GRR

Use GRR Rapid Response framework.

Endpoint · GRR

Details

ID	`GRR`
Provider	Open Source
Category	Endpoint
From Version	5.0.0
Supported Modules	Agentix XSIAM

README

Overview

Use the GRR integration to manage and communicate with the clients connected to your GRR server.

This integration was integrated and tested with GRR Rapid Response v3.2.3.2.

Configure GRR on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for GRR.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Server URL: e.g. https://192.168.0.1
- Port: e.g. 8000
- Username: The username of the GRR server.
- Trust any certificate (not secure)
- Use system proxy settings
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Start a flow on a client: grr-set-flows
Get a list of flows: grr-get-flows
Get a list of available hunts: grr-get-hunts
Get hunt summary: grr-get-hunt
Set a hunt: grr-set-hunts
Get a list of clients: grr-get-clients

1. Start a flow on a client

Starts a flow on a specified client according to optoinal parameters.

Base Command

grr-set-flows

Input

Argument Name	Description	Required
client_id	ID of the client	Required
flow	JSON string of the flow to set	Required
headers	The headers to display in output	Optional

Context Output

Path	Description
Flow	A GRR flow
Flow.ID	GRR flow ID
Flow.Args	GRR flow Args
Flow.Creator	GRR flow creator
Flow.LastActiveAt	When the flow was last active
Flow.NestedFlow	Nested GRR flows
Flow.StartedAt	When the flow was started
Flow.State	GRR flow state

Command Example

!grr-set-flows client_id="C.d824a5afc0ee6a46" flow="{\"name\":\"AnalyzeClientMemory\"}"

Context Example

"Flow": [
        {
            "Expires": null,
            "IsRobot": null,
            "Description": null,
            "Creator": "admin",
            "NestedFlow": null,
            "LastActiveAt": 1535900542748033,
            "Args": {
                "request": {}
            },
            "State": "RUNNING",
            "StartedAt": 1535900542745106,
            "ID": "F:B51D6EAB",
            "Created": null,
            "Name": "AnalyzeClientMemory"
        }
    ]
}

Human Readable Output

2. Get a list of flows

Lists flows launched on a specified client.

Base Command

grr-get-flows

Input

Argument Name	Description	Required
client_id	ID of the client	Required
offset	Starting offset	Optional
count	Maximum number of flows to fetch	Optional
headers	The headers to display in output	Optional

Context Output

Path	Description
Flow	A GRR flow
Flow.ID	GRR flow ID
Flow.Args	GRR flow Args
Flow.Creator	GRR flow creator
Flow.LastActiveAt	When the flow was last active
Flow.NestedFlow	Nested GRR flows
Flow.StartedAt	When the flow was started
Flow.State	GRR flow state

Command Example

!grr-get-flows client_id="C.d824a5afc0ee6a46" count="2"

Context Example

{
    "Flow": [
        {
            "Expires": null,
            "IsRobot": null,
            "Description": null,
            "Creator": "admin",
            "NestedFlow": [],
            "LastActiveAt": 1535900632278975,
            "Args": {
                "request": {}
            },
            "State": "TERMINATED",
            "StartedAt": 1535900542745106,
            "ID": "F:B51D6EAB",
            "Created": null,
            "Name": "AnalyzeClientMemory"
        },
        {
            "Expires": null,
            "IsRobot": null,
            "Description": null,
            "Creator": "admin",
            "NestedFlow": [],
            "LastActiveAt": 1535854160731193,
            "Args": {
                "request": {}
            },
            "State": "TERMINATED",
            "StartedAt": 1535853917723700,
            "ID": "F:88F4F65D",
            "Created": null,
            "Name": "AnalyzeClientMemory"
        }
    ]
}

Human Readable Output

3. Get a list of available hunts

Renders list of available hunts

Base Command

grr-get-hunts

Input

Argument Name	Description	Required
offset	Starting offset	Optional
count	Maximumn number of items to fetch	Optional
created_by	Only return hunts created by a specified user. If the approved_by and/or description_contains arguments are specified, then logical AND is applied to all criteria. This filter can only be used in conjunction with the active_within filter (to prevent queries of death).	Optional
description_contains	Only return hunts where the description contains given sub-string (matching is case-insensitive). If the created_by and/or approved_by arguments are specified, then logical AND is applied to all criteria. This filter can only be used in conjunction with the active_within filter (to prevent queries of death).	Optional
active_within	Only return hunts that were active within given time duration	Optional
headers	The headers to display in output	Optional

Context Output

Path	Description
Hunt	A GRR hunt
Hunt.ID	GRR hunt ID
Hunt.Creator	GRR hunt creator
Hunt.Description	GRR hunt description
Hunt.Created	Time the GRR hunt was created
Hunt.Expires	Time the GRR hunt expires
Hunt.IsRobot	Whether the hunt originated from a robot
Hunt.Name	GRR hunt name
Hunt.State	GRR hunt state

Command Example

!grr-get-hunts count=2

Context Example

{
    "Hunt": [
        {
            "Expires": 1537063517000000,
            "Description": "",
            "Creator": "admin",
            "IsRobot": false,
            "State": "PAUSED",
            "ID": "H:7B7F45F",
            "Created": 1535853917657925,
            "Name": "GenericHunt"
        },
        {
            "Expires": 1537059453000000,
            "Description": "",
            "Creator": "admin",
            "IsRobot": false,
            "State": "PAUSED",
            "ID": "H:AED24E68",
            "Created": 1535849853550599,
            "Name": "GenericHunt"
        }
    ]
}

Human Readable Output

4. Get hunt summary

Returns the summary of a specified hunt.

Base Command

grr-get-hunt

Input

Argument Name	Description	Required
hunt_id	GRR hunt id	Required
headers	The headers to display in output	Optional

Context Output

Path	Description
Hunt	A GRR hunt
Hunt.ID	GRR hunt ID
Hunt.Creator	GRR hunt creator
Hunt.Description	GRR hunt description
Hunt.Created	Time the GRR hunt was created
Hunt.Expires	Time the GRR hunt expires
Hunt.IsRobot	Whether the hunt originated from a robot
Hunt.Name	GRR hunt name
Hunt.State	GRR hunt state

Command Example

!grr-get-hunt hunt_id=H:7B7F45F

Context Example

{
    "Hunt": [
        {
            "Expires": 1537063517000000,
            "Description": "",
            "Creator": "admin",
            "IsRobot": false,
            "State": "PAUSED",
            "ID": "H:7B7F45F",
            "Created": 1535853917657925,
            "Name": "GenericHunt"
        }
    ]
}

Human Readable Output

5. Set a hunt

Handles hunt creation request.

Base Command

grr-set-hunts

Input

Argument Name	Description	Required
hunt_runner_args	Hunt runner arguments	Optional
hunt_args	Hunt arguments	Optional
headers	The headers to display	Optional

Context Output

There is no context output for this command.

Command Example

!grr-set-hunts

Context Example

{
    "Hunt": [
        {
            "Expires": 1537117003000000,
            "Description": "",
            "Creator": "admin",
            "IsRobot": false,
            "State": "PAUSED",
            "ID": "H:74EB48EE",
            "Created": 1535907403638694,
            "Name": "GenericHunt"
        }
    ]
}

Human Readable Output

6. Get a list of clients

Returns results of a client search.

Base Command

grr-get-clients

Input

Argument Name	Description	Required
query	Search query string. See the GRR documentation for more information.	Optional
offset	Found clients starting offset	Optional
count	Number of found clients to fetch	Optional
headers	The headers to display in output	Optional

Context Output

Path	Description
Client	GRR client
Client.ID	GRR client ID
Client.LastBootedAt	GRR client LastBootedAt time
Client.FirstSeenAt	GRR client FirstSeenAt time
Client.LatClock	GRR client LastClock
Client.LastCrashAt	GRR client LastCrashAt time
Client.AgentInfo	GRR client AgentInfo
Client.HardwareInfo	GRR client HardwareInfo
Client.Interfaces	GRR client interfaces
Client.Labels	GRR client labels
Client.OS	GRR client OS details
Client.User	GRR Client user
Client.Volumes	GRR client volumes

Command Example

!grr-get-clients

Context Example

{
    "Client": [
        {
            "HardwareInfo": {
                "system_product_name": "HVM domU",
                "bios_rom_size": "64 kB",
                "bios_vendor": "Xen",
                "system_sku_number": "Not Specified",
                "system_family": "Not Specified",
                "system_uuid": "EC2EDE26-BB13-B80C-1915-DC53118B923F",
                "system_manufacturer": "Xen",
                "bios_release_date": "08/24/2006",
                "bios_version": "4.2.amazon",
                "serial_number": "ec2ede26-bb13-b80c-1915-dc53118b923f",
                "bios_revision": "4.2"
            },
            "LastClock": 1535907460060247,
            "Interfaces": [
                {
                    "ifname": "lo",
                    "addresses": [
                        {
                            "packed_bytes": "fwAAAQ==",
                            "address_type": "INET"
                        },
                        {
                            "packed_bytes": "AAAAAAAAAAAAAAAAAAAAAQ==",
                            "address_type": "INET6"
                        }
                    ],
                    "mac_address": "AAAAAAAA"
                },
                {
                    "ifname": "eth0",
                    "addresses": [
                        {
                            "packed_bytes": "rB8sWw==",
                            "address_type": "INET"
                        },
                        {
                            "packed_bytes": "/oAAAAAAAAAE1kv//h5yfg==",
                            "address_type": "INET6"
                        }
                    ],
                    "mac_address": "BtZLHnJ+"
                }
            ],
            "OS": {
                "kernel": "4.4.0-1065-aws",
                "install_date": 1534280169000000,
                "system": "Linux",
                "fqdn": "ip-172-31-44-91.eu-central-1.compute.internal",
                "machine": "x86_64",
                "version": "16.4",
                "release": "Ubuntu"
            },
            "AgentInfo": {
                "client_name": "grr",
                "client_description": "grr linux amd64",
                "client_version": 3232,
                "build_time": "2018-06-28 09:37:57"
            },
            "Labels": [],
            "LastBootedAt": 1535292604000000,
            "FirstSeenAt": 1535293827970976,
            "User": [
                {
                    "username": "ubuntu",
                    "shell": "/bin/bash",
                    "homedir": "/home/ubuntu",
                    "last_logon": 1535356309000000,
                    "gid": 1000,
                    "full_name": "Ubuntu",
                    "uid": 1000
                }
            ],
            "Volumes": [
                {
                    "total_allocation_units": 50808745,
                    "bytes_per_sector": 4096,
                    "sectors_per_allocation_unit": 1,
                    "unixvolume": {
                        "mount_point": "/"
                    },
                    "actual_available_allocation_units": 50027766
                }
            ],
            "LastCrashAt": null,
            "LastSeenAt": 1535907460075229,
            "ID": "C.d824a5afc0ee6a46"
        }
    ]
}

Human Readable Output

Configuration parameters

server — Server URL (e.g. https://192.168.0.1) (required)
port — Port
credentials — Username (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (13)

grr-get-clients
Renders results of a client search.
grr-get-files Deprecated
Downloads files from specified machine without requiring approval
grr-get-flows
Lists flows launched on a given client
grr-get-hunt
Renders hunt's summary
grr-get-hunts
Renders list of available hunts
grr-set-flows
Starts a flow on a given client with given parameters
grr-set-hunts
Handles hunt creation request
grr_get_files
Downloads files from specified machine without requiring approval
grr_get_flows Deprecated
Lists flows launched on a given client
grr_get_hunt
Renders hunt's summary
grr_get_hunts
Renders list of available hunts
grr_set_flows Deprecated
Starts a flow on a given client with given parameters
grr_set_hunts
Handles hunt creation request

Source

GRR.js GRR.yml

Download History Raw

commonfields:
  id: GRR
  version: -1
name: GRR
display: GRR
category: Endpoint
provider: Open Source
description: Use GRR Rapid Response framework.
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: server
  defaultvalue: ""
  type: 0
  required: true
- display: Port
  name: port
  defaultvalue: "8000"
  type: 0
  required: false
- display: Username
  name: credentials
  defaultvalue: ""
  type: 9
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: grr-set-flows
    arguments:
    - name: client_id
      required: true
      default: true
      description: The ID of the client.
    - name: flow
      required: true
      description: JSON string of the flow to set.
    - name: headers
      description: The headers to show.
    description: Starts a flow on a given client with given parameters
    outputs:
    - contextPath: Flow
      description: A GRR Flow.
    - contextPath: Flow.ID
      description: The GRR Flow ID.
    - contextPath: Flow.Args
      description: The GRR Flow Args.
    - contextPath: Flow.Creator
      description: The GRR Flow Creator.
    - contextPath: Flow.LastActiveAt
      description: When Was the flow last active.
    - contextPath: Flow.NestedFlow
      description: The GRR Flow Nested Flows.
    - contextPath: Flow.StartedAt
      description: When was the flow started at.
    - contextPath: Flow.State
      description: The GRR Flow State.
    important:
    - contextPath: Flow.ID
      description: The Flow ID
  - name: grr-get-flows
    arguments:
    - name: client_id
      required: true
      default: true
      description: The ID of the client.
    - name: offset
      description: Starting offset.
    - name: count
      description: Max number of flows to fetch.
    - name: headers
      description: headers to show in output.
    description: Lists flows launched on a given client
    outputs:
    - contextPath: Flow
      description: A GRR Flow.
    - contextPath: Flow.ID
      description: The GRR Flow ID.
    - contextPath: Flow.Args
      description: The GRR Flow Args.
    - contextPath: Flow.Creator
      description: The GRR Flow Creator.
    - contextPath: Flow.LastActiveAt
      description: When Was the flow last active.
    - contextPath: Flow.NestedFlow
      description: The GRR Flow Nested Flows.
    - contextPath: Flow.StartedAt
      description: When was the flow started at.
    - contextPath: Flow.State
      description: The GRR Flow State.
    important:
    - contextPath: Flow.ID
      description: The Flow ID
  - name: grr-get-files
    deprecated: true
    arguments:
    - name: hostname
      description: Target host, Can be FQDN or client ID.
    - name: paths
      description: Fetch this number of elements, an array of path strings.
    - name: max_file_size
      description: Maximum size of file we will download.
    - name: action
      description: Action to apply to found files - STAT, HASH or DOWNLOAD.
    - name: pathtype
      description: Path type to glob in - UNSET, OS, TSK, REGISTRY, MEMORY, TMPFILE.
    description: Downloads files from specified machine without requiring approval
  - name: grr-get-hunts
    arguments:
    - name: offset
      description: Starting offset.
    - name: count
      description: Max number of items to fetch.
    - name: created_by
      description: 'Only return hunts created by a given user. If approved_by or/and description_contains are also supplied, then logical AND is applied to all the criterias. NOTE: this filter can only be used in conjunction with ''active_within'' filter (to prevent queries of death).'
    - name: description_contains
      description: 'Only return hunts where description contains given substring (matching is case-insensitive).If created_by or/and approved_by are also supplied, then logical AND is applied to all the criterias. NOTE: this filter can only be used in conjunction with ''active_within'' filter (to prevent queries of death).'
    - name: active_within
      description: Only return hunts that were active within given time duration.
    - name: headers
      description: headers to show in output.
    description: Renders list of available hunts
    outputs:
    - contextPath: Hunt
      description: A GRR Hunt.
    - contextPath: Hunt.ID
      description: The GRR Hunt ID.
    - contextPath: Hunt.Creator
      description: The GRR Hunt Creator.
    - contextPath: Hunt.Description
      description: The GRR Hunt Description.
    - contextPath: Hunt.Created
      description: The time the GRR Hunt was created.
    - contextPath: Hunt.Expires
      description: The time the GRR Hunt expires.
    - contextPath: Hunt.IsRobot
      description: Is the Hunt originated from a robot.
    - contextPath: Hunt.Name
      description: The GRR Hunt Name.
    - contextPath: Hunt.State
      description: The GRR Hunt State.
    important:
    - contextPath: Hunt.ID
      description: The Hunt ID
  - name: grr-get-hunt
    arguments:
    - name: hunt_id
      required: true
      default: true
      description: Hunt id.
    - name: headers
      description: headers to show in output.
    description: Renders hunt's summary
    outputs:
    - contextPath: Hunt
      description: A GRR Hunt.
    - contextPath: Hunt.ID
      description: The GRR Hunt ID.
    - contextPath: Hunt.Creator
      description: The GRR Hunt Creator.
    - contextPath: Hunt.Description
      description: The GRR Hunt Description.
    - contextPath: Hunt.Created
      description: The time the GRR Hunt was created.
    - contextPath: Hunt.Expires
      description: The time the GRR Hunt expires.
    - contextPath: Hunt.IsRobot
      description: Is the Hunt originated from a robot.
    - contextPath: Hunt.Name
      description: The GRR Hunt Name.
    - contextPath: Hunt.State
      description: The GRR Hunt State.
    important:
    - contextPath: Hunt.ID
      description: The Hunt ID
  - name: grr-set-hunts
    arguments:
    - name: hunt_runner_args
      description: Hunt runner arguments.
    - name: hunt_args
      description: Hunt arguments.
    - name: headers
      description: The headers to show.
    description: Handles hunt creation request
  - name: grr-get-clients
    arguments:
    - name: query
      description: 'Search query string. See here for syntax: https://github.com/google/grr-doc/blob/master/user_manual.adoc#searching-for-a-client '
    - name: offset
      description: 'Found clients starting offset. '
    - name: count
      description: 'Number of found client to fetch. '
    - name: headers
      description: headers to show in output.
    description: 'Renders results of a client search. '
    outputs:
    - contextPath: Client
      description: A GRR Client.
    - contextPath: Client.ID
      description: The GRR Client ID.
    - contextPath: Client.LastBootedAt
      description: The GRR Client LastBootedAt time.
    - contextPath: Client.FirstSeenAt
      description: The GRR Client FirstSeenAt time.
    - contextPath: Client.LatClock
      description: The GRR Client LastClock.
    - contextPath: Client.LastCrashAt
      description: The GRR Client LastCrashAt time.
    - contextPath: Client.AgentInfo
      description: The GRR Client AgentInfo.
    - contextPath: Client.HardwareInfo
      description: The GRR Client HardwareInfo.
    - contextPath: Client.Interfaces
      description: The GRR Client Interfaces.
    - contextPath: Client.Labels
      description: The GRR Client Labels.
    - contextPath: Client.OS
      description: The GRR Client OS details.
    - contextPath: Client.User
      description: The GRR Client User.
    - contextPath: Client.Volumes
      description: The GRR Client Volumes.
    important:
    - contextPath: Client.ID
      description: The Client ID
  - name: grr_set_flows
    deprecated: true
    arguments:
    - name: client_id
      required: true
      default: true
      description: The ID of the client.
    - name: flow
      required: true
      description: JSON string of the flow to set.
    description: Starts a flow on a given client with given parameters
  - name: grr_get_flows
    deprecated: true
    arguments:
    - name: client_id
      required: true
      default: true
      description: The ID of the client.
    - name: offset
      description: Starting offset.
    - name: count
      description: Max number of flows to fetch.
    description: Lists flows launched on a given client
  - name: grr_get_files
    arguments:
    - name: hostname
      description: Target host, Can be FQDN or client ID.
    - name: paths
      description: Fetch this number of elements, an array of path strings.
    - name: max_file_size
      description: Maximum size of file we will download.
    - name: action
      description: Action to apply to found files - STAT, HASH or DOWNLOAD.
    - name: pathtype
      description: Path type to glob in - UNSET, OS, TSK, REGISTRY, MEMORY, TMPFILE.
    description: Downloads files from specified machine without requiring approval
  - name: grr_get_hunts
    arguments:
    - name: offset
      description: Starting offset.
    - name: count
      description: Max number of items to fetch.
    - name: created_by
      description: 'Only return hunts created by a given user. If approved_by or/and description_contains are also supplied, then logical AND is applied to all the criterias. NOTE: this filter can only be used in conjunction with ''active_within'' filter (to prevent queries of death).'
    - name: description_contains
      description: 'Only return hunts where description contains given substring (matching is case-insensitive).If created_by or/and approved_by are also supplied, then logical AND is applied to all the criterias. NOTE: this filter can only be used in conjunction with ''active_within'' filter (to prevent queries of death).'
    - name: active_within
      description: Only return hunts that were active within given time duration.
    description: Renders list of available hunts
  - name: grr_get_hunt
    arguments:
    - name: hunt_id
      required: true
      default: true
      description: Hunt id.
    description: Renders hunt's summary
  - name: grr_set_hunts
    arguments:
    - name: hunt_runner_args
      description: Hunt runner arguments.
    - name: hunt_args
      description: Hunt arguments.
    description: Handles hunt creation request
tests:
- No tests
system: true
fromversion: 5.0.0