Get prevalence for IOCs

The playbook queries the analytics module to receive the prevalence of an IOC. Supported IOC: - Process by SHA256 - Process by file name - IP - Domain - CMD - Registry (require key and value)

Pack

CommonPlaybooks

Tasks

20

Inputs

• IP
• Hash
• Commandline
• Process
• RegistryKey
• RegistryValue
• Domain

Outputs

• Core.AnalyticsPrevalence.Ip — Whether the IP address is prevalent or not.
• Core.AnalyticsPrevalence.Ip.value — Whether the IP address is prevalent or not.
• Core.AnalyticsPrevalence.Ip.data.global_prevalence — The global prevalence of the IP address.
• Core.AnalyticsPrevalence.Ip.data.global_prevalence.value — The global prevalence of the IP address.
• Core.AnalyticsPrevalence.Ip.data.local_prevalence — The local prevalence of the IP address.
• Core.AnalyticsPrevalence.Ip.data.local_prevalence.value — The local prevalence of the IP address.
• Core.AnalyticsPrevalence.Ip.data.prevalence — The prevalence of the IP address.
• Core.AnalyticsPrevalence.Ip.data.prevalence.value — The prevalence of the IP address.
• Core.AnalyticsPrevalence.Hash — The prevalence of the hash.
• Core.AnalyticsPrevalence.Hash.value — Whether the hash is prevalent or not.
• Core.AnalyticsPrevalence.Hash.data.global_prevalence — The prevalence of the hash.
• Core.AnalyticsPrevalence.Hash.data.global_prevalence.value — The global prevalence of the hash.
• Core.AnalyticsPrevalence.Hash.data.local_prevalence — The local prevalence of the hash.
• Core.AnalyticsPrevalence.Hash.data.local_prevalence.value — The local prevalence of the hash.
• Core.AnalyticsPrevalence.Hash.data.prevalence — The prevalence of the hash.
• Core.AnalyticsPrevalence.Hash.data.prevalence.value — The prevalence of the hash.
• Core.AnalyticsPrevalence.Domain — The prevalence of the domain.
• Core.AnalyticsPrevalence.Domain.value — Whether the domain is prevalent or not.
• Core.AnalyticsPrevalence.Domain.data.global_prevalence — The global prevalence of the domain.
• Core.AnalyticsPrevalence.Domain.data.global_prevalence.value — The global prevalence of the domain.
• Core.AnalyticsPrevalence.Domain.data.local_prevalence — The local prevalence of the domain.
• Core.AnalyticsPrevalence.Domain.data.local_prevalence.value — The local prevalence of the domain.
• Core.AnalyticsPrevalence.Domain.data.prevalence — The prevalence of the domain.
• Core.AnalyticsPrevalence.Domain.data.prevalence.value — The prevalence of the domain.
• Core.AnalyticsPrevalence.Process — The prevalence of the process.
• Core.AnalyticsPrevalence.Process.value — Whether the process is prevalent or not.
• Core.AnalyticsPrevalence.Process.data.global_prevalence — The global prevalence of the process.
• Core.AnalyticsPrevalence.Process.data.global_prevalence.value — The global prevalence of the process.
• Core.AnalyticsPrevalence.Process.data.local_prevalence — The local prevalence of the process.
• Core.AnalyticsPrevalence.Process.data.local_prevalence.value — The local prevalence of the process.
• Core.AnalyticsPrevalence.Process.data.prevalence — The prevalence of the process.
• Core.AnalyticsPrevalence.Process.data.prevalence.value — The prevalence of the process.
• Core.AnalyticsPrevalence.Registry — The prevalence of the registry.
• Core.AnalyticsPrevalence.Registry.value — Whether the registry is prevalent or not.
• Core.AnalyticsPrevalence.Registry.data.global_prevalence — The global prevalence of the registry.
• Core.AnalyticsPrevalence.Registry.data.global_prevalence.value — The global prevalence of the registry.
• Core.AnalyticsPrevalence.Registry.data.local_prevalence — The local prevalence of the registry.
• Core.AnalyticsPrevalence.Registry.data.local_prevalence.value — The local prevalence of the registry.
• Core.AnalyticsPrevalence.Registry.data.prevalence — The prevalence of the registry.
• Core.AnalyticsPrevalence.Registry.data.prevalence.value — The prevalence of the registry.
• Core.AnalyticsPrevalence.Cmd — The prevalence of the CMD.
• Core.AnalyticsPrevalence.Cmd.value — Whether the CMD is prevalent or not.
• Core.AnalyticsPrevalence.Cmd.data.global_prevalence — The global prevalence of the CMD.
• Core.AnalyticsPrevalence.Cmd.data.global_prevalence.value — The global prevalence of the CMD.
• Core.AnalyticsPrevalence.Cmd.data.local_prevalence — The local prevalence of the CMD.
• Core.AnalyticsPrevalence.Cmd.data.local_prevalence.value — The local prevalence of the CMD.
• Core.AnalyticsPrevalence.Cmd.data.prevalence — The prevalence of the CMD.
• Core.AnalyticsPrevalence.Cmd.data.prevalence.value — The prevalence of the Cmd.

Commands used

• core-get-IP-analytics-prevalence
• core-get-cmd-analytics-prevalence
• core-get-domain-analytics-prevalence
• core-get-hash-analytics-prevalence
• core-get-process-analytics-prevalence
• core-get-registry-analytics-prevalence