Proactive Threat Hunting
Proactive Threat Hunting Incident
Details
| ID | Proactive Threat Hunting |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.9.0 |
Layout Structure
Legacy Summary 0 sections
No sections defined.
Evidence 4 sections
Updates For The Hunter
Evidence Results
Instructions
Close Investigation Notes
| Field ID | Position |
|---|---|
| closenotes | Col 0-2, Height: 22 |
Hunt Results 7 sections
Hunting Hypothesis - SDO Details
The hunted SDO details. These details include the SDO's name, source feed, as well as any associated attack patterns and related tools. It's important to note that the hunt will only cover attack patterns and techniques that have relevant tool data from the existing Threat Intelligence Management (TIM) feeds
| Field ID | Position |
|---|---|
| sdoname | Col 0-1, Height: 106 |
| sdofeed | Col 0-1, Height: 106 |
| tools | Col 1-4, Height: 53 |
| attackpatterns | Col 1-4, Height: 53 |
SDO Hunt Results - Summary
A summary of the hunt results including tool usage found, affected hosts and affected users
| Field ID | Position |
|---|---|
| toolusagefound | Col 0-1, Height: 53 |
| affectedhosts | Col 1-2, Height: 53 |
| affectedusers | Col 2-4, Height: 53 |
Hunting Hypothesis - SDO Related IOCs
IOCs to search in the hunt
Detected IOCs
IOCs found during the hunt
Suspicious
| Field ID | Position |
|---|---|
| suspiciousexecutionsfound | Col 0-4, Height: 106 |
SDO Hunt Results
This section displays the comparison results between malicious tool patterns and command-line arguments found within the environment.
| Field ID | Position |
|---|---|
| stringsimilarityresults | Col 0-4, Height: 106 |
Updates For The Hunter
Investigation & Response 5 sections
Entity Enrichment
Upon executing a entity enrichment, the results will be promptly displayed in this section.
| Field ID | Position |
|---|---|
| endpointsdetails | Col 0-6, Height: 44 |
| usersdetails | Col 0-6, Height: 44 |
| relatedalerts | Col 0-6, Height: 44 |
Actions
Set of post-hunting actions. There is a manual Collection task before the actual remediation. Executing a new action will abort the previous one, if hasn't done yet.
| Field ID | Position |
|---|---|
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| endpointisolationstatus | Col 0-1, Height: 53 |
| userblockstatus | Col 0-2, Height: 53 |
| blockindicatorsstatus | Col 0-2, Height: 53 |
Updates For The Hunter
Instructions
Follow the instruction to build and execute your hunting query.
Custom Query Results
Upon executing a custom query, the results will be promptly displayed in this section.
| Field ID | Position |
|---|---|
| customqueryresults | Col 0-2, Height: 106 |
Freestyle Hunting 5 sections
Entity Enrichment
Upon executing a entity enrichment, the results will be promptly displayed in this section.
| Field ID | Position |
|---|---|
| endpointsdetails | Col 0-6, Height: 44 |
| usersdetails | Col 0-6, Height: 44 |
| relatedalerts | Col 0-6, Height: 44 |
Actions
Set of post-hunting actions. There is a manual Collection task before the actual remediation. Executing a new action will abort the previous one, if hasn't done yet.
| Field ID | Position |
|---|---|
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| endpointisolationstatus | Col 0-1, Height: 53 |
| userblockstatus | Col 0-2, Height: 53 |
| blockindicatorsstatus | Col 0-2, Height: 53 |
Updates For The Hunter
Query Instructions
Follow the instruction to build and execute your hunting query.
Custom Query Results
Upon executing a custom query, the results will be promptly displayed in this section.
| Field ID | Position |
|---|---|
| customqueryresults | Col 0-2, Height: 106 |
Investigation & Response copy 5 sections
Entity Enrichment
To get entities details, click "Entity Enrichment" in the actions section.
| Field ID | Position |
|---|---|
| endpointsdetails | Col 0-6, Height: 44 |
| usersdetails | Col 0-6, Height: 44 |
| relatedalerts | Col 0-6, Height: 44 |
Actions
Set of post-hunting actions. There is a manual Collection task before the actual remediation. Executing a new action will abort the previous one, if hasn't done yet.
| Field ID | Position |
|---|---|
| — | Col 0-4, Height: 53 |
| — | Col 0-4, Height: 53 |
| — | Col 0-4, Height: 53 |
| — | Col 0-4, Height: 53 |
| — | Col 0-4, Height: 53 |
| — | Col 0-4, Height: 53 |
| endpointisolationstatus | Col 0-1, Height: 53 |
| userblockstatus | Col 0-2, Height: 53 |
| blockindicatorsstatus | Col 0-2, Height: 53 |
Custom Query Results
| Field ID | Position |
|---|---|
| customqueryresults | Col 0-4, Height: 106 |
Query Status
Query Instructions
Follow the instruction to build and execute your hunting query.
Control Panel copy 3 sections
Query Status
Query Instructions
Follow the instruction to build and execute your hunting query.
Evidence Results
War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Evidence Board 0 sections
No sections defined.
Related Incidents 0 sections
No sections defined.
Canvas 0 sections
No sections defined.
Cheat Sheet 1 section
Cheat Sheet
| Field ID | Position |
|---|---|
| cheatsheet | Col 0-6, Height: 44 |
{ "detailsV2": { "tabs": [ { "id": "summary", "name": "Legacy Summary", "type": "summary" }, { "id": "caseinfoid", "name": "Evidence", "sections": [ { "h": 2, "i": "caseinfoid-field-changed-caseinfoid-lsqweemtuk-caseinfoid-field-changed-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-caseinfoid-field-changed-caseinfoid-61263cc0-98b1-11e9-97d7-ed26ef9e46c8", "maxW": 3, "minH": 1, "moved": false, "name": "Updates For The Hunter", "static": false, "type": "notes", "w": 3, "x": 0, "y": 0 }, { "h": 4, "i": "caseinfoid-field-changed-caseinfoid-lsqweemtuk-caseinfoid-field-changed-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-33264160-09c0-11ee-8f72-f32dc12d5a8f", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Evidence Results", "sort": { "asc": false, "field": "description" }, "static": false, "type": "evidence", "w": 2, "x": 0, "y": 2 }, { "h": 4, "i": "caseinfoid-b0fe00d0-2fb0-11ee-a284-cde109092515", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Instructions", "static": false, "type": "workplan", "w": 1, "x": 2, "y": 2 }, { "displayType": "CARD", "h": 2, "hideName": false, "i": "caseinfoid-325fd1a0-724e-11ee-b9de-abf403278027", "items": [ { "endCol": 2, "fieldId": "closenotes", "height": 22, "id": "4b32a590-724e-11ee-b9de-abf403278027", "index": 0, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Close Investigation Notes", "static": false, "w": 3, "x": 0, "y": 6 } ], "type": "custom" }, { "filters": [ [ { "ignoreCase": false, "left": { "isContext": true, "value": { "simple": "sdoname" } }, "operator": "isNotEmpty", "right": null, "type": "markdown" } ] ], "hidden": false, "id": "lsqweemtuk", "name": "Hunt Results", "sections": [ { "description": "The hunted SDO details. These details include the SDO's name, source feed, as well as any associated attack patterns and related tools. It's important to note that the hunt will only cover attack patterns and techniques that have relevant tool data from the existing Threat Intelligence Management (TIM) feeds", "displayType": "CARD", "h": 3, "hideName": false, "i": "caseinfoid-field-changed-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-d2cabf40-bcf7-11ed-b6eb-39368307a439", "items": [ { "dropEffect": "move", "endCol": 1, "fieldId": "sdoname", "height": 106, "id": "0aa3c270-09bc-11ee-9e2b-251d921ea3e1", "index": 0, "listId": "caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-d2cabf40-bcf7-11ed-b6eb-39368307a439", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 1, "fieldId": "sdofeed", "height": 106, "id": "950b2600-14c6-11ee-b61f-5f6ef40adff4", "index": 1, "listId": "caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-d2cabf40-bcf7-11ed-b6eb-39368307a439", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 4, "fieldId": "tools", "height": 53, "id": "29fbafb0-d1f0-11ed-acc6-b384b0c94da3", "index": 0, "listId": "caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-d2cabf40-bcf7-11ed-b6eb-39368307a439", "sectionItemType": "field", "startCol": 1 }, { "dropEffect": "move", "endCol": 4, "fieldId": "attackpatterns", "height": 53, "id": "26f94520-d1f0-11ed-acc6-b384b0c94da3", "index": 2, "listId": "caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-d2cabf40-bcf7-11ed-b6eb-39368307a439", "sectionItemType": "field", "startCol": 1 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Hunting Hypothesis - SDO Details", "static": false, "w": 2, "x": 0, "y": 2 }, { "description": "A summary of the hunt results including tool usage found, affected hosts and affected users", "displayType": "CARD", "h": 2, "hideName": false, "i": "caseinfoid-field-changed-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-7d826ee0-d1d6-11ed-b353-b1e63aacf41c", "items": [ { "dropEffect": "move", "endCol": 1, "fieldId": "toolusagefound", "height": 53, "id": "d36d36c0-04f6-11ee-b4d9-19f1ef96b1ee", "index": 0, "listId": "caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-7d826ee0-d1d6-11ed-b353-b1e63aacf41c", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "affectedhosts", "height": 53, "id": "50637f10-09e6-11ee-abc4-2b5a1ddfcac7", "index": 0, "listId": "caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-7d826ee0-d1d6-11ed-b353-b1e63aacf41c", "sectionItemType": "field", "startCol": 1 }, { "dropEffect": "move", "endCol": 4, "fieldId": "affectedusers", "height": 53, "id": "2804c340-0a7b-11ee-83e6-29d08fecc6d3", "index": 0, "listId": "caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-7d826ee0-d1d6-11ed-b353-b1e63aacf41c", "sectionItemType": "field", "startCol": 2 } ], "maxW": 3, "minH": 1, "moved": false, "name": "SDO Hunt Results - Summary", "static": false, "w": 2, "wrapLabels": false, "x": 0, "y": 5 }, { "description": "IOCs to search in the hunt", "h": 3, "i": "caseinfoid-field-changed-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-c990b6e0-0460-11ee-8ee6-8b736c56904f", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Hunting Hypothesis - SDO Related IOCs", "query": "tags:\"Hunting Session\"", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 2, "y": 2 }, { "description": "IOCs found during the hunt", "h": 8, "i": "caseinfoid-field-changed-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fd726570-09d9-11ee-816a-29823d8f2014", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Detected IOCs", "query": "tags:\"Hunting Session - Exist In Environment\"", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 2, "y": 5 }, { "description": "", "displayType": "CARD", "h": 3, "hideItemTitleOnlyOne": false, "hideName": true, "i": "caseinfoid-field-changed-caseinfoid-1e1fa8e5-2083-11ee-8b39-a7ebb8a31864", "items": [ { "endCol": 4, "fieldId": "suspiciousexecutionsfound", "height": 106, "id": "714751f0-2086-11ee-8b39-a7ebb8a31864", "index": 0, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Suspicious", "static": false, "w": 2, "wrapLabels": false, "x": 0, "y": 7 }, { "description": "This section displays the comparison results between malicious tool patterns and command-line arguments found within the environment.", "displayType": "CARD", "h": 3, "hideName": true, "i": "caseinfoid-field-changed-caseinfoid-25d429d5-2083-11ee-8b39-a7ebb8a31864", "items": [ { "dropEffect": "move", "endCol": 4, "fieldId": "stringsimilarityresults", "height": 106, "id": "25d429d2-2083-11ee-8b39-a7ebb8a31864", "index": 0, "listId": "caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-7d826ee0-d1d6-11ed-b353-b1e63aacf41c", "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "SDO Hunt Results", "static": false, "w": 2, "wrapLabels": false, "x": 0, "y": 10 }, { "h": 2, "i": "caseinfoid-field-changed-caseinfoid-04121060-2096-11ee-8b39-a7ebb8a31864", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Updates For The Hunter", "static": false, "type": "notes", "w": 3, "x": 0, "y": 0 } ], "type": "custom" }, { "filters": [ [ { "ignoreCase": false, "left": { "isContext": true, "value": { "simple": "huntingsessionstatus" } }, "operator": "isNotEmpty", "right": null, "type": "shortText" } ] ], "hidden": false, "id": "fvtmv2oyuw", "name": "Investigation \u0026 Response", "sections": [ { "description": "Upon executing a entity enrichment, the results will be promptly displayed in this section.", "displayType": "CARD", "h": 4, "hideName": false, "i": "caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-51034f40-09eb-11ee-abc4-2b5a1ddfcac7", "items": [ { "dropEffect": "move", "endCol": 6, "fieldId": "endpointsdetails", "height": 44, "id": "1f477c20-1403-11ee-85c9-5b605042f1e1", "index": 0, "listId": "caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-51034f40-09eb-11ee-abc4-2b5a1ddfcac7", "sectionItemType": "field", "startCol": 0 }, { "endCol": 6, "fieldId": "usersdetails", "height": 44, "id": "1d661c80-1404-11ee-a9af-a9d9f3be4779", "index": 1, "sectionItemType": "field", "startCol": 0 }, { "endCol": 6, "fieldId": "relatedalerts", "height": 44, "id": "e5f60f70-140e-11ee-a9af-a9d9f3be4779", "index": 2, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Entity Enrichment", "static": false, "w": 3, "x": 0, "y": 6 }, { "description": "Set of post-hunting actions. There is a manual Collection task before the actual remediation. Executing a new action will abort the previous one, if hasn't done yet.", "displayType": "CARD", "h": 4, "hideName": false, "i": "caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-74d80420-0a1c-11ee-94e8-b97b8109133e", "items": [ { "args": { "name": { "simple": "Proactive Threat Hunting - Entity Enrichment" } }, "buttonClass": "primary", "endCol": 2, "fieldId": "", "height": 53, "id": "91a70bf0-0a1c-11ee-94e8-b97b8109133e", "index": 0, "name": "Entity Enrichment", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Proactive Threat Hunting - Execute Query" } }, "buttonClass": "primary", "endCol": 2, "fieldId": "", "height": 53, "id": "74341230-14c0-11ee-985b-5d9798906d26", "index": 1, "name": "Execute Custom Query", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Proactive Threat Hunting - Endpoint Isolation" } }, "buttonClass": "error", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 53, "id": "a60e1cb0-2096-11ee-8b39-a7ebb8a31864", "index": 2, "listId": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-74d80420-0a1c-11ee-94e8-b97b8109133e", "name": "Isolate Endpoint", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Proactive Threat Hunting - Block Indicators" } }, "buttonClass": "error", "endCol": 2, "fieldId": "", "height": 53, "id": "92b065a0-0a1c-11ee-94e8-b97b8109133e", "index": 4, "name": "Block IOCs", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Proactive Threat Hunting - Block Account" } }, "buttonClass": "error", "endCol": 2, "fieldId": "", "height": 53, "id": "23f8b020-0ec9-11ee-a51d-a990e3e96055", "index": 4, "name": "Block Account", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Proactive Threat Hunting - Quarantine File" } }, "buttonClass": "error", "endCol": 2, "fieldId": "", "height": 53, "id": "5b971bd0-2499-11ee-8af3-f160d3812173", "index": 5, "name": "Quarantine File", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "closeNotes": { "simple": "", "userMarkedRequired": true }, "closeReason": { "simple": "", "userMarkedRequired": true } }, "buttonClass": "success", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 53, "id": "907087c0-0a1c-11ee-94e8-b97b8109133e", "index": 6, "listId": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-74d80420-0a1c-11ee-94e8-b97b8109133e", "name": "Close Hunting Session", "scriptId": "Builtin|||closeInvestigation", "sectionItemType": "button", "startCol": 0 }, { "dropEffect": "move", "endCol": 1, "fieldId": "endpointisolationstatus", "height": 53, "id": "b785d850-0ab3-11ee-b966-55e2f7a73dc9", "index": 7, "listId": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-74d80420-0a1c-11ee-94e8-b97b8109133e", "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "userblockstatus", "height": 53, "id": "51929c50-0ee0-11ee-9be8-03c60dac9e17", "index": 8, "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "blockindicatorsstatus", "height": 53, "id": "f057cf80-0a1d-11ee-94e8-b97b8109133e", "index": 9, "listId": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-74d80420-0a1c-11ee-94e8-b97b8109133e", "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Actions", "static": false, "w": 1, "x": 1, "y": 2 }, { "h": 2, "i": "caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-field-changed-caseinfoid-4fcf36a0-2095-11ee-8b39-a7ebb8a31864", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Updates For The Hunter", "static": false, "type": "notes", "w": 3, "x": 0, "y": 0 }, { "description": "Follow the instruction to build and execute your hunting query.", "h": 4, "i": "caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-field-changed-caseinfoid-5bbc3120-2095-11ee-8b39-a7ebb8a31864", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Instructions", "static": false, "type": "workplan", "w": 1, "x": 2, "y": 2 }, { "description": "Upon executing a custom query, the results will be promptly displayed in this section.", "displayType": "CARD", "h": 4, "hideItemTitleOnlyOne": true, "hideName": false, "i": "caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-field-changed-caseinfoid-333e7890-2480-11ee-a551-4de127fb8d67", "items": [ { "endCol": 2, "fieldId": "customqueryresults", "height": 106, "id": "68e0f1c0-249a-11ee-b86a-459fde83cad3", "index": 0, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Custom Query Results", "static": false, "w": 1, "x": 0, "y": 2 } ], "type": "custom" }, { "filters": [ [ { "ignoreCase": false, "left": { "isContext": true, "value": { "simple": "freestylehunt" } }, "operator": "isEqualString", "right": { "isContext": false, "value": { "simple": "True" } }, "type": "shortText" } ] ], "hidden": false, "id": "loos7lrdto", "name": "Freestyle Hunting", "sections": [ { "description": "Upon executing a entity enrichment, the results will be promptly displayed in this section.", "displayType": "CARD", "h": 4, "hideName": false, "i": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-51034f40-09eb-11ee-abc4-2b5a1ddfcac7", "items": [ { "dropEffect": "move", "endCol": 6, "fieldId": "endpointsdetails", "height": 44, "id": "1f477c20-1403-11ee-85c9-5b605042f1e1", "index": 0, "listId": "caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-51034f40-09eb-11ee-abc4-2b5a1ddfcac7", "sectionItemType": "field", "startCol": 0 }, { "endCol": 6, "fieldId": "usersdetails", "height": 44, "id": "1d661c80-1404-11ee-a9af-a9d9f3be4779", "index": 1, "sectionItemType": "field", "startCol": 0 }, { "endCol": 6, "fieldId": "relatedalerts", "height": 44, "id": "e5f60f70-140e-11ee-a9af-a9d9f3be4779", "index": 2, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Entity Enrichment", "static": false, "w": 3, "x": 0, "y": 6 }, { "description": "Set of post-hunting actions. There is a manual Collection task before the actual remediation. Executing a new action will abort the previous one, if hasn't done yet.", "displayType": "CARD", "h": 4, "hideName": false, "i": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-74d80420-0a1c-11ee-94e8-b97b8109133e", "items": [ { "args": { "name": { "simple": "Proactive Threat Hunting - Entity Enrichment" } }, "buttonClass": "primary", "endCol": 2, "fieldId": "", "height": 53, "id": "91a70bf0-0a1c-11ee-94e8-b97b8109133e", "index": 0, "name": "Entity Enrichment", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Search And Block Software - Generic" } }, "buttonClass": "primary", "endCol": 2, "fieldId": "", "height": 53, "id": "09b7c210-314b-11ee-9036-1938f862dddc", "index": 1, "name": "Search And Block Software", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Proactive Threat Hunting - Execute Query" } }, "buttonClass": "primary", "endCol": 2, "fieldId": "", "height": 53, "id": "74341230-14c0-11ee-985b-5d9798906d26", "index": 2, "name": "Execute Custom Query", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Proactive Threat Hunting - Endpoint Isolation" } }, "buttonClass": "error", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 53, "id": "a60e1cb0-2096-11ee-8b39-a7ebb8a31864", "index": 2, "listId": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-74d80420-0a1c-11ee-94e8-b97b8109133e", "name": "Isolate Endpoint", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Proactive Threat Hunting - Block Indicators" } }, "buttonClass": "error", "endCol": 2, "fieldId": "", "height": 53, "id": "92b065a0-0a1c-11ee-94e8-b97b8109133e", "index": 3, "name": "Upload \u0026 Block IOCs", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Proactive Threat Hunting - Block Account" } }, "buttonClass": "error", "endCol": 2, "fieldId": "", "height": 53, "id": "23f8b020-0ec9-11ee-a51d-a990e3e96055", "index": 4, "name": "Block Account", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Proactive Threat Hunting - Quarantine File" } }, "buttonClass": "error", "endCol": 2, "fieldId": "", "height": 53, "id": "5b971bd0-2499-11ee-8af3-f160d3812173", "index": 5, "name": "Quarantine File", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "closeNotes": { "simple": "", "userMarkedRequired": true }, "closeReason": { "simple": "", "userMarkedRequired": true } }, "buttonClass": "success", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 53, "id": "907087c0-0a1c-11ee-94e8-b97b8109133e", "index": 6, "listId": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-74d80420-0a1c-11ee-94e8-b97b8109133e", "name": "Close Hunting Session", "scriptId": "Builtin|||closeInvestigation", "sectionItemType": "button", "startCol": 0 }, { "dropEffect": "move", "endCol": 1, "fieldId": "endpointisolationstatus", "height": 53, "id": "b785d850-0ab3-11ee-b966-55e2f7a73dc9", "index": 7, "listId": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-74d80420-0a1c-11ee-94e8-b97b8109133e", "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "userblockstatus", "height": 53, "id": "51929c50-0ee0-11ee-9be8-03c60dac9e17", "index": 8, "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "blockindicatorsstatus", "height": 53, "id": "f057cf80-0a1d-11ee-94e8-b97b8109133e", "index": 9, "listId": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-74d80420-0a1c-11ee-94e8-b97b8109133e", "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Actions", "static": false, "w": 1, "x": 1, "y": 2 }, { "h": 2, "i": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-field-changed-caseinfoid-4fcf36a0-2095-11ee-8b39-a7ebb8a31864", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Updates For The Hunter", "static": false, "type": "notes", "w": 3, "x": 0, "y": 0 }, { "description": "Follow the instruction to build and execute your hunting query.", "h": 4, "i": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-field-changed-caseinfoid-5bbc3120-2095-11ee-8b39-a7ebb8a31864", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Query Instructions", "static": false, "type": "workplan", "w": 1, "x": 2, "y": 2 }, { "description": "Upon executing a custom query, the results will be promptly displayed in this section.", "displayType": "CARD", "h": 4, "hideItemTitleOnlyOne": true, "hideName": false, "i": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-field-changed-caseinfoid-333e7890-2480-11ee-a551-4de127fb8d67", "items": [ { "endCol": 2, "fieldId": "customqueryresults", "height": 106, "id": "68e0f1c0-249a-11ee-b86a-459fde83cad3", "index": 0, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Custom Query Results", "static": false, "w": 1, "x": 0, "y": 2 } ], "type": "custom" }, { "filters": [ [ { "ignoreCase": false, "left": { "isContext": true, "value": { "simple": "huntingsessionstatus" } }, "operator": "isNotEmpty", "right": null, "type": "shortText" } ] ], "hidden": true, "id": "upjje5nuji", "name": "Investigation \u0026 Response copy", "sections": [ { "description": "To get entities details, click \"Entity Enrichment\" in the actions section.", "displayType": "CARD", "h": 4, "hideName": false, "i": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-51034f40-09eb-11ee-abc4-2b5a1ddfcac7", "items": [ { "dropEffect": "move", "endCol": 6, "fieldId": "endpointsdetails", "height": 44, "id": "1f477c20-1403-11ee-85c9-5b605042f1e1", "index": 0, "listId": "caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-51034f40-09eb-11ee-abc4-2b5a1ddfcac7", "sectionItemType": "field", "startCol": 0 }, { "endCol": 6, "fieldId": "usersdetails", "height": 44, "id": "1d661c80-1404-11ee-a9af-a9d9f3be4779", "index": 1, "sectionItemType": "field", "startCol": 0 }, { "endCol": 6, "fieldId": "relatedalerts", "height": 44, "id": "e5f60f70-140e-11ee-a9af-a9d9f3be4779", "index": 2, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Entity Enrichment", "static": false, "w": 3, "x": 0, "y": 9 }, { "description": "Set of post-hunting actions. There is a manual Collection task before the actual remediation. Executing a new action will abort the previous one, if hasn't done yet.", "displayType": "CARD", "h": 4, "hideName": false, "i": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-74d80420-0a1c-11ee-94e8-b97b8109133e", "items": [ { "args": { "closeNotes": { "simple": "", "userMarkedRequired": true }, "closeReason": { "simple": "", "userMarkedRequired": true } }, "buttonClass": "success", "endCol": 4, "fieldId": "", "height": 53, "id": "907087c0-0a1c-11ee-94e8-b97b8109133e", "index": 0, "name": "Close Hunting Session", "scriptId": "Builtin|||closeInvestigation", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Proactive Threat Hunting - Entity Enrichment" } }, "buttonClass": "primary", "endCol": 4, "fieldId": "", "height": 53, "id": "91a70bf0-0a1c-11ee-94e8-b97b8109133e", "index": 1, "name": "Entity Enrichment", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Proactive Threat Hunting - Execute Query" } }, "buttonClass": "primary", "endCol": 4, "fieldId": "", "height": 53, "id": "74341230-14c0-11ee-985b-5d9798906d26", "index": 2, "name": "Execute Custom Query", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Proactive Threat Hunting - Block Indicators" } }, "buttonClass": "error", "endCol": 4, "fieldId": "", "height": 53, "id": "92b065a0-0a1c-11ee-94e8-b97b8109133e", "index": 3, "name": "Block IOCs", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "dropEffect": "move", "endCol": 4, "fieldId": "", "height": 53, "id": "a60e1cb0-2096-11ee-8b39-a7ebb8a31864", "index": 4, "listId": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-74d80420-0a1c-11ee-94e8-b97b8109133e", "sectionItemType": "button", "startCol": 0 }, { "args": { "name": { "simple": "Proactive Threat Hunting - Block Account" } }, "buttonClass": "error", "endCol": 4, "fieldId": "", "height": 53, "id": "23f8b020-0ec9-11ee-a51d-a990e3e96055", "index": 5, "name": "Block Account", "scriptId": "Builtin|||setPlaybook", "sectionItemType": "button", "startCol": 0 }, { "dropEffect": "move", "endCol": 1, "fieldId": "endpointisolationstatus", "height": 53, "id": "b785d850-0ab3-11ee-b966-55e2f7a73dc9", "index": 6, "listId": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-74d80420-0a1c-11ee-94e8-b97b8109133e", "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "userblockstatus", "height": 53, "id": "51929c50-0ee0-11ee-9be8-03c60dac9e17", "index": 7, "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "blockindicatorsstatus", "height": 53, "id": "f057cf80-0a1d-11ee-94e8-b97b8109133e", "index": 8, "listId": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-field-changed-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-74d80420-0a1c-11ee-94e8-b97b8109133e", "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Actions", "static": false, "w": 2, "x": 1, "y": 2 }, { "displayType": "CARD", "h": 3, "hideName": false, "i": "caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-caseinfoid-6d0c67f0-14c0-11ee-985b-5d9798906d26", "items": [ { "dropEffect": "move", "endCol": 4, "fieldId": "customqueryresults", "height": 106, "id": "cab9bab0-14c0-11ee-985b-5d9798906d26", "index": 0, "listId": "caseinfoid-6d0c67f0-14c0-11ee-985b-5d9798906d26", "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Custom Query Results", "static": false, "w": 3, "x": 0, "y": 6 }, { "h": 2, "i": "caseinfoid-4fcf36a0-2095-11ee-8b39-a7ebb8a31864", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Query Status ", "static": false, "type": "notes", "w": 3, "x": 0, "y": 0 }, { "description": "Follow the instruction to build and execute your hunting query.", "h": 4, "i": "caseinfoid-5bbc3120-2095-11ee-8b39-a7ebb8a31864", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Query Instructions", "static": false, "type": "workplan", "w": 1, "x": 0, "y": 2 } ], "type": "custom" }, { "hidden": true, "id": "ifeizyi4oe", "name": "Control Panel copy", "sections": [ { "h": 3, "i": "caseinfoid-lsqweemtuk-caseinfoid-field-changed-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-caseinfoid-field-changed-caseinfoid-61263cc0-98b1-11e9-97d7-ed26ef9e46c8", "maxW": 3, "minH": 1, "moved": false, "name": "Query Status ", "static": false, "type": "notes", "w": 1, "x": 2, "y": 0 }, { "description": "Follow the instruction to build and execute your hunting query.", "displayType": "ROW", "h": 3, "i": "caseinfoid-lsqweemtuk-caseinfoid-field-changed-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-field-changed-caseinfoid-field-changed-caseinfoid-6aabad20-98b1-11e9-97d7-ed26ef9e46c8", "maxW": 3, "minH": 1, "moved": false, "name": "Query Instructions", "static": false, "type": "workplan", "w": 2, "x": 0, "y": 0 }, { "h": 3, "i": "caseinfoid-lsqweemtuk-caseinfoid-field-changed-caseinfoid-lsqweemtuk-caseinfoid-lsqweemtuk-caseinfoid-fvtmv2oyuw-caseinfoid-fvtmv2oyuw-lsqweemtuk-caseinfoid-33264160-09c0-11ee-8f72-f32dc12d5a8f", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Evidence Results", "sort": { "asc": false, "field": "description" }, "static": false, "type": "evidence", "w": 3, "x": 0, "y": 3 } ], "type": "custom" }, { "hidden": false, "id": "warRoom", "name": "War Room", "type": "warRoom" }, { "hidden": false, "id": "workPlan", "name": "Work Plan", "type": "workPlan" }, { "hidden": true, "id": "evidenceBoard", "name": "Evidence Board", "type": "evidenceBoard" }, { "hidden": true, "id": "relatedIncidents", "name": "Related Incidents", "type": "relatedIncidents" }, { "hidden": true, "id": "canvas", "name": "Canvas", "type": "canvas" }, { "hidden": false, "id": "cis1gmcroi", "name": "Cheat Sheet", "sections": [ { "displayType": "ROW", "h": 10, "hideName": true, "i": "caseinfoid-cis1gmcroi-caseinfoid-7d05e0a0-56c4-11ee-9a16-f746601c51f2", "items": [ { "endCol": 6, "fieldId": "cheatsheet", "height": 44, "id": "7fce2860-56c4-11ee-9a16-f746601c51f2", "index": 0, "sectionItemType": "field", "startCol": 0 } ], "maxH": null, "maxW": 3, "minH": 1, "moved": false, "name": "Cheat Sheet", "static": false, "w": 3, "x": 0, "y": 0 } ], "type": "custom" } ] }, "edit": { "sections": [ { "description": "", "fields": [ { "fieldId": "incident_name", "isVisible": true }, { "fieldId": "incident_owner", "isVisible": true }, { "fieldId": "incident_type", "isVisible": true }, { "fieldId": "incident_tags", "isVisible": true } ], "isVisible": true, "name": "Basic Information", "query": null, "queryType": "", "readOnly": false, "type": "" } ] }, "group": "incident", "id": "Proactive Threat Hunting", "name": "Proactive Threat Hunting", "system": false, "version": -1, "fromVersion": "6.9.0", "description": "" }