path": "action_result.data.*.file_name",
"data_type": "string",
"example_values": [
"\testdata\test\test\test.exe"
]
},
{
"contains": [
"pid"
],
"data_path": "action_result.data.*.process_id",
"data_type": "string",
"example_values": [
"pid:07c312fabcb8473454d0a16f118928fg:16716090292999"
]
},
{
"contains": [
"pid"
],
"data_path": "action_result.data.*.process_id_local",
"data_type": "string",
"example_values": [
"16716090292999"
]
},
{
"column_name": "Start Timestamp",
"column_order": 4,
"data_path": "action_result.data.*.start_timestamp",
"data_type": "string",
"example_values": [
"2020-02-14T01:41:11Z"
]
},
{
"column_name": "Start Timestamp Raw",
"column_order": 7,
"data_path": "action_result.data.*.start_timestamp_raw",
"data_type": "string",
"example_values": [
"132261180718697221"
]
},
{
"column_name": "Stop Timestamp",
"column_order": 5,
"data_path": "action_result.data.*.stop_timestamp",
"data_type": "string"
},
{
"column_name": "Stop TimestampRaw",
"column_order": 8,
"data_path": "action_result.data.*.stop_timestamp_raw",
"data_type": "string"
},
{
"data_path": "action_result.summary",
"data_type": "string"
},
{
"data_path": "action_result.message",
"data_type": "string",
"example_values": [
"Process details fetched successfully"
]
}
],
"parameters": {
"falcon_process_id": {
"contains": [
"falcon process id"
],
"data_type": "string",
"default": null,
"description": "Process ID from previous Falcon IOC search",
"key": "falcon_process_id",
"primary": true,
"required": true
}
},
"product_name": "CrowdStrike",
"product_vendor": "CrowdStrike",
"targets": "19",
"type": "endpoint"
}
],
"attrs": {
".action": {
"text": "get process details"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "Investigate"
},
"g.approver image": {
"opacity": 1
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
},
"g.timer image": {
"opacity": 1
}
},
"block_code": "def get_process_details(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('get_process_details() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'get_process_details' call\n results_data_1 = phantom.collect2(container=container, datapath=['list_processes_with_hash:action_result.data.*.falcon_process_id', 'list_processes_with_hash:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'get_process_details' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'falcon_process_id': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"get process detail\", parameters=parameters, assets=['crowdstrike_oauth'], callback=join_format_prompt, name=\"get_process_details\", parent_action=action)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": true,
"color": "",
"connected_to_start": true,
"connection_name": "list processes with hash",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "get process details",
"delay": 0,
"description": "Fetch additional information about each process listed in the previous step.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "583356d6-13eb-45bf-9d38-5cbe82358374",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 410,
"line_start": 387,
"message": "Configuring now",
"name": "get process detail",
"notes": "Fetch additional information about each process listed in the previous step.",
"number": 1,
"order": 18,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 480,
"y": -80
},
"previous_function": "",
"previous_name": "get_process_details",
"required_params": {
"falcon_process_id": true
},
"reviewer": "",
"show_number": false,
"size": {
"height": 100,
"width": 180
},
"state": "app_action_assets",
"status": "",
"title": "Investigate",
"type": "coa.Action",
"warn": false,
"z": 265
},
{
"action": "get system info",
"action_type": "investigate",
"active": false,
"active_keys": {},
"active_values": {
"id": "hunt_file_1:action_result.data.*.device_id"
},
"angle": 0,
"app": "CrowdStrike OAuth API",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"approver": "",
"assets": [
{
"action": "get system info",
"actions": [
"update indicator",
"delete indicator",
"upload indicator",
"list processes",
"on poll",
"list put files",
"list custom indicators",
"get indicator",
"upload put file",
"hunt domain",
"hunt file",
"get process detail",
"get system info",
"set status",
"get session file",
"list incidents",
"list incident behaviors",
"get incident details",
"list crowdscores",
"get role",
"list roles",
"get user roles",
"list users",
"update incident",
"get incident behaviors",
"list session files",
"get command details",
"run admin command",
"run command",
"list sessions",
"delete session",
"create session",
"remove hosts",
"assign hosts",
"unquarantine device",
"quarantine device",
"list groups",
"query device",
"test connectivity"
],
"active": true,
"app_name": "CrowdStrike OAuth API",
"app_version": "2.0.5",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"asset_name": "crowdstrike_oauth",
"config_type": "asset",
"count": 0,
"fields": {
"id": "hunt_file_1:action_result.data.*.device_id"
},
"has_app": true,
"id": 19,
"loaded": false,
"missing": false,
"name": "crowdstrike_oauth",
"output": [
{
"data_path": "action_result.status",
"data_type": "string",
"example_values": [
"success",
"failed"
]
},
{
"data_path": "action_result.data.*.service_pack_minor",
"data_type": "string",
"example_values": [
"0"
]
},
{
"data_path": "action_result.data.*.build_number",
"data_type": "string",
"example_values": [
"17134"
]
},
{
"data_path": "action_result.data.*.mac_address",
"data_type": "string",
"example_values": [
"00-0c-29-a0-10-27"
]
},
{
"data_path": "action_result.data.*.device_policies.sensor_update.uninstall_protection",
"data_type": "string",
"example_values": [
"ENABLED"
]
},
{
"data_path": "action_result.data.*.device_policies.remote_response.applied",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.device_policies.remote_response.applied_date",
"data_type": "string",
"example_values": [
"2019-02-08T02:39:21.726331953Z"
]
},
{
"data_path": "action_result.data.*.device_policies.remote_response.settings_hash",
"data_type": "string",
"example_values": [
"f472bd8e"
]
},
{
"data_path": "action_result.data.*.device_policies.remote_response.policy_type",
"data_type": "string",
"example_values": [
"remote-response"
]
},
{
"data_path": "action_result.data.*.device_policies.remote_response.assigned_date",
"data_type": "string",
"example_values": [
"2019-02-08T02:36:05.073298048Z"
]
},
{
"data_path": "action_result.data.*.device_policies.remote_response.policy_id",
"data_type": "string",
"example_values": [
"6c74313d6c864180bd759c3235dbd550"
]
},
{
"data_path": "action_result.data.*.device_policies.device_control.applied",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.device_policies.device_control.applied_date",
"data_type": "string",
"example_values": [
"2020-05-12T17:24:23.856260169Z"
]
},
{
"data_path": "action_result.data.*.device_policies.device_control.assigned_date",
"data_type": "string",
"example_values": [
"2020-05-12T17:24:12.52970392Z"
]
},
{
"data_path": "action_result.data.*.device_policies.device_control.policy_type",
"data_type": "string",
"example_values": [
"device-control"
]
},
{
"data_path": "action_result.data.*.device_policies.device_control.policy_id",
"data_type": "string",
"example_values": [
"cb4babb273274f79a91e8a0e84164916"
]
},
{
"data_path": "action_result.data.*.device_policies.global_config.applied",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.device_policies.global_config.applied_date",
"data_type": "string",
"example_values": [
"2020-04-16T02:44:27.694202488Z"
]
},
{
"data_path": "action_result.data.*.device_policies.global_config.settings_hash",
"data_type": "string",
"example_values": [
"f48b1bd1"
]
},
{
"data_path": "action_result.data.*.device_policies.global_config.policy_type",
"data_type": "string",
"example_values": [
"globalconfig"
]
},
{
"data_path": "action_result.data.*.device_policies.global_config.assigned_date",
"data_type": "string",
"example_values": [
"2020-04-16T02:42:41.826629904Z"
]
},
{
"data_path": "action_result.data.*.device_policies.global_config.policy_id",
"data_type": "string",
"example_values": [
"49ee9efc99164562ad89640955f372ce"
]
},
{
"data_path": "action_result.data.*.service_pack_major",
"data_type": "string",
"example_values": [
"0"
]
},
{
"data_path": "action_result.data.*.local_ip",
"data_type": "string",
"example_values": [
"10.1.18.49"
]
},
{
"data_path": "action_result.data.*.pointer_size",
"data_type": "string",
"example_values": [
"8"
]
},
{
"data_path": "action_result.data.*.device_policies.firewall.applied",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.device_policies.firewall.applied_date",
"data_type": "string",
"example_values": [
"2020-07-08T03:12:30.212194872Z"
]
},
{
"data_path": "action_result.data.*.device_policies.firewall.policy_type",
"data_type": "string",
"example_values": [
"firewall"
]
},
{
"data_path": "action_result.data.*.device_policies.firewall.rule_set_id",
"data_type": "string",
"example_values": [
"2018f9894359493cb756bfa7dd3357a6"
]
},
{
"data_path": "action_result.data.*.device_policies.firewall.assigned_date",
"data_type": "string",
"example_values": [
"2020-07-08T03:07:38.48127371Z"
]
},
{
"data_path": "action_result.data.*.device_policies.firewall.policy_id",
"data_type": "string",
"example_values": [
"2018f9894359493cb756bfa7dd3357a6"
]
},
{
"contains": [
"crowdstrike device id"
],
"data_path": "action_result.parameter.id",
"data_type": "string",
"example_values": [
"0498d1102b23481162ff846d0633e14c"
]
},
{
"data_path": "action_result.data.*.agent_load_flags",
"data_type": "string",
"example_values": [
"3"
]
},
{
"data_path": "action_result.data.*.agent_local_time",
"data_type": "string",
"example_values": [
"2015-07-31T14:07:42.816Z"
]
},
{
"data_path": "action_result.data.*.agent_version",
"data_type": "string",
"example_values": [
"2.0.0010.3005"
]
},
{
"data_path": "action_result.data.*.bios_manufacturer",
"data_type": "string",
"example_values": [
"Phoenix Technologies LTD"
]
},
{
"data_path": "action_result.data.*.bios_version",
"data_type": "string",
"example_values": [
"6.00"
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.cid",
"data_type": "string",
"example_values": [
"3f40c380adc74a3187c27252c0227cff"
]
},
{
"data_path": "action_result.data.*.config_id_base",
"data_type": "string",
"example_values": [
"65994752"
]
},
{
"data_path": "action_result.data.*.config_id_build",
"data_type": "string",
"example_values": [
"3005"
]
},
{
"data_path": "action_result.data.*.config_id_platform",
"data_type": "string",
"example_values": [
"3"
]
},
{
"column_name": "Crowdstrike Device ID",
"column_order": 0,
"contains": [
"crowdstrike device id"
],
"data_path": "action_result.data.*.device_id",
"data_type": "string",
"example_values": [
"0498d1102b23481162ff846d0633e14c"
]
},
{
"data_path": "action_result.data.*.device_policies.prevention.applied",
"data_type": "boolean",
"example_values": [
true
]
},
{
"data_path": "action_result.data.*.device_policies.prevention.applied_date",
"data_type": "string"
},
{
"data_path": "action_result.data.*.device_policies.prevention.assigned_date",
"data_type": "string",
"example_values": [
"2018-03-10T15:39:31.220730539Z"
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.device_policies.prevention.policy_id",
"data_type": "string",
"example_values": [
"f81459e0d85b4bc7b3ad14ad40889042"
]
},
{
"data_path": "action_result.data.*.device_policies.prevention.policy_type",
"data_type": "string",
"example_values": [
"prevention"
]
},
{
"data_path": "action_result.data.*.device_policies.prevention.settings_hash",
"data_type": "string",
"example_values": [
"87cb8b2e"
]
},
{
"data_path": "action_result.data.*.device_policies.sensor_update.applied",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.device_policies.sensor_update.applied_date",
"data_type": "string",
"example_values": []
},
{
"data_path": "action_result.data.*.device_policies.sensor_update.assigned_date",
"data_type": "string",
"example_values": [
"2018-03-10T15:39:31.220769757Z"
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.device_policies.sensor_update.policy_id",
"data_type": "string",
"example_values": [
"62a3908297584c52bdafaa7fdf3c3bdd"
]
},
{
"data_path": "action_result.data.*.device_policies.sensor_update.policy_type",
"data_type": "string",
"example_values": [
"sensor-update"
]
},
{
"data_path": "action_result.data.*.device_policies.sensor_update.settings_hash",
"data_type": "string",
"example_values": [
"65994753|3|2|automatic"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.external_ip",
"data_type": "string",
"example_values": [
"50.18.218.205"
]
},
{
"data_path": "action_result.data.*.first_seen",
"data_type": "string",
"example_values": [
"2018-03-10T15:38:09Z"
]
},
{
"contains": [
"sha256"
],
"data_path": "action_result.data.*.group_hash",
"data_type": "string",
"example_values": [
"e2a8b394c0e62960747ff5d64a335162b36ba4c5a54ee6499b438b94e5269ae8"
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.groups",
"data_type": "string",
"example_values": [
"873560309d1b4686a6cee666575e7a93"
]
},
{
"column_name": "Hostname",
"column_order": 1,
"contains": [
"host name"
],
"data_path": "action_result.data.*.hostname",
"data_type": "string",
"example_values": [
"TheNarrowSea",
"CentOS70"
]
},
{
"column_name": "Last Seen",
"column_order": 2,
"data_path": "action_result.data.*.last_seen",
"data_type": "string",
"example_values": [
"2018-03-10T15:39:34Z"
]
},
{
"contains": [
"domain"
],
"data_path": "action_result.data.*.machine_domain",
"data_type": "string",
"example_values": [
"VICTIMNET.local"
]
},
{
"data_path": "action_result.data.*.major_version",
"data_type": "string",
"example_values": [
"6"
]
},
{
"data_path": "action_result.data.*.meta.version",
"data_type": "string",
"example_values": [
"6",
"106635"
]
},
{
"data_path": "action_result.data.*.minor_version",
"data_type": "string",
"example_values": [
"1"
]
},
{
"data_path": "action_result.data.*.modified_timestamp",
"data_type": "string",
"example_values": [
"2018-03-10T15:40:09Z"
]
},
{
"column_name": "OS Version",
"column_order": 3,
"data_path": "action_result.data.*.os_version",
"data_type": "string",
"example_values": [
"Windows Server 2008 R2",
"CentOS 7"
]
},
{
"data_path": "action_result.data.*.ou",
"data_type": "string"
},
{
"data_path": "action_result.data.*.platform_id",
"data_type": "string",
"example_values": [
"0",
"3"
]
},
{
"column_name": "Platform",
"column_order": 4,
"data_path": "action_result.data.*.platform_name",
"data_type": "string",
"example_values": [
"Windows"
]
},
{
"data_path": "action_result.data.*.policies.*.applied",
"data_type": "boolean",
"example_values": [
true
]
},
{
"data_path": "action_result.data.*.policies.*.applied_date",
"data_type": "string"
},
{
"data_path": "action_result.data.*.policies.*.assigned_date",
"data_type": "string",
"example_values": [
"2018-03-10T15:39:31.220730539Z"
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.policies.*.policy_id",
"data_type": "string",
"example_values": [
"f81459e0d85b4bc7b3ad14ad40889042"
]
},
{
"data_path": "action_result.data.*.policies.*.policy_type",
"data_type": "string",
"example_values": [
"prevention"
]
},
{
"data_path": "action_result.data.*.policies.*.settings_hash",
"data_type": "string",
"example_values": [
"87cb8b2e"
]
},
{
"data_path": "action_result.data.*.product_type",
"data_type": "string",
"example_values": [
"3"
]
},
{
"data_path": "action_result.data.*.product_type_desc",
"data_type": "string",
"example_values": [
"Server"
]
},
{
"data_path": "action_result.data.*.provision_status",
"data_type": "string",
"example_values": [
"Provisioned"
]
},
{
"data_path": "action_result.data.*.release_group",
"data_type": "string"
},
{
"data_path": "action_result.data.*.site_name",
"data_type": "string",
"example_values": [
"Default-First-Site-Name"
]
},
{
"data_path": "action_result.data.*.slow_changing_modified_timestamp",
"data_type": "string",
"example_values": [
"2018-04-23T22:52:27Z"
]
},
{
"data_path": "action_result.data.*.status",
"data_type": "string",
"example_values": [
"normal"
]
},
{
"data_path": "action_result.data.*.system_manufacturer",
"data_type": "string",
"example_values": [
"VMware, Inc."
]
},
{
"data_path": "action_result.data.*.system_product_name",
"data_type": "string",
"example_values": [
"VMware Virtual Platform"
]
},
{
"contains": [
"host name"
],
"data_path": "action_result.summary.hostname",
"data_type": "string",
"example_values": [
"TheNarrowSea"
]
},
{
"data_path": "action_result.message",
"data_type": "string",
"example_values": [
"Device details fetched successfully"
]
},
{
"data_path": "summary.total_objects",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "summary.total_objects_successful",
"data_type": "numeric",
"example_values": [
1
]
}
],
"parameters": {
"id": {
"contains": [
"crowdstrike device id"
],
"data_type": "string",
"default": null,
"description": "Device ID from previous Crowdstrike IOC search",
"key": "id",
"primary": true,
"required": true
}
},
"product_name": "CrowdStrike",
"product_vendor": "CrowdStrike",
"targets": "19",
"type": "endpoint"
}
],
"attrs": {
".action": {
"text": "get system info"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "Investigate"
},
"g.approver image": {
"opacity": 1
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
},
"g.timer image": {
"opacity": 1
}
},
"block_code": "def get_system_info_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('get_system_info_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'get_system_info_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.device_id', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'get_system_info_1' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'id': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"get system info\", parameters=parameters, assets=['crowdstrike_oauth'], callback=join_format_prompt, name=\"get_system_info_1\", parent_action=action)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": true,
"color": "",
"connected_to_start": true,
"connection_name": "hunt file",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "",
"delay": 0,
"description": "Fetch additional information about each machine listed in the previous step.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "005c6087-3fe9-4e37-89f7-f170dd34412b",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 293,
"line_start": 270,
"message": "Configuring now",
"name": "get system info",
"notes": "Fetch additional information about each machine listed in the previous step.",
"number": 1,
"order": 14,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 480,
"y": 60
},
"previous_function": "",
"previous_name": "get_system_info_1",
"required_params": {
"id": true
},
"reviewer": "",
"show_number": false,
"size": {
"height": 100,
"width": 180
},
"state": "app_action_assets",
"status": "",
"title": "Investigate",
"type": "coa.Action",
"warn": false,
"z": 267
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".format": {
"text": "format detect description"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"text": "Configuring now"
},
".outPorts>.port-out-1": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out-1>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
".title": {
"text": "format"
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def format_detect_description(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_detect_description() called')\n \n template = \"\"\"This indicator was created by Phantom in the playbook crowdstrike_malware_triage to detect and block process executions based on the file hash first seen in {0} and processed in Phantom as {1}\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink\",\n \"container:url\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_detect_description\")\n\n create_detect_indicator(container=container)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "crowdstrike new file detection",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "format detect description",
"description": "Format a description to provide when creating an Indicator with a policy of \"detect\".",
"format": "format",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "0f9d0bb7-4931-4e17-b50f-03ff0551c70d",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 615,
"line_start": 598,
"message": "Configuring now",
"name": "format",
"notes": "Format a description to provide when creating an Indicator with a policy of \"detect\".",
"number": 5,
"order": 25,
"outPorts": [
"out-1"
],
"parameters": [
{
"position": 0,
"type": "",
"value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink"
},
{
"position": 1,
"type": "",
"value": "container:url"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1280,
"y": 60
},
"previous_function": "",
"previous_name": "format_detect_description",
"show_number": true,
"size": {
"height": 100,
"width": 180
},
"state": "format",
"status": "",
"template": "This indicator was created by Phantom in the playbook crowdstrike_malware_triage to detect and block process executions based on the file hash first seen in {0} and processed in Phantom as {1}",
"title": "format",
"type": "coa.Format",
"warn": false,
"z": 276
},
{
"active": false,
"angle": 0,
"api": "add comment",
"attrs": {
".api": {
"text": "comment no indicator"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "API"
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def comment_no_indicator(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('comment_no_indicator() called')\n\n phantom.comment(container=container, comment=\"The analyst decided not to create a custom indicator for the file hash.\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"color": "",
"configured": [
{
"addCommentComment": "The analyst decided not to create a custom indicator for the file hash.",
"key": "add-comment"
}
],
"connected_to_start": true,
"connection_name": "crowdstrike new file detection",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "comment no indicator",
"description": "Explain in a comment that no Indicator will be created.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "d6ae9b4a-a027-4ce4-b4ea-15a67a35668d",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 595,
"line_start": 588,
"message": "Configuring now",
"name": "add comment",
"notes": "Explain in a comment that no Indicator will be created.",
"number": 9,
"order": 24,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1280,
"y": -80
},
"previous_function": "",
"previous_name": "comment_no_indicator",
"show_number": false,
"size": {
"height": 100,
"width": 180
},
"state": "api",
"status": "",
"title": "API",
"type": "coa.API",
"warn": false,
"z": 281
},
{
"action": "upload indicator",
"action_type": "contain",
"active": false,
"active_keys": {},
"active_values": {
"description": "",
"expiration": "",
"ioc": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256",
"policy": "detect",
"share_level": "red",
"source": ""
},
"angle": 0,
"app": "CrowdStrike OAuth API",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"approver": "",
"assets": [
{
"action": "upload indicator",
"actions": [
"update indicator",
"delete indicator",
"upload indicator",
"list processes",
"on poll",
"list put files",
"list custom indicators",
"get indicator",
"upload put file",
"hunt domain",
"hunt file",
"get process detail",
"get system info",
"set status",
"get session file",
"list incidents",
"list incident behaviors",
"get incident details",
"list crowdscores",
"get role",
"list roles",
"get user roles",
"list users",
"update incident",
"get incident behaviors",
"list session files",
"get command details",
"run admin command",
"run command",
"list sessions",
"delete session",
"create session",
"remove hosts",
"assign hosts",
"unquarantine device",
"quarantine device",
"list groups",
"query device",
"test connectivity"
],
"active": true,
"app_name": "CrowdStrike OAuth API",
"app_version": "2.0.5",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"asset_name": "crowdstrike_oauth",
"config_type": "asset",
"count": 0,
"fields": {
"description": "",
"expiration": "",
"ioc": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256",
"policy": "detect",
"share_level": "red",
"source": ""
},
"has_app": true,
"id": 19,
"loaded": false,
"missing": false,
"name": "crowdstrike_oauth",
"output": [
{
"data_path": "action_result.status",
"data_type": "string",
"example_values": [
"success",
"failed"
]
},
{
"data_path": "action_result.parameter.description",
"data_type": "string",
"example_values": [
"test description"
]
},
{
"data_path": "action_result.parameter.expiration",
"data_type": "numeric",
"example_values": [
10
]
},
{
"contains": [
"hash",
"sha256",
"sha1",
"md5",
"domain",
"ip"
],
"data_path": "action_result.parameter.ioc",
"data_type": "string",
"example_values": [
"test"
]
},
{
"data_path": "action_result.parameter.policy",
"data_type": "string",
"example_values": [
"detect"
]
},
{
"data_path": "action_result.parameter.share_level",
"data_type": "string",
"example_values": [
"red"
]
},
{
"data_path": "action_result.parameter.source",
"data_type": "string",
"example_values": [
"test source"
]
},
{
"data_path": "action_result.data",
"data_type": "string"
},
{
"data_path": "action_result.summary",
"data_type": "string"
},
{
"data_path": "action_result.message",
"data_type": "string",
"example_values": [
"IOC Uploaded to create alert"
]
},
{
"data_path": "summary.total_objects",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "summary.total_objects_successful",
"data_type": "numeric",
"example_values": [
1
]
}
],
"parameters": {
"description": {
"data_type": "string",
"default": null,
"description": "Indicator description",
"key": "description",
"order": 5,
"required": false
},
"expiration": {
"data_type": "numeric",
"default": null,
"description": "Alert lifetime in days (Valid for domains and ips only)",
"key": "expiration",
"order": 3,
"required": false
},
"ioc": {
"contains": [
"hash",
"sha256",
"sha1",
"md5",
"domain",
"ip"
],
"data_type": "string",
"default": null,
"description": "Input domain, ip, or hash ioc",
"key": "ioc",
"order": 0,
"primary": true,
"required": true
},
"policy": {
"data_type": "string",
"default": null,
"description": "Enforcement Policy (in case of detection)",
"key": "policy",
"order": 1,
"required": true,
"value_list": [
"detect",
"none"
]
},
"share_level": {
"data_type": "string",
"default": null,
"description": "Indicator share level",
"key": "share_level",
"order": 2,
"required": false,
"value_list": [
"red"
]
},
"source": {
"data_type": "string",
"default": null,
"description": "Indicator Originating source",
"key": "source",
"order": 4,
"required": false
}
},
"product_name": "CrowdStrike",
"product_vendor": "CrowdStrike",
"targets": "19",
"type": "endpoint"
}
],
"attrs": {
".action": {
"text": "create detect indicator"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "Contain"
},
"g.approver image": {
"opacity": 1
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_contain.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
},
"g.timer image": {
"opacity": 1
}
},
"block_code": "def create_detect_indicator(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('create_detect_indicator() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'create_detect_indicator' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'create_detect_indicator' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'ioc': filtered_artifacts_item_1[0],\n 'policy': \"detect\",\n 'source': \"\",\n 'expiration': \"\",\n 'description': \"\",\n 'share_level': \"red\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"upload indicator\", parameters=parameters, assets=['crowdstrike_oauth'], name=\"create_detect_indicator\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": true,
"color": "",
"connected_to_start": true,
"connection_name": "crowdstrike new file detection",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "create detect indicator",
"delay": 0,
"description": "Create an Indicator to detect and block this file hash.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "a8b369f1-2a55-4e49-85da-a66c35534861",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 646,
"line_start": 618,
"message": "Configuring now",
"name": "upload indicator",
"notes": "Create an Indicator to detect and block this file hash.",
"number": 2,
"order": 26,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1520,
"y": 60
},
"previous_function": "",
"previous_name": "create_detect_indicator",
"required_params": {
"ioc": true,
"policy": true
},
"reviewer": "",
"show_number": true,
"size": {
"height": 100,
"width": 180
},
"state": "app_action_assets",
"status": "",
"title": "Contain",
"type": "coa.Action",
"warn": false,
"z": 282
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".format": {
"text": "format repeat note"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"text": "Configuring now"
},
".outPorts>.port-out-1": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out-1>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
".title": {
"text": "format"
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def format_repeat_note(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_repeat_note() called')\n \n template = \"\"\"CrowdStrike detected a file on an endpoint which matched a previously detected file hash: \n\n| Field | Value |\n|---|---|\n| Host | {0} |\n| Command Line | {1} |\n| SHA 256 | {2} |\n| File Path | {3}\\\\\\\\{4} |\n| CrowdStrike Detection Link | {5} | \n\n---\n\nThis event will have the severity escalated to high, and should be investigated further.\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sourceHostName\",\n \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.cmdLine\",\n \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256\",\n \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.filePath\",\n \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileName\",\n \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_repeat_note\")\n\n add_repeat_note(container=container)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "get indicator",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "format repeat note",
"description": "Format a note to summarize all known information about the event.",
"format": "format",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "a03011e0-61d6-4949-b0c2-03e18b844dba",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 172,
"line_start": 139,
"message": "Configuring now",
"name": "format",
"notes": "Format a note to summarize all known information about the event.",
"number": 2,
"order": 8,
"outPorts": [
"out-1"
],
"parameters": [
{
"position": 0,
"type": "",
"value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sourceHostName"
},
{
"position": 1,
"type": "",
"value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.cmdLine"
},
{
"position": 2,
"type": "",
"value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
},
{
"position": 3,
"type": "",
"value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.filePath"
},
{
"position": 4,
"type": "",
"value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileName"
},
{
"position": 5,
"type": "",
"value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 320,
"y": 620
},
"previous_function": "",
"previous_name": "format_repeat_note",
"show_number": true,
"size": {
"height": 100,
"width": 180
},
"state": "format",
"status": "",
"template": "CrowdStrike detected a file on an endpoint which matched a previously detected file hash: \n\n| Field | Value |\n|---|---|\n| Host | {0} |\n| Command Line | {1} |\n| SHA 256 | {2} |\n| File Path | {3}\\\\{4} |\n| CrowdStrike Detection Link | {5} | \n\n---\n\nThis event will have the severity escalated to high, and should be investigated further.",
"title": "format",
"type": "coa.Format",
"warn": false,
"z": 284
},
{
"active": false,
"angle": 0,
"api": "add comment",
"attrs": {
".api": {
"text": "detection policy none"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "API"
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def detection_policy_none(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('detection_policy_none() called')\n\n phantom.comment(container=container, comment=\"The file hash indicator has a detection policy of none, so previous investigations have found that the file is not harmful. This playbook will take no further action and the event will be closed.\")\n close_event(container=container)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"color": "",
"configured": [
{
"addCommentComment": "The file hash indicator has a detection policy of none, so previous investigations have found that the file is not harmful. This playbook will take no further action and the event will be closed.",
"key": "add-comment"
}
],
"connected_to_start": true,
"connection_name": "get indicator",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "detection policy none",
"description": "Add a comment to explain why the event is being closed.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "ea7fbdda-bb34-4d57-9973-03db50614381",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 267,
"line_start": 259,
"message": "Configuring now",
"name": "add comment",
"notes": "Add a comment to explain why the event is being closed.",
"number": 7,
"order": 13,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 320,
"y": 340
},
"previous_function": "",
"previous_name": "detection_policy_none",
"show_number": false,
"size": {
"height": 100,
"width": 180
},
"state": "api",
"status": "",
"title": "API",
"type": "coa.API",
"warn": false,
"z": 287
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "837789d7-0479-4e6b-b678-3d036385f0ed",
"router": {
"name": "metro"
},
"source": {
"id": "278bf5f1-38a2-4a6c-924e-4f37b28fa60e",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "f41cc6f3-3db1-4909-b141-04c01050331f",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 289
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "7f5c6b2b-9839-4db7-acf7-6999c8469f60",
"router": {
"name": "metro"
},
"source": {
"id": "f41cc6f3-3db1-4909-b141-04c01050331f",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "98e3644d-2438-4cf7-8aaf-928647553f7b",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 294
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "3ca96a50-53a8-4881-a653-6f4fe7ebc6d3",
"router": {
"name": "metro"
},
"source": {
"id": "98e3644d-2438-4cf7-8aaf-928647553f7b",
"port": "out-1",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "4b535b2e-3be9-4a09-be52-dbbe8ada4228",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 301
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "0be99cce-991a-48a7-aa9e-ff9dfbd8ce9e",
"router": {
"name": "metro"
},
"source": {
"id": "98e3644d-2438-4cf7-8aaf-928647553f7b",
"port": "out-2",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "dc3a4fa8-879c-49f9-8af9-3c050b7f1aba",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 307
},
{
"active": false,
"angle": 0,
"api": "add comment",
"attrs": {
".api": {
"text": "comment no quarantine 1"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "API"
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def comment_no_quarantine_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('comment_no_quarantine_1() called')\n\n phantom.comment(container=container, comment=\"The analyst decided not to quarantine the endpoint.\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"color": "",
"configured": [
{
"addCommentComment": "The analyst decided not to quarantine the endpoint.",
"key": "add-comment"
}
],
"connected_to_start": true,
"connection_name": "crowdstrike new file detection",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "comment no quarantine 1",
"description": "Do not quarantine the endpoint because the analyst responded No in the prompt.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "e67e9ce0-f06d-4687-b3ed-d5d24860ed82",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 656,
"line_start": 649,
"message": "Configuring now",
"name": "add comment",
"notes": "Do not quarantine the endpoint because the analyst responded No in the prompt.",
"number": 10,
"order": 27,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1280,
"y": 340
},
"previous_function": "",
"previous_name": "comment_no_quarantine_1",
"show_number": false,
"size": {
"height": 100,
"width": 180
},
"state": "api",
"status": "",
"title": "API",
"type": "coa.API",
"warn": false,
"z": 311
},
{
"active": false,
"angle": 0,
"api": "add comment",
"attrs": {
".api": {
"text": "comment no quarantine 2"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "API"
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def comment_no_quarantine_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('comment_no_quarantine_2() called')\n\n phantom.comment(container=container, comment=\"The analyst decided not to quarantine the endpoint.\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"color": "",
"configured": [
{
"addCommentComment": "The analyst decided not to quarantine the endpoint.",
"key": "add-comment"
}
],
"connected_to_start": true,
"connection_name": "crowdstrike known file quarantine",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "comment no quarantine 2",
"description": "Do not quarantine the endpoint because the analyst responded No in the prompt.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "dc3a4fa8-879c-49f9-8af9-3c050b7f1aba",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 779,
"line_start": 772,
"message": "Configuring now",
"name": "add comment",
"notes": "Do not quarantine the endpoint because the analyst responded No in the prompt.",
"number": 11,
"order": 32,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1080,
"y": 760
},
"previous_function": "",
"previous_name": "comment_no_quarantine_2",
"show_number": false,
"size": {
"height": 100,
"width": 180
},
"state": "api",
"status": "",
"title": "API",
"type": "coa.API",
"warn": false,
"z": 312
},
{
"active": false,
"angle": 0,
"api": "add note",
"attrs": {
".api": {
"text": "add repeat note"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "API"
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def add_repeat_note(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_repeat_note() called')\n\n formatted_data_1 = phantom.get_format_data(name='format_repeat_note')\n\n note_title = \"Known Malicious File\"\n note_content = formatted_data_1\n note_format = \"markdown\"\n phantom.add_note(container=container, note_type=\"general\", title=note_title, content=note_content, note_format=note_format)\n crowdstrike_known_file_quarantine(container=container)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"color": "",
"configured": [
{
"addNoteContent": "format_repeat_note:formatted_data",
"addNoteNoteFormat": "markdown",
"addNoteTitle": "Known Malicious File",
"key": "add-note"
}
],
"connected_to_start": true,
"connection_name": "get indicator",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "add repeat note",
"description": "Add a note to summarize the event information.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "278bf5f1-38a2-4a6c-924e-4f37b28fa60e",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 188,
"line_start": 175,
"message": "Configuring now",
"name": "add note",
"notes": "Add a note to summarize the event information.",
"number": 4,
"order": 9,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 560,
"y": 620
},
"previous_function": "",
"previous_name": "add_repeat_note",
"show_number": false,
"size": {
"height": 100,
"width": 180
},
"state": "api",
"status": "",
"title": "API",
"type": "coa.API",
"warn": false,
"z": 314
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#637282",
"transform": "rotate(45 30 70)"
},
".inPorts>.port-0>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".number": {
"text": 6
},
".outPorts>.port-0": {
"port": {
"id": "out-1",
"type": "out"
},
"ref-x": 83,
"ref-y": 40
},
".outPorts>.port-0>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
".outPorts>.port-1": {
"port": {
"id": "out-2",
"type": "out"
},
"ref-x": 41,
"ref-y": 82
},
".outPorts>.port-1>.port-body": {
"port": {
"id": "out-2",
"type": "out"
}
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def quarantine_decision_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('quarantine_decision_1() called')\n\n # check for 'if' condition 1\n matched = phantom.decision(\n container=container,\n action_results=results,\n conditions=[\n [\"crowdstrike_new_file_detection:action_result.summary.responses.1\", \"==\", \"Yes\"],\n ])\n\n # call connected blocks if condition 1 matched\n if matched:\n quarantine_device_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n # call connected blocks for 'else' condition 2\n comment_no_quarantine_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "crowdstrike new file detection",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "quarantine decision 1",
"description": "Check the quarantine device prompt response.",
"hasElse": true,
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "d5f48d34-ef50-4204-956c-7023b9846414",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 533,
"line_start": 512,
"name": "decision",
"notes": "Check the quarantine device prompt response.",
"number": 6,
"order": 21,
"outPorts": [
"out-1",
"out-2"
],
"outputs": [
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "crowdstrike_new_file_detection:action_result.summary.responses.1",
"value": "Yes"
}
],
"display": "If",
"logic": "and",
"type": "if"
},
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "",
"value": ""
}
],
"display": "Else",
"logic": "and",
"type": "else"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1140,
"y": 200
},
"previous_function": "",
"previous_name": "quarantine_decision_1",
"show_number": true,
"size": {
"height": 82,
"width": 82
},
"state": "decision",
"status": "",
"type": "coa.Decision",
"warn": "",
"z": 318
},
{
"action": "quarantine device",
"action_type": "contain",
"active": false,
"active_keys": {},
"active_values": {
"device_id": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId",
"hostname": ""
},
"angle": 0,
"app": "CrowdStrike OAuth API",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"approver": "",
"assets": [
{
"action": "quarantine device",
"actions": [
"update indicator",
"delete indicator",
"upload indicator",
"list processes",
"on poll",
"list put files",
"list custom indicators",
"get indicator",
"upload put file",
"hunt domain",
"hunt file",
"get process detail",
"get system info",
"set status",
"get session file",
"list incidents",
"list incident behaviors",
"get incident details",
"list crowdscores",
"get role",
"list roles",
"get user roles",
"list users",
"update incident",
"get incident behaviors",
"list session files",
"get command details",
"run admin command",
"run command",
"list sessions",
"delete session",
"create session",
"remove hosts",
"assign hosts",
"unquarantine device",
"quarantine device",
"list groups",
"query device",
"test connectivity"
],
"active": true,
"app_name": "CrowdStrike OAuth API",
"app_version": "2.0.5",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"asset_name": "crowdstrike_oauth",
"config_type": "asset",
"count": 0,
"fields": {
"device_id": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId",
"hostname": ""
},
"has_app": true,
"id": 19,
"loaded": false,
"missing": false,
"name": "crowdstrike_oauth",
"output": [
{
"data_path": "action_result.status",
"data_type": "string",
"example_values": [
"success",
"failed"
]
},
{
"contains": [
"crowdstrike device id"
],
"data_path": "action_result.parameter.device_id",
"data_type": "string",
"example_values": [
"c70bbe8334aa47bd61046603eb27b15a"
]
},
{
"contains": [
"host name"
],
"data_path": "action_result.parameter.hostname",
"data_type": "string",
"example_values": [
"CB-TEST-01"
]
},
{
"column_name": "Device ID",
"column_order": 0,
"contains": [
"crowdstrike device id"
],
"data_path": "action_result.data.*.id",
"data_type": "string",
"example_values": [
"c70bbe8334aa47bd61046603eb27b15a"
]
},
{
"column_name": "Path",
"column_order": 1,
"data_path": "action_result.data.*.path",
"data_type": "string",
"example_values": [
"/devices/entities/devices/v1"
]
},
{
"data_path": "action_result.summary.total_quarantined_device",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.message",
"data_type": "string",
"example_values": [
"Device quarantined successfully"
]
},
{
"data_path": "summary.total_objects",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "summary.total_objects_successful",
"data_type": "numeric",
"example_values": [
1
]
}
],
"parameters": {
"device_id": {
"contains": [
"crowdstrike device id"
],
"data_type": "string",
"default": null,
"description": "Comma-separated list of device IDs",
"key": "device_id",
"order": 0,
"primary": true,
"required": false
},
"hostname": {
"contains": [
"host name"
],
"data_type": "string",
"default": null,
"description": "Comma-separated list of hostnames",
"key": "hostname",
"order": 1,
"primary": true,
"required": false
}
},
"product_name": "CrowdStrike",
"product_vendor": "CrowdStrike",
"targets": "19",
"type": "endpoint"
}
],
"attrs": {
".action": {
"text": "quarantine device 1"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "Contain"
},
"g.approver image": {
"opacity": 1
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_contain.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
},
"g.timer image": {
"opacity": 1
}
},
"block_code": "def quarantine_device_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('quarantine_device_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'quarantine_device_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'quarantine_device_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n parameters.append({\n 'hostname': \"\",\n 'device_id': filtered_artifacts_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"quarantine device\", parameters=parameters, assets=['crowdstrike_oauth'], name=\"quarantine_device_1\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": true,
"color": "",
"connected_to_start": true,
"connection_name": "crowdstrike new file detection",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "quarantine device 1",
"delay": 0,
"description": "Block the endpoint from everything but the configured allowlist of network addresses while the investigation is ongoing.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "8f1bc7f0-5b9e-4e9c-9159-ee6a2b73c0e5",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 682,
"line_start": 659,
"message": "Configuring now",
"name": "quarantine device",
"notes": "Block the endpoint from everything but the configured allowlist of network addresses while the investigation is ongoing.",
"number": 1,
"order": 28,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1280,
"y": 200
},
"previous_function": "",
"previous_name": "quarantine_device_1",
"required_params": {},
"reviewer": "",
"show_number": true,
"size": {
"height": 100,
"width": 180
},
"state": "app_action_assets",
"status": "",
"title": "Contain",
"type": "coa.Action",
"warn": false,
"z": 321
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#637282",
"transform": "rotate(45 30 70)"
},
".inPorts>.port-0>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".number": {
"text": 7
},
".outPorts>.port-0": {
"port": {
"id": "out-1",
"type": "out"
},
"ref-x": 83,
"ref-y": 40
},
".outPorts>.port-0>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
".outPorts>.port-1": {
"port": {
"id": "out-2",
"type": "out"
},
"ref-x": 41,
"ref-y": 82
},
".outPorts>.port-1>.port-body": {
"port": {
"id": "out-2",
"type": "out"
}
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def quarantine_decision_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('quarantine_decision_2() called')\n\n # check for 'if' condition 1\n matched = phantom.decision(\n container=container,\n action_results=results,\n conditions=[\n [\"crowdstrike_known_file_quarantine:action_result.summary.responses.0\", \"==\", \"Yes\"],\n ])\n\n # call connected blocks if condition 1 matched\n if matched:\n quarantine_device_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n # call connected blocks for 'else' condition 2\n comment_no_quarantine_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "crowdstrike known file quarantine",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "quarantine decision 2",
"description": "Check if the analyst responded Yes or No to the quarantine.",
"hasElse": true,
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "98e3644d-2438-4cf7-8aaf-928647553f7b",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 743,
"line_start": 722,
"name": "decision",
"notes": "Check if the analyst responded Yes or No to the quarantine.",
"number": 7,
"order": 30,
"outPorts": [
"out-1",
"out-2"
],
"outputs": [
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "crowdstrike_known_file_quarantine:action_result.summary.responses.0",
"value": "Yes"
}
],
"display": "If",
"logic": "and",
"type": "if"
},
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "",
"value": ""
}
],
"display": "Else",
"logic": "and",
"type": "else"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 940,
"y": 620
},
"previous_function": "",
"previous_name": "quarantine_decision_2",
"show_number": true,
"size": {
"height": 82,
"width": 82
},
"state": "decision",
"status": "",
"type": "coa.Decision",
"warn": "",
"z": 322
},
{
"action": "quarantine device",
"action_type": "contain",
"active": false,
"active_keys": {},
"active_values": {
"device_id": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId",
"hostname": ""
},
"angle": 0,
"app": "CrowdStrike OAuth API",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"approver": "",
"assets": [
{
"action": "quarantine device",
"actions": [
"update indicator",
"delete indicator",
"upload indicator",
"list processes",
"on poll",
"list put files",
"list custom indicators",
"get indicator",
"upload put file",
"hunt domain",
"hunt file",
"get process detail",
"get system info",
"set status",
"get session file",
"list incidents",
"list incident behaviors",
"get incident details",
"list crowdscores",
"get role",
"list roles",
"get user roles",
"list users",
"update incident",
"get incident behaviors",
"list session files",
"get command details",
"run admin command",
"run command",
"list sessions",
"delete session",
"create session",
"remove hosts",
"assign hosts",
"unquarantine device",
"quarantine device",
"list groups",
"query device",
"test connectivity"
],
"active": true,
"app_name": "CrowdStrike OAuth API",
"app_version": "2.0.5",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"asset_name": "crowdstrike_oauth",
"config_type": "asset",
"count": 0,
"fields": {
"device_id": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId",
"hostname": ""
},
"has_app": true,
"id": 19,
"loaded": false,
"missing": false,
"name": "crowdstrike_oauth",
"output": [
{
"data_path": "action_result.status",
"data_type": "string",
"example_values": [
"success",
"failed"
]
},
{
"contains": [
"crowdstrike device id"
],
"data_path": "action_result.parameter.device_id",
"data_type": "string",
"example_values": [
"c70bbe8334aa47bd61046603eb27b15a"
]
},
{
"contains": [
"host name"
],
"data_path": "action_result.parameter.hostname",
"data_type": "string",
"example_values": [
"CB-TEST-01"
]
},
{
"column_name": "Device ID",
"column_order": 0,
"contains": [
"crowdstrike device id"
],
"data_path": "action_result.data.*.id",
"data_type": "string",
"example_values": [
"c70bbe8334aa47bd61046603eb27b15a"
]
},
{
"column_name": "Path",
"column_order": 1,
"data_path": "action_result.data.*.path",
"data_type": "string",
"example_values": [
"/devices/entities/devices/v1"
]
},
{
"data_path": "action_result.summary.total_quarantined_device",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.message",
"data_type": "string",
"example_values": [
"Device quarantined successfully"
]
},
{
"data_path": "summary.total_objects",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "summary.total_objects_successful",
"data_type": "numeric",
"example_values": [
1
]
}
],
"parameters": {
"device_id": {
"contains": [
"crowdstrike device id"
],
"data_type": "string",
"default": null,
"description": "Comma-separated list of device IDs",
"key": "device_id",
"order": 0,
"primary": true,
"required": false
},
"hostname": {
"contains": [
"host name"
],
"data_type": "string",
"default": null,
"description": "Comma-separated list of hostnames",
"key": "hostname",
"order": 1,
"primary": true,
"required": false
}
},
"product_name": "CrowdStrike",
"product_vendor": "CrowdStrike",
"targets": "19",
"type": "endpoint"
}
],
"attrs": {
".action": {
"text": "quarantine device 2"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "Contain"
},
"g.approver image": {
"opacity": 1
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_contain.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
},
"g.timer image": {
"opacity": 1
}
},
"block_code": "def quarantine_device_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('quarantine_device_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'quarantine_device_2' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'quarantine_device_2' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n parameters.append({\n 'hostname': \"\",\n 'device_id': filtered_artifacts_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"quarantine device\", parameters=parameters, assets=['crowdstrike_oauth'], name=\"quarantine_device_2\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": true,
"color": "",
"connected_to_start": true,
"connection_name": "crowdstrike known file quarantine",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "",
"delay": 0,
"description": "Block the endpoint from everything but the configured allowlist of network addresses while the investigation is ongoing.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "4b535b2e-3be9-4a09-be52-dbbe8ada4228",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 769,
"line_start": 746,
"message": "Configuring now",
"name": "quarantine device",
"notes": "Block the endpoint from everything but the configured allowlist of network addresses while the investigation is ongoing.",
"number": 2,
"order": 31,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1080,
"y": 620
},
"previous_function": "",
"previous_name": "quarantine_device_2",
"required_params": {},
"reviewer": "",
"show_number": true,
"size": {
"height": 100,
"width": 180
},
"state": "app_action_assets",
"status": "",
"title": "Contain",
"type": "coa.Action",
"warn": false,
"z": 323
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".format": {
"text": "format ignore description"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"text": "Configuring now"
},
".outPorts>.port-out-1": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out-1>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
".title": {
"text": "format"
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def format_ignore_description(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_ignore_description() called')\n \n template = \"\"\"This indicator was created by Phantom in the playbook crowdstrike_malware_triage to ignore CrowdStrike detections based on the file hash first seen in {0} and processed in Phantom as {1}\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink\",\n \"container:url\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_ignore_description\")\n\n create_ignore_indicator(container=container)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "crowdstrike new file detection",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "format ignore description",
"description": "Format a description to provide when creating an Indicator with a policy of \"none\".",
"format": "format",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "da97de34-c6e5-47a8-bfcb-0a7ee4cca2a1",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 585,
"line_start": 568,
"message": "Configuring now",
"name": "format",
"notes": "Format a description to provide when creating an Indicator with a policy of \"none\".",
"number": 4,
"order": 23,
"outPorts": [
"out-1"
],
"parameters": [
{
"position": 0,
"type": "",
"value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink"
},
{
"position": 1,
"type": "",
"value": "container:url"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1280,
"y": -220
},
"previous_function": "",
"previous_name": "format_ignore_description",
"show_number": true,
"size": {
"height": 100,
"width": 180
},
"state": "format",
"status": "",
"template": "This indicator was created by Phantom in the playbook crowdstrike_malware_triage to ignore CrowdStrike detections based on the file hash first seen in {0} and processed in Phantom as {1}",
"title": "format",
"type": "coa.Format",
"warn": false,
"z": 324
},
{
"action": "upload indicator",
"action_type": "contain",
"active": false,
"active_keys": {},
"active_values": {
"description": "format_ignore_description:formatted_data",
"expiration": "",
"ioc": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256",
"policy": "none",
"share_level": "red",
"source": "Phantom Playbook crowdstrike_malware_triage"
},
"angle": 0,
"app": "CrowdStrike OAuth API",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"approver": "",
"assets": [
{
"action": "upload indicator",
"actions": [
"update indicator",
"delete indicator",
"upload indicator",
"list processes",
"on poll",
"list put files",
"list custom indicators",
"get indicator",
"upload put file",
"hunt domain",
"hunt file",
"get process detail",
"get system info",
"set status",
"get session file",
"list incidents",
"list incident behaviors",
"get incident details",
"list crowdscores",
"get role",
"list roles",
"get user roles",
"list users",
"update incident",
"get incident behaviors",
"list session files",
"get command details",
"run admin command",
"run command",
"list sessions",
"delete session",
"create session",
"remove hosts",
"assign hosts",
"unquarantine device",
"quarantine device",
"list groups",
"query device",
"test connectivity"
],
"active": true,
"app_name": "CrowdStrike OAuth API",
"app_version": "2.0.5",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"asset_name": "crowdstrike_oauth",
"config_type": "asset",
"count": 0,
"fields": {
"description": "format_ignore_description:formatted_data",
"expiration": "",
"ioc": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256",
"policy": "none",
"share_level": "red",
"source": "Phantom Playbook crowdstrike_malware_triage"
},
"has_app": true,
"id": 19,
"loaded": false,
"missing": false,
"name": "crowdstrike_oauth",
"output": [
{
"data_path": "action_result.status",
"data_type": "string",
"example_values": [
"success",
"failed"
]
},
{
"data_path": "action_result.parameter.description",
"data_type": "string",
"example_values": [
"test description"
]
},
{
"data_path": "action_result.parameter.expiration",
"data_type": "numeric",
"example_values": [
10
]
},
{
"contains": [
"hash",
"sha256",
"sha1",
"md5",
"domain",
"ip"
],
"data_path": "action_result.parameter.ioc",
"data_type": "string",
"example_values": [
"test"
]
},
{
"data_path": "action_result.parameter.policy",
"data_type": "string",
"example_values": [
"detect"
]
},
{
"data_path": "action_result.parameter.share_level",
"data_type": "string",
"example_values": [
"red"
]
},
{
"data_path": "action_result.parameter.source",
"data_type": "string",
"example_values": [
"test source"
]
},
{
"data_path": "action_result.data",
"data_type": "string"
},
{
"data_path": "action_result.summary",
"data_type": "string"
},
{
"data_path": "action_result.message",
"data_type": "string",
"example_values": [
"IOC Uploaded to create alert"
]
},
{
"data_path": "summary.total_objects",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "summary.total_objects_successful",
"data_type": "numeric",
"example_values": [
1
]
}
],
"parameters": {
"description": {
"data_type": "string",
"default": null,
"description": "Indicator description",
"key": "description",
"order": 5,
"required": false
},
"expiration": {
"data_type": "numeric",
"default": null,
"description": "Alert lifetime in days (Valid for domains and ips only)",
"key": "expiration",
"order": 3,
"required": false
},
"ioc": {
"contains": [
"hash",
"sha256",
"sha1",
"md5",
"domain",
"ip"
],
"data_type": "string",
"default": null,
"description": "Input domain, ip, or hash ioc",
"key": "ioc",
"order": 0,
"primary": true,
"required": true
},
"policy": {
"data_type": "string",
"default": null,
"description": "Enforcement Policy (in case of detection)",
"key": "policy",
"order": 1,
"required": true,
"value_list": [
"detect",
"none"
]
},
"share_level": {
"data_type": "string",
"default": null,
"description": "Indicator share level",
"key": "share_level",
"order": 2,
"required": false,
"value_list": [
"red"
]
},
"source": {
"data_type": "string",
"default": null,
"description": "Indicator Originating source",
"key": "source",
"order": 4,
"required": false
}
},
"product_name": "CrowdStrike",
"product_vendor": "CrowdStrike",
"targets": "19",
"type": "endpoint"
}
],
"attrs": {
".action": {
"text": "create ignore indicator"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "Contain"
},
"g.approver image": {
"opacity": 1
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_contain.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
},
"g.timer image": {
"opacity": 1
}
},
"block_code": "def create_ignore_indicator(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('create_ignore_indicator() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'create_ignore_indicator' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])\n formatted_data_1 = phantom.get_format_data(name='format_ignore_description')\n\n parameters = []\n \n # build parameters list for 'create_ignore_indicator' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'ioc': filtered_artifacts_item_1[0],\n 'policy': \"none\",\n 'source': \"Phantom Playbook crowdstrike_malware_triage\",\n 'expiration': \"\",\n 'description': formatted_data_1,\n 'share_level': \"red\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"upload indicator\", parameters=parameters, assets=['crowdstrike_oauth'], name=\"create_ignore_indicator\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": true,
"color": "",
"connected_to_start": true,
"connection_name": "crowdstrike new file detection",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "create ignore indicator",
"delay": 0,
"description": "Create an Indicator in CrowdStrike with a policy of \"none\" to ignore detections based on this file hash in the future.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "d04015bf-190d-415d-8fab-06f8f1276751",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 565,
"line_start": 536,
"message": "Configuring now",
"name": "upload indicator",
"notes": "Create an Indicator in CrowdStrike with a policy of \"none\" to ignore detections based on this file hash in the future.",
"number": 1,
"order": 22,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1520,
"y": -220
},
"previous_function": "",
"previous_name": "create_ignore_indicator",
"required_params": {
"ioc": true,
"policy": true
},
"reviewer": "",
"show_number": true,
"size": {
"height": 100,
"width": 180
},
"state": "app_action_assets",
"status": "",
"title": "Contain",
"type": "coa.Action",
"warn": false,
"z": 325
},
{
"active": false,
"angle": 0,
"api": "add comment",
"attrs": {
".api": {
"text": "comment unexpected po..."
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "API"
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def comment_unexpected_policy(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('comment_unexpected_policy() called')\n\n phantom.comment(container=container, comment=\"The playbook received an unexpected indicator policy and needs to be extended to handle this situation.\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"color": "",
"configured": [
{
"addCommentComment": "The playbook received an unexpected indicator policy and needs to be extended to handle this situation.",
"key": "add-comment"
}
],
"connected_to_start": true,
"connection_name": "get indicator",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "comment unexpected policy",
"description": "End processing because this playbook only expects \"none\" or \"detect\" as the Indicator policy.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "b827b91f-97e9-4a99-983a-bdb0b4eb98ce",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 256,
"line_start": 249,
"message": "Configuring now",
"name": "add comment",
"notes": "End processing because this playbook only expects \"none\" or \"detect\" as the Indicator policy.",
"number": 5,
"order": 12,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 320,
"y": 200
},
"previous_function": "",
"previous_name": "comment_unexpected_policy",
"show_number": false,
"size": {
"height": 100,
"width": 180
},
"state": "api",
"status": "",
"title": "API",
"type": "coa.API",
"warn": false,
"z": 326
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".format": {
"text": "format prompt"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"text": "Configuring now"
},
".outPorts>.port-out-1": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out-1>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
".title": {
"text": "format"
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def format_prompt(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_prompt() called')\n \n template = \"\"\"CrowdStrike detected the following suspicious activity on an endpoint:\n\n| Field | Value |\n|---|---|\n| Host | {0} |\n| Command Line | {1} |\n| SHA 256 | {2} |\n| File Path | {3}\\\\\\\\{4}\n| CrowdStrike Detection Link | {5} |\n| Details of processes associated with the file hash | <see \\\"get process details\\\" action results> |\n| Count of machines that have the file on disk | {6} |\n| System information of machines that have the file on disk | <see \\\"get system info\\\" action results> |\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sourceHostName\",\n \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.cmdLine\",\n \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256\",\n \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.filePath\",\n \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileName\",\n \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink\",\n \"hunt_file_1:action_result.summary.device_count\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_prompt\")\n\n crowdstrike_new_file_detection(container=container)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "get system info, get process details",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "format prompt",
"description": "Summarize all the gathered information to help the analyst decide a response in the prompt.",
"format": "format",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "09fbbded-a2ad-433f-968d-40f3ae3c189e",
"inPorts": [
"in"
],
"join_code": "def join_format_prompt(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('join_format_prompt() called')\n \n # if the joined function has already been called, do nothing\n if phantom.get_run_data(key='join_format_prompt_called'):\n return\n\n # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n if phantom.completed(action_names=['get_process_details']):\n \n # save the state that the joined function has now been called\n phantom.save_run_data(key='join_format_prompt_called', value='format_prompt')\n \n # call connected block \"format_prompt\"\n format_prompt(container=container, handle=handle)\n \n return",
"join_optional": [
"get_system_info_1"
],
"join_start": 329,
"line_end": 347,
"line_start": 296,
"message": "Configuring now",
"name": "format",
"notes": "Summarize all the gathered information to help the analyst decide a response in the prompt.",
"number": 3,
"order": 15,
"outPorts": [
"out-1"
],
"parameters": [
{
"position": 1,
"type": "",
"value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sourceHostName"
},
{
"position": 1,
"type": "",
"value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.cmdLine"
},
{
"position": 2,
"type": "",
"value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
},
{
"position": 3,
"type": "",
"value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.filePath"
},
{
"position": 4,
"type": "",
"value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileName"
},
{
"position": 5,
"type": "",
"value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink"
},
{
"position": 6,
"type": "",
"value": "hunt_file_1:action_result.summary.device_count"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 740,
"y": 60
},
"previous_function": "",
"previous_name": "format_prompt",
"show_number": true,
"size": {
"height": 100,
"width": 180
},
"state": "format",
"status": "",
"template": "CrowdStrike detected the following suspicious activity on an endpoint:\n\n| Field | Value |\n|---|---|\n| Host | {0} |\n| Command Line | {1} |\n| SHA 256 | {2} |\n| File Path | {3}\\\\{4}\n| CrowdStrike Detection Link | {5} |\n| Details of processes associated with the file hash | <see \"get process details\" action results> |\n| Count of machines that have the file on disk | {6} |\n| System information of machines that have the file on disk | <see \"get system info\" action results> |",
"title": "format",
"type": "coa.Format",
"warn": false,
"z": 328
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#637282",
"transform": "rotate(45 30 70)"
},
".inPorts>.port-0>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".number": {
"text": 5
},
".outPorts>.port-0": {
"port": {
"id": "out-1",
"type": "out"
},
"ref-x": 83,
"ref-y": 40
},
".outPorts>.port-0>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
".outPorts>.port-1": {
"port": {
"id": "out-2",
"type": "out"
},
"ref-x": 41,
"ref-y": 82
},
".outPorts>.port-1>.port-body": {
"port": {
"id": "out-2",
"type": "out"
}
},
".outPorts>.port-2": {
"port": {
"id": "out-3",
"type": "out"
},
"ref-x": 41,
"ref-y": -2
},
".outPorts>.port-2>.port-body": {
"port": {
"id": "out-3",
"type": "out"
}
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def indicator_decision(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('indicator_decision() called')\n\n # check for 'if' condition 1\n matched = phantom.decision(\n container=container,\n action_results=results,\n conditions=[\n [\"No, do not create an Indicator in CrowdStrike at this time.\", \"==\", \"crowdstrike_new_file_detection:action_result.summary.responses.0\"],\n ])\n\n # call connected blocks if condition 1 matched\n if matched:\n comment_no_indicator(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n # check for 'elif' condition 2\n matched = phantom.decision(\n container=container,\n action_results=results,\n conditions=[\n [\"Yes, create a CrowdStrike Indicator to detect and block this file hash from now on. (True Positive)\", \"==\", \"crowdstrike_new_file_detection:action_result.summary.responses.0\"],\n ])\n\n # call connected blocks if condition 2 matched\n if matched:\n format_detect_description(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n # check for 'elif' condition 3\n matched = phantom.decision(\n container=container,\n action_results=results,\n conditions=[\n [\"Yes, create a CrowdStrike Indicator to ignore this file hash going forward (False Positive)\", \"==\", \"crowdstrike_new_file_detection:action_result.summary.responses.0\"],\n ])\n\n # call connected blocks if condition 3 matched\n if matched:\n format_ignore_description(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "crowdstrike new file detection",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "indicator decision",
"description": "Parse the prompt response to determine how to handle the indicator.",
"hasElse": false,
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "f39ff0a8-97cc-494b-b692-346dd89eab7a",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 509,
"line_start": 465,
"name": "decision",
"notes": "Parse the prompt response to determine how to handle the indicator.",
"number": 5,
"order": 20,
"outPorts": [
"out-1",
"out-2",
"out-3"
],
"outputs": [
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "No, do not create an Indicator in CrowdStrike at this time.",
"value": "crowdstrike_new_file_detection:action_result.summary.responses.0"
}
],
"display": "If",
"logic": "and",
"type": "if"
},
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "Yes, create a CrowdStrike Indicator to detect and block this file hash from now on. (True Positive)",
"value": "crowdstrike_new_file_detection:action_result.summary.responses.0"
}
],
"display": "Else If",
"logic": "and",
"type": "elif"
},
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "Yes, create a CrowdStrike Indicator to ignore this file hash going forward (False Positive)",
"value": "crowdstrike_new_file_detection:action_result.summary.responses.0"
}
],
"display": "Else If",
"logic": "and",
"type": "elif"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1140,
"y": -80
},
"previous_function": "",
"previous_name": "indicator_decision",
"show_number": true,
"size": {
"height": 82,
"width": 82
},
"state": "decision",
"status": "",
"type": "coa.Decision",
"warn": "",
"z": 330
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#637282",
"transform": "rotate(45 30 70)"
},
".inPorts>.port-0>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".number": {
"text": 3
},
".outPorts>.port-0": {
"port": {
"id": "out-1",
"type": "out"
},
"ref-x": 83,
"ref-y": 40
},
".outPorts>.port-0>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
".outPorts>.port-1": {
"port": {
"id": "out-2",
"type": "out"
},
"ref-x": 41,
"ref-y": 82
},
".outPorts>.port-1>.port-body": {
"port": {
"id": "out-2",
"type": "out"
}
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def if_indicator_exists(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('if_indicator_exists() called')\n\n # check for 'if' condition 1\n matched = phantom.decision(\n container=container,\n action_results=results,\n conditions=[\n [\"Resource Not Found\", \"in\", \"get_indicator_2:action_result.message\"],\n ])\n\n # call connected blocks if condition 1 matched\n if matched:\n hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n list_processes_with_hash(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n # call connected blocks for 'else' condition 2\n indicator_policy_decision(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "get indicator",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "if indicator exists",
"description": "Determine which response to take based on whether an Indicator exists in CrowdStrike for the SHA256 file hash.",
"hasElse": true,
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "0484d948-e831-4efc-b3a4-5f7f6ffb9441",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 126,
"line_start": 104,
"name": "decision",
"notes": "Determine which response to take based on whether an Indicator exists in CrowdStrike for the SHA256 file hash.",
"number": 3,
"order": 6,
"outPorts": [
"out-1",
"out-2"
],
"outputs": [
{
"conditions": [
{
"comparison": "in",
"data_type": "",
"param": "Resource Not Found",
"value": "get_indicator_2:action_result.message"
}
],
"display": "If",
"logic": "and",
"type": "if"
},
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "",
"value": ""
}
],
"display": "Else",
"logic": "and",
"type": "else"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 100,
"y": 60
},
"previous_function": "",
"previous_name": "if_indicator_exists",
"show_number": true,
"size": {
"height": 82,
"width": 82
},
"state": "decision",
"status": "",
"type": "coa.Decision",
"warn": "",
"z": 332
},
{
"action": "hunt file",
"action_type": "investigate",
"active": false,
"active_keys": {},
"active_values": {
"count_only": "False",
"hash": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
},
"angle": 0,
"app": "CrowdStrike OAuth API",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"approver": "",
"assets": [
{
"action": "hunt file",
"actions": [
"update indicator",
"delete indicator",
"upload indicator",
"list processes",
"on poll",
"list put files",
"list custom indicators",
"get indicator",
"upload put file",
"hunt domain",
"hunt file",
"get process detail",
"get system info",
"set status",
"get session file",
"list incidents",
"list incident behaviors",
"get incident details",
"list crowdscores",
"get role",
"list roles",
"get user roles",
"list users",
"update incident",
"get incident behaviors",
"list session files",
"get command details",
"run admin command",
"run command",
"list sessions",
"delete session",
"create session",
"remove hosts",
"assign hosts",
"unquarantine device",
"quarantine device",
"list groups",
"query device",
"test connectivity"
],
"active": true,
"app_name": "CrowdStrike OAuth API",
"app_version": "2.0.5",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"asset_name": "crowdstrike_oauth",
"config_type": "asset",
"count": 0,
"fields": {
"count_only": "False",
"hash": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
},
"has_app": true,
"id": 19,
"loaded": false,
"missing": false,
"name": "crowdstrike_oauth",
"output": [
{
"data_path": "action_result.status",
"data_type": "string",
"example_values": [
"success",
"failed"
]
},
{
"data_path": "action_result.parameter.count_only",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "summary.total_objects",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "summary.total_objects_successful",
"data_type": "numeric",
"example_values": [
1
]
},
{
"contains": [
"hash",
"sha256",
"sha1",
"md5"
],
"data_path": "action_result.parameter.hash",
"data_type": "string",
"example_values": [
"eeb27d04c5fb25f7459407c0e5394621f12100e301b22d04a6b8f78e2adbf44t"
]
},
{
"column_name": "Crowdstrike Device ID",
"column_order": 0,
"contains": [
"crowdstrike device id"
],
"data_path": "action_result.data.*.device_id",
"data_type": "string",
"example_values": [
"07c312fabcb8473454d0a16f118928fg"
]
},
{
"data_path": "action_result.summary.device_count",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.message",
"data_type": "string",
"example_values": [
"Device count: 1"
]
}
],
"parameters": {
"count_only": {
"data_type": "boolean",
"default": false,
"description": "Get endpoint count only",
"key": "count_only",
"required": false
},
"hash": {
"contains": [
"hash",
"sha256",
"sha1",
"md5"
],
"data_type": "string",
"default": null,
"description": "File hash to search",
"key": "hash",
"primary": true,
"required": true
}
},
"product_name": "CrowdStrike",
"product_vendor": "CrowdStrike",
"targets": "19",
"type": "endpoint"
}
],
"attrs": {
".action": {
"text": "hunt file"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "Investigate"
},
"g.approver image": {
"opacity": 1
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
},
"g.timer image": {
"opacity": 1
}
},
"block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'hunt_file_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'hash': filtered_artifacts_item_1[0],\n 'count_only': False,\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['crowdstrike_oauth'], callback=get_system_info_1, name=\"hunt_file_1\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": true,
"color": "",
"connected_to_start": true,
"connection_name": "get indicator",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "",
"delay": 0,
"description": "List all machines where the file hash has been seen.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "6d11a3cf-6f79-4280-a83c-ff518a10f734",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 43,
"line_start": 19,
"message": "Configuring now",
"name": "hunt file",
"notes": "List all machines where the file hash has been seen.",
"number": 1,
"order": 2,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 240,
"y": 60
},
"previous_function": "",
"previous_name": "hunt_file_1",
"required_params": {
"hash": true
},
"reviewer": "",
"show_number": false,
"size": {
"height": 100,
"width": 180
},
"state": "app_action_assets",
"status": "",
"title": "Investigate",
"type": "coa.Action",
"warn": false,
"z": 333
},
{
"active": false,
"angle": 0,
"approver": "admin",
"approver_display": "admin",
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".number": {
"text": 1
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def crowdstrike_new_file_detection(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('crowdstrike_new_file_detection() called')\n \n # set user and message variables for phantom.prompt call\n user = \"admin\"\n message = \"\"\"{0}\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"format_prompt:formatted_data\",\n ]\n\n #responses:\n response_types = [\n {\n \"prompt\": \"Should Phantom create an Indicator in CrowdStrike to track this file hash from now on?\",\n \"options\": {\n \"type\": \"list\",\n \"choices\": [\n \"No, do not create an Indicator in CrowdStrike at this time.\",\n \"Yes, create a CrowdStrike Indicator to detect and block this file hash from now on. (True Positive)\",\n \"Yes, create a CrowdStrike Indicator to ignore this file hash from now on. (False Positive)\",\n ]\n },\n },\n {\n \"prompt\": \"Should Phantom quarantine the endpoint?\",\n \"options\": {\n \"type\": \"list\",\n \"choices\": [\n \"Yes\",\n \"No\",\n ]\n },\n },\n ]\n\n phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name=\"crowdstrike_new_file_detection\", parameters=parameters, response_types=response_types, callback=crowdstrike_new_file_detection_callback)\n\n return",
"callback_code": "def crowdstrike_new_file_detection_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('crowdstrike_new_file_detection_callback() called')\n \n indicator_decision(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n quarantine_decision_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n return",
"callback_start": 454,
"callsback": true,
"connected_to_start": true,
"connection_name": "get system info, get process details",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "crowdstrike new file detection",
"description": "Prompt the user to determine whether or not to create an Indicator for the file hash and whether or not to quarantine the endpoint.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "e6b6bdfa-6ec1-40a6-96fd-1f9b535b2087",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 462,
"line_start": 413,
"message": "{0}",
"name": "prompt",
"notes": "Prompt the user to determine whether or not to create an Indicator for the file hash and whether or not to quarantine the endpoint.",
"number": 1,
"order": 19,
"outPorts": [
"out"
],
"parameters": [
{
"position": 0,
"type": "",
"value": "format_prompt:formatted_data"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 980,
"y": 60
},
"previous_function": "",
"previous_name": "crowdstrike_new_file_detection",
"respond_in": "30",
"response_key": "Message",
"response_options": [],
"response_type": "list",
"responses": [
{
"response_key": "Custom List",
"response_options": [
"No, do not create an Indicator in CrowdStrike at this time.",
"Yes, create a CrowdStrike Indicator to detect and block this file hash from now on. (True Positive)",
"Yes, create a CrowdStrike Indicator to ignore this file hash from now on. (False Positive)"
],
"response_prompt": "Should Phantom create an Indicator in CrowdStrike to track this file hash from now on?",
"response_type": "list",
"responses_prompt": "Should Phantom create an Indicator in CrowdStrike to track this file hash from now on??"
},
{
"response_key": "Yes/No",
"response_options": [
"Yes",
"No"
],
"response_prompt": "Should Phantom quarantine the endpoint?",
"response_type": "list"
}
],
"show_number": true,
"size": {
"height": 80,
"width": 80
},
"state": "prompt",
"status": "",
"type": "coa.Prompt",
"warn": false,
"z": 334
},
{
"action": "get indicator",
"action_type": "investigate",
"active": false,
"active_keys": {},
"active_values": {
"indicator_type": "sha256",
"indicator_value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
},
"angle": 0,
"app": "CrowdStrike OAuth API",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"approver": "",
"assets": [
{
"action": "get indicator",
"actions": [
"update indicator",
"delete indicator",
"upload indicator",
"list processes",
"on poll",
"list put files",
"list custom indicators",
"get indicator",
"upload put file",
"hunt domain",
"hunt file",
"get process detail",
"get system info",
"set status",
"get session file",
"list incidents",
"list incident behaviors",
"get incident details",
"list crowdscores",
"get role",
"list roles",
"get user roles",
"list users",
"update incident",
"get incident behaviors",
"list session files",
"get command details",
"run admin command",
"run command",
"list sessions",
"delete session",
"create session",
"remove hosts",
"assign hosts",
"unquarantine device",
"quarantine device",
"list groups",
"query device",
"test connectivity"
],
"active": true,
"app_name": "CrowdStrike OAuth API",
"app_version": "2.0.5",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"asset_name": "crowdstrike_oauth",
"config_type": "asset",
"count": 0,
"fields": {
"indicator_type": "sha256",
"indicator_value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
},
"has_app": true,
"id": 19,
"loaded": false,
"missing": false,
"name": "crowdstrike_oauth",
"output": [
{
"data_path": "action_result.status",
"data_type": "string",
"example_values": [
"success",
"failed"
]
},
{
"data_path": "action_result.message",
"data_type": "string",
"example_values": [
"Indicator fetched successfully"
]
},
{
"data_path": "action_result.summary",
"data_type": "string"
},
{
"data_path": "action_result.parameter.indicator_type",
"data_type": "string",
"example_values": [
"domain"
]
},
{
"contains": [
"domain",
"md5",
"sha256",
"ip"
],
"data_path": "action_result.parameter.indicator_value",
"data_type": "string",
"example_values": [
"xyz"
]
},
{
"data_path": "action_result.data.*.resources.*.source",
"data_type": "string",
"example_values": [
"test source"
]
},
{
"data_path": "action_result.data.*.resources.*.description",
"data_type": "string",
"example_values": [
"test description"
]
},
{
"data_path": "action_result.data.*.meta.query_time",
"data_type": "numeric",
"example_values": [
0.002269266
]
},
{
"data_path": "action_result.data.*.meta.trace_id",
"data_type": "string",
"example_values": [
"6a4b970e-93a9-4151-bac4-e721ff3925a8"
]
},
{
"data_path": "action_result.data.*.resources.*.modified_timestamp",
"data_type": "string",
"example_values": [
"2018-08-17T15:19:31Z"
]
},
{
"data_path": "action_result.data.*.resources.*.modified_by",
"data_type": "string",
"example_values": [
"C16JJOUVVY125J3O50FF"
]
},
{
"data_path": "action_result.data.*.resources.*.share_level",
"data_type": "string",
"example_values": [
"red"
]
},
{
"data_path": "action_result.data.*.resources.*.created_by",
"data_type": "string",
"example_values": [
"C16JJOUVVY125J3O50FF"
]
},
{
"data_path": "action_result.data.*.resources.*.created_timestamp",
"data_type": "string",
"example_values": [
"2018-08-17T15:19:31Z"
]
},
{
"data_path": "action_result.data.*.resources.*.value",
"data_type": "string",
"example_values": [
"xyz"
]
},
{
"data_path": "action_result.data.*.resources.*.policy",
"data_type": "string",
"example_values": [
"none"
]
},
{
"data_path": "action_result.data.*.resources.*.type",
"data_type": "string",
"example_values": [
"domain"
]
},
{
"data_path": "action_result.data.*.resources.*.expiration_timestamp",
"data_type": "string",
"example_values": [
"2018-09-16T00:00:00Z"
]
},
{
"data_path": "summary.total_objects",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "summary.total_objects_successful",
"data_type": "numeric",
"example_values": [
1
]
}
],
"parameters": {
"indicator_type": {
"data_type": "string",
"default": null,
"description": "The type of the indicator",
"key": "indicator_type",
"order": 1,
"required": true,
"value_list": [
"sha256",
"md5",
"domain",
"ipv4",
"ipv6"
]
},
"indicator_value": {
"contains": [
"domain",
"md5",
"sha256",
"ip"
],
"data_type": "string",
"default": null,
"description": "String representation of the indicator",
"key": "indicator_value",
"order": 0,
"primary": true,
"required": true
}
},
"product_name": "CrowdStrike",
"product_vendor": "CrowdStrike",
"targets": "19",
"type": "endpoint"
}
],
"attrs": {
".action": {
"text": "get indicator"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "Investigate"
},
"g.approver image": {
"opacity": 1
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
},
"g.timer image": {
"opacity": 1
}
},
"block_code": "def get_indicator_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('get_indicator_2() called')\n\n # collect data for 'get_indicator_2' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'get_indicator_2' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'indicator_type': \"sha256\",\n 'indicator_value': filtered_artifacts_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"get indicator\", parameters=parameters, assets=['crowdstrike_oauth'], callback=if_indicator_exists, name=\"get_indicator_2\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": true,
"color": "",
"connected_to_start": true,
"connection_name": "",
"connection_type": "",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "",
"delay": 0,
"description": "Fetch the CrowdStrike indicator for the SHA256 file hash, if there is one. This action will fail if there is no matching indicator in CrowdStrike, but the playbook will check for the failure and continue.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "c5d59d69-49e7-4433-a650-d1b0b98e74be",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 101,
"line_start": 79,
"message": "Configuring now",
"name": "get indicator",
"notes": "Fetch the CrowdStrike indicator for the SHA256 file hash, if there is one. This action will fail if there is no matching indicator in CrowdStrike, but the playbook will check for the failure and continue.",
"number": 2,
"order": 5,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": -140,
"y": 60
},
"previous_function": "",
"previous_name": "get_indicator_2",
"required_params": {
"indicator_type": true,
"indicator_value": true
},
"reviewer": "",
"show_number": false,
"size": {
"height": 100,
"width": 180
},
"state": "app_action_assets",
"status": "",
"title": "Investigate",
"type": "coa.Action",
"warn": false,
"z": 335
},
{
"active": false,
"angle": 0,
"approver": "admin",
"approver_display": "admin",
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".number": {
"text": 2
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def crowdstrike_known_file_quarantine(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('crowdstrike_known_file_quarantine() called')\n \n # set user and message variables for phantom.prompt call\n user = \"admin\"\n message = \"\"\"{0}\n\n---\n\nShould Phantom quarantine the device?\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"format_repeat_note:formatted_data\",\n ]\n\n #responses:\n response_types = [\n {\n \"prompt\": \"\",\n \"options\": {\n \"type\": \"list\",\n \"choices\": [\n \"Yes\",\n \"No\",\n ]\n },\n },\n ]\n\n phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name=\"crowdstrike_known_file_quarantine\", parameters=parameters, response_types=response_types, callback=quarantine_decision_2)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": true,
"connected_to_start": true,
"connection_name": "get indicator",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "crowdstrike known file quarantine",
"description": "Ask the analyst if the endpoint should be quarantined.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "f41cc6f3-3db1-4909-b141-04c01050331f",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 719,
"line_start": 685,
"message": "{0}\n\n---\n\nShould Phantom quarantine the device?",
"name": "prompt",
"notes": "Ask the analyst if the endpoint should be quarantined.",
"number": 2,
"order": 29,
"outPorts": [
"out"
],
"parameters": [
{
"position": 0,
"type": "",
"value": "format_repeat_note:formatted_data"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 800,
"y": 620
},
"previous_function": "",
"previous_name": "crowdstrike_known_file_quarantine",
"respond_in": "30",
"response_key": "Message",
"response_options": [],
"response_type": "list",
"responses": [
{
"response_key": "Yes/No",
"response_options": [
"Yes",
"No"
],
"response_prompt": "",
"response_type": "list"
}
],
"show_number": true,
"size": {
"height": 80,
"width": 80
},
"state": "prompt",
"status": "",
"type": "coa.Prompt",
"warn": false,
"z": 336
},
{
"action": "list processes",
"action_type": "investigate",
"active": false,
"active_keys": {},
"active_values": {
"id": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId",
"ioc": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
},
"angle": 0,
"app": "CrowdStrike OAuth API",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"approver": "",
"assets": [
{
"action": "list processes",
"actions": [
"update indicator",
"delete indicator",
"upload indicator",
"list processes",
"on poll",
"list put files",
"list custom indicators",
"get indicator",
"upload put file",
"hunt domain",
"hunt file",
"get process detail",
"get system info",
"set status",
"get session file",
"list incidents",
"list incident behaviors",
"get incident details",
"list crowdscores",
"get role",
"list roles",
"get user roles",
"list users",
"update incident",
"get incident behaviors",
"list session files",
"get command details",
"run admin command",
"run command",
"list sessions",
"delete session",
"create session",
"remove hosts",
"assign hosts",
"unquarantine device",
"quarantine device",
"list groups",
"query device",
"test connectivity"
],
"active": true,
"app_name": "CrowdStrike OAuth API",
"app_version": "2.0.5",
"appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
"asset_name": "crowdstrike_oauth",
"config_type": "asset",
"count": 0,
"fields": {
"id": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId",
"ioc": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
},
"has_app": true,
"id": 19,
"loaded": false,
"missing": false,
"name": "crowdstrike_oauth",
"output": [
{
"column_name": "Status",
"column_order": 2,
"data_path": "action_result.status",
"data_type": "string",
"example_values": [
"success",
"failed"
]
},
{
"column_name": "Crowdstrike Device ID",
"column_order": 0,
"contains": [
"crowdstrike device id"
],
"data_path": "action_result.parameter.id",
"data_type": "string",
"example_values": [
"07c312fabcb8473454d0a16f118928ab"
]
},
{
"column_name": "IOC Queried",
"column_order": 1,
"contains": [
"hash",
"sha256",
"sha1",
"md5",
"domain"
],
"data_path": "action_result.parameter.ioc",
"data_type": "string",
"example_values": [
"eeb27d04c5fb25f7459407c0e5394621f12100e301b22d04a6b8f78e2adbf33d"
]
},
{
"column_name": "Falcon Process ID",
"column_order": 3,
"contains": [
"falcon process id"
],
"data_path": "action_result.data.*.falcon_process_id",
"data_type": "string",
"example_values": [
"pid:07c312fabcb8473454d0a16f118928fg:16716090292999"
]
},
{
"data_path": "action_result.message",
"data_type": "string",
"example_values": [
"Process count: 1"
]
},
{
"data_path": "summary.total_objects",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "summary.total_objects_successful",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.summary.process_count",
"data_type": "numeric",
"example_values": [
1
]
}
],
"parameters": {
"id": {
"contains": [
"crowdstrike device id"
],
"data_type": "string",
"default": null,
"description": "Crowdstrike Device ID to search on",
"key": "id",
"primary": true,
"required": true
},
"ioc": {
"contains": [
"hash",
"sha256",
"sha1",
"md5",
"domain"
],
"data_type": "string",
"default": null,
"description": "File Hash or Domain to use for searching",
"key": "ioc",
"primary": true,
"required": true
}
},
"product_name": "CrowdStrike",
"product_vendor": "CrowdStrike",
"targets": "19",
"type": "endpoint"
}
],
"attrs": {
".action": {
"text": "list processes with hash"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "Investigate"
},
"g.approver image": {
"opacity": 1
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
},
"g.timer image": {
"opacity": 1
}
},
"block_code": "def list_processes_with_hash(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('list_processes_with_hash() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'list_processes_with_hash' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId', 'filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'list_processes_with_hash' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0] and filtered_artifacts_item_1[1]:\n parameters.append({\n 'id': filtered_artifacts_item_1[0],\n 'ioc': filtered_artifacts_item_1[1],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[2]},\n })\n\n phantom.act(action=\"list processes\", parameters=parameters, assets=['crowdstrike_oauth'], callback=get_process_details, name=\"list_processes_with_hash\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": true,
"color": "",
"connected_to_start": true,
"connection_name": "get indicator",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "list processes with hash",
"delay": 0,
"description": "List all processes seen on this host associated with this file hash.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "2d0844c0-d8d8-4435-9b26-38ea0b6f2c3b",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 384,
"line_start": 360,
"message": "Configuring now",
"name": "list processes",
"notes": "List all processes seen on this host associated with this file hash.",
"number": 1,
"order": 17,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 240,
"y": -80
},
"previous_function": "",
"previous_name": "list_processes_with_hash",
"required_params": {
"id": true,
"ioc": true
},
"reviewer": "",
"show_number": false,
"size": {
"height": 100,
"width": 180
},
"state": "app_action_assets",
"status": "",
"title": "Investigate",
"type": "coa.Action",
"warn": false,
"z": 337
}
]
},
"notes": "This playbook uses the following Apps:\n - CrowdStrike OAuth (get indicator, hunt file, and more) [asset name = crowdstrike_oauth] - Investigate and respond on the endpoint with CrowdStrike Falcon\n\nDeployment Notes:\n - Change the target user of the prompt from admin to the appropriate user or role"
},
"python_version": "3",
"schema": 4,
"version": "4.10.0.40961"
},
"create_time": "2021-02-25T15:14:37.456337+00:00",
"draft_mode": false,
"labels": [
"crowdstrike"
],
"tags": []
}
Reference in New Issue View Git Blame Copy Permalink