Hurukai - Hunt IOCs

This playbook allows is triggered by the Hurukai - Process Indicators - Manual Review playbook. It allows to search for IOC sightings in the HarfangLab EDR and tag sighted IOCs accordingly for manual review. All IOCs are tagged in order to be further inserted into a HarfangLab EDR IOC source.

Pack

HarfangLabEDR

Tasks

8

Inputs

Outputs

• ProcessedIndicators — Indicators that are associated to EDR sightings and need reviewing.

Commands used

• appendIndicatorField
• harfanglab-hunt-search-hash