QRadar Indicator Hunting

Deprecated. Use the "QRadar Indicator Hunting V2" playbook instead.

Inputs

MD5 — MD5 hash file or an array of hashes to search.
QradarMD5Field — MD5 field to search in QRadar. If none are specified, the search will use a payload contains filter.
SHA1 — SHA1 hash file or an array of hashes to search.
QradarSHA1Field — SHA1 field to search in QRadar. If none are specified, the search will use a payload contains filter.
SHA256 — SHA256 hash file or an array of hashes to search.
QradarSHA256Field — SHA256 field to search in QRadar. If none are specified, the search will use a payload contains filter.
IPAddress — Source or destination IP to search. Can be a single address or an array of addresses.
QradarIPfield — IP field to search in QRadar. If none are specified, the search will use sourceip or destinationip (combined).
URLDomain — Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used.
URLDomainField — URL/Domain field to search in QRadar. If none are specified, the search will use a payload contains filter.
SelectFields — The fields to be used in the select. Use comma delimited field names as they appear in AQL. * is an acceptable value.
TimeFrame — Time frame as used in AQL Examples can be LAST 7 DAYS START '2019-09-25 15:51' STOP '2019-09-25 17:51' For more examples review IBM's AQL documentation.
InvestigationFields — The fields to be used for the hunting outputs. These fields are added to the selected field's input.

QRadar.Search.Result — Qradar's search results.
QRadar.DetectedIPs — IP addresses detected based on sourceip and destinationip fields in your search.
QRadar.DetectedUsers — Users detected based on the username field in your search.
QRadar.DetectedHosts — Hosts detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar.