Endpoint Enrichment - Generic v2.1

Enrich an endpoint by hostname using one or more integrations. Supported integrations: - Active Directory Query v2 - McAfee ePolicy Orchestrator - Carbon Black Enterprise Response v2 - Cylance Protect v2 - CrowdStrike Falcon Host - ExtraHop Reveal(x) - Endpoint reputation using !endpoint command

Pack

CommonPlaybooks

Tasks

28

Inputs

• Hostname — The hostname of the endpoint to enrich.
• UseReputationCommand — Define if you would like to use the !endpoint command. Note: This input should be used whenever there is no auto-extract enabled in the investigation flow. Possible values: True / False.
• IPAddress — The IP address of the endpoint to enrich.
• EndpointID — The endpoint ID of the endpoint to enrich.

Outputs

• Endpoint — The endpoint object of the endpoint that was enriched.
• Endpoint.Hostname — The hostnames of the endpoints that were enriched.
• Endpoint.OS — The operating systems running on the endpoints that were enriched.
• Endpoint.IP — A list of the IP addresses of the endpoints.
• Endpoint.MAC — A list of the MAC addresses of the endpoints that were enriched.
• Endpoint.Domain — The domain names of the endpoints that were enriched.
• CylanceProtectDevice — The device information about the hostname that was enriched using Cylance Protect v2.
• ExtraHop.Device.Macaddr — The MAC Address of the device.
• ExtraHop.Device.DeviceClass — The class of the device.
• ExtraHop.Device.UserModTime — The time of the most recent update, expressed in milliseconds since the epoch.
• ExtraHop.Device.AutoRole — The role automatically detected by the ExtraHop.
• ExtraHop.Device.ParentId — The ID of the parent device.
• ExtraHop.Device.Vendor — The device vendor.
• ExtraHop.Device.Analysis — The level of analysis preformed on the device.
• ExtraHop.Device.DiscoveryId — The UUID given by the Discover appliance.
• ExtraHop.Device.DefaultName — The default name of the device.
• ExtraHop.Device.DisplayName — The display name of device.
• ExtraHop.Device.OnWatchlist — Whether the device is on the advanced analysis allow list.
• ExtraHop.Device.ModTime — The time of the most recent update, expressed in milliseconds since the epoch.
• ExtraHop.Device.IsL3 — Indicates whether the device is a Layer 3 device.
• ExtraHop.Device.Role — The role of the device.
• ExtraHop.Device.DiscoverTime — The time that the device was discovered.
• ExtraHop.Device.Id — The ID of the device.
• ExtraHop.Device.Ipaddr4 — The IPv4 address of the device.
• ExtraHop.Device.Vlanid — The ID of VLan.
• ExtraHop.Device.Ipaddr6 — The IPv6 address of the device.
• ExtraHop.Device.NodeId — The Node ID of the Discover appliance.
• ExtraHop.Device.Description — A user customizable description of the device.
• ExtraHop.Device.DnsName — The DNS name associated with the device.
• ExtraHop.Device.DhcpName — The DHCP name associated with the device.
• ExtraHop.Device.CdpName — The Cisco Discovery Protocol name associated with the device.
• ExtraHop.Device.NetbiosName — The NetBIOS name associated with the device.
• ExtraHop.Device.Url — Link to the device details page in ExtraHop.
• Endpoint.IPAddress — The endpoint IP address or list of IP addresses.
• Endpoint.ID — The endpoint ID.
• Endpoint.Status — The endpoint status.
• Endpoint.IsIsolated — The endpoint isolation status.
• Endpoint.MACAddress — The endpoint MAC address.
• Endpoint.Vendor — The integration name of the endpoint vendor.
• ActiveDirectory.Computers — The information about the hostname that was enriched using Active Directory.
• ActiveDirectory.Computers.dn — The computer distinguished name.
• ActiveDirectory.Computers.memberOf — Groups for which the computer is listed.
• ActiveDirectory.Computers.name — The computer name.
• Endpoint.Groups — Groups for which the computer is listed as a member.
• ActiveDirectory.ComputersPageCookie — An opaque string received in a paged search, used for requesting subsequent entries.

Commands used

• ad-get-computer
• cb-sensor-info
• cs-device-details
• cs-device-search
• endpoint
• epo-find-system
• extrahop-device-search