Anomali Enterprise Forensic Search

Initiates a Forensic Search on IOCs in Anomali Match.

Pack

Anomali_Enterprise

Tasks

6

Inputs

• from — First appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes).
• to — Last appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is now.
• indicators — Indicators to search.

Outputs

• AnomaliEnterprise.ForensicSearch.job_id — Job ID of the search.
• AnomaliEnterprise.ForensicSearch.status — Status of the search.
• AnomaliEnterprise.ForensicSearch.scannedEvents — Number of scanned events.
• AnomaliEnterprise.ForensicSearch.processedFiles — Number of processed files.
• AnomaliEnterprise.ForensicSearch.result_file_name — Matched file name.
• AnomaliEnterprise.ForensicSearch.totalMatches — Number of total matches.
• AnomaliEnterprise.ForensicSearch.complete — Whether the search was complete.
• AnomaliEnterprise.ForensicSearch.category — Search category.
• AnomaliEnterprise.ForensicSearch.streamResults — Stream results for the search.

Commands used

• anomali-enterprise-retro-forensic-search
• anomali-enterprise-retro-forensic-search-results