FireEye HX - Indicators Hunting

This playbook facilitates threat hunting and detection of IOCs within FireEye Endpoint Security (HX) utilizing three sub-playbooks. The sub-playbooks query FireEye HX for different indicators including files, traffic, and execution flow indicators. Note that multiple search values should be separated by commas only (without spaces or any special characters). Supported IOCs for this playbook: - MD5 - SHA1 - SHA256 - IP Address - URLDomain - Registry Value - Registry Key - File Name - Process Name - Port Number - File Path - FileType

Pack

FireEyeHX

Tasks

8

Inputs

• IPAddress — A single or multiple IP address to search for in FireEye HX logs. Used for both source and destination IP addresses. Separate multiple search values by commas only (without spaces or any special characters).
• PortNumber — A single or multiple port numbers to search for in FireEye HX logs. Used for both remote and local ports. Separate multiple search values by commas only (without spaces or any special characters).
• URLDomain — Single or multiple URLs and/or domains to search for in FireEye HX logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).
• SHA256 — A single or multiple SHA256 file hashes to search for in FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
• SHA1 — A single or multiple SHA1 file hashes to search for in FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
• MD5 — A single or multiple MD5 file hashes to search for in FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
• FilePath — A single or multiple file paths to search for in FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
• FileName — A single or multiple file names to search for in FireEye HX logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).
• FileType — A single or multiple file types to search for in FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
• ProcessName — A single or multiple process names to search for in FireEye HX logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).
• RegistryKey — A single or multiple registry keys to search for in FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
• RegistryValue — A single or multiple registry values to search for in FireEye HX logs. By default, the 'contains' clause is used.
• Application — Single or multiple application names or codes to search for in FireEye HX logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).
• hostSetName — The name of the host set to be searched.
• exhaustive — Whether a search is exhaustive. Possible values are: yes, no. Default is yes.
• interval_in_seconds — The interval in seconds between each poll. Default is 60.
• limit — Limits the results count. (When the limit is reached, the search stops).

Outputs

• FireEyeHX.HuntingResults — Email message objects and fields that were retrieved from FireEye HX.
• FireEyeHX.HuntingResults.Timestamp - Event — The timestamp of the event.
• FireEyeHX.HuntingResults.Timestamp - Accessed — The time when the entry was last accessed.
• FireEyeHX.HuntingResults.Timestamp - Modified — The time when the entry was last modified.
• FireEyeHX.HuntingResults.File Name — The name of the file.
• FireEyeHX.HuntingResults.File Full Path — The full path of the file.
• FireEyeHX.HuntingResults.DNS Hostname — The name of the DNS host.
• FireEyeHX.HuntingResults.URL — The event URL.
• FireEyeHX.HuntingResults.Username — The event username.
• FireEyeHX.HuntingResults.File MD5 Hash — The MD5 hash of the file.
• FireEyeHX.HuntingResults.Port — The port.
• FireEyeHX.HuntingResults.Process ID — The ID of the process.
• FireEyeHX.HuntingResults.Local IP Address — The local IP address.
• FireEyeHX.HuntingResults.Local Port — The local port.
• FireEyeHX.HuntingResults.Remote Port — The remote port.
• FireEyeHX.HuntingResults.IP Address — The IP address.
• FireEyeHX.HuntingResults.Process Name — The process name.
• FireEyeHX.HuntingResults.type — The type of the event.
• FireEyeHX.HuntingResults.id — The ID of the result.