Rapid7 InsightIDR - Execution Flow Indicators Hunting

This playbook queries Rapid7 InsightIDR SIEM for execution flow indicators, including registry values, registry keys, registry hives, commands, processes name, and applications. Note that multiple search values should be separated by commas only (without spaces or any special characters).

Pack

Rapid7_InsightIDR

Tasks

34

Inputs

• Application — A single or multiple application names to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRAppField — The name of the fields, in Rapid7 InsightIDR, in which to find the application names.
• RegistryValue — A single or multiple registry values to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRRegistryValueField — The name of the fields, in Rapid7 InsightIDR, in which to find the registry values.
• RegistryKey — A single or multiple registry keys to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRRegistryKeyField — The name of the fields, in Rapid7 InsightIDR, in which to find the registry keys.
• RegistryHives — Only relevant for hunting on Windows hosts. A single or multiple registry hives to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRRegistryHivesField — The name of the fields, in Rapid7 InsightIDR, in which to find the registry hives.
• CommandLine — A single or multiple command to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRCommandLineField — The name of the fields, in Rapid7 InsightIDR, in which to find the command's lines.
• ProcessName — A single or multiple process names to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRProcessNameField — The name of the fields, in Rapid7 InsightIDR, in which to find the process names.
• LogSetId — An identifier for a Rapid7 InsightIDR log set to query.
• time_range — Specify the timeframe in which the Rapid7 InsightIDR logs will be searched. Most start with 'last' (e.g., last 2 months, last 10 minutes). The 'start_time' and 'end_time' inputs should not be used if the time_range input is specified. Supported time units (case insensitive): min(s) or minute(s) hr(s) or hour(s) day(s) week(s) month(s) year(s)
• logs_per_page — Specify the maximum number of log entries to return per page, up to 500 (the maximum allowed). By default, 50 is set.
• sequence_number — The earliest sequence number of a log entry to start searching. If this query parameter is included, the query results will additionally include all log entries received in the 'start_time' millisecond which have sequence numbers larger than the one specified. Sequence numbers are identifiers used to distinguish between log entries received in the same millisecond. If a log entry was split up into several log entries during ingestion, then those chunks are ordered by sequence number.
• start_time — Specify the query start time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds. For example, if you wish to begin searching 1 week ago, the UNIX timestamp value is 604800.
• end_time — Specify the query end time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds. For example, to end searching a day ago, the UNIX timestamp value would be 86400.

Outputs

• Rapid7InsightIDR.HuntingResults — Events log objects containing relevant fields.

Commands used

• rapid7-insight-idr-query-log-set