Get host forensics - Generic

This playbook retrieves forensics from hosts for the following integrations: - Illusive Networks - Microsoft Defender For Endpoint.

Pack

CommonPlaybooks

Tasks

6

Inputs

• fqdn_or_ip — If using the Illusive Networks integration to retrieve additional forensics, provide the host fqdn_or_ip from which to get the forensics.
• start_date — Date_range must be "number date_range_unit", for example 2 hours, 4 minutes, 6 months, 1 day.
• end_date — Date_range must be "number date_range_unit" for example 2 hours, 4 minutes, 6 months, 1 day.
• machine_ID — Provide the machine IDs of the systems you want to retrieve.

Outputs

• MicrosoftATP — An object containing the machine action details.
• MicrosoftATP.MachineAction — Microsoft Defender For Endpoint machine action details.
• Illusive.Forensics.Evidence — An object containing evidence from Illusive Networks.
• Illusive.Forensics.Evidence.details — The forensics evidence details.
• Illusive.Forensics.Evidence.eventId — The event ID.
• Illusive.Forensics.Evidence.id — The forensics evidence ID.
• Illusive.Forensics.Evidence.source — The evidence source.
• Illusive.Forensics.Evidence.starred — Whether the forensics evidence has been starred.
• Illusive.Forensics.Evidence.time — Date and time of the forensics evidence.
• Illusive.Forensics.Evidence.title — The forensics evidence description.
• Illusive.Forensics — Ab object containing the Incident ID in Illusive Networks.
• Illusive.Forensics.IncidentId — The incident ID.