Rapid7 InsightIDR - Indicators Hunting

This playbook facilitates threat hunting and detection of IOCs within Rapid7 InsightIDR SIEM logs utilizing four sub-playbooks. The sub-playbooks query Rapid7 InsightIDR SIEM for different indicators including files, traffic, HTTP requests, and execution flows indicators. Note that multiple search values should be separated by commas only (without spaces or any special characters). Supported IOCs for this playbook: - MD5 - SHA1 - SHA256 - IP Address - URLDomain - Registry Value - Registry Key - Registry Hives - Command Line - File Name - Process Name - HTTP Request Methods - User Agent - Port Number - File Path - Geolocation - Email Address - CIDR - URI - Ja3 - FileType

Pack

Rapid7_InsightIDR

Tasks

10

Inputs

• IPAddress — A single or multiple IP addresses to search for within Rapid7 InsightIDR logs. Used for both source and destination IP addresses. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRdstIPField — The name of the fields, in Rapid7 InsightIDR, in which to find the destination IPs.
• InsightIDRsrcIPField — The name of the fields, in Rapid7 InsightIDR, in which to find the source IPs.
• Application — A single or multiple application names to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRAppField — The name of the fields, in Rapid7 InsightIDR, in which to find the application names.
• PortNumber — A single or multiple IP addresses to search for within Rapid7 InsightIDR logs. Used for both source and destination ports. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRsrcPortField — The name of the fields, in Rapid7 InsightIDR, in which to find the source ports.
• InsightIDRdstPortField — The name of the fields, in Rapid7 InsightIDR, in which to find the destination ports.
• Geolocation — A single or multiple country names or codes to search for within Rapid7 InsightIDR logs. Used for both source and destination geolocations. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRsrcGeolocationField — The name of the fields, in Rapid7 InsightIDR, in which to find the source geolocations.
• InsightIDRSdstGeolocationField — The name of the fields, in Rapid7 InsightIDR, in which to find the destination geolocations.
• UserAgent — A single or multiple user agents to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRUserAgentField — The name of the fields, in Rapid7 InsightIDR, in which to find the user agents.
• FileType — A single or multiple file types to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRFileTypeField — The name of the fields, in Rapid7 InsightIDR, in which to find the file types.
• FileName — A single or multiple file names to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRFileNameField — The name of the fields, in Rapid7 InsightIDR, in which to find the file names.
• URLDomain — Single or multiple URLs and/or domains to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRURLDomainField — The name of the fields, in Rapid7 InsightIDR, in which to find the URLs or domains.
• URI — A single or multiple URIs to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRURIField — The name of the fields, in Rapid7 InsightIDR, in which to find the URIs.
• EmailAddress — A single or multiple email addresses to search for within Rapid7 InsightIDR logs. Used for both sender and recipient email addresses. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRSenderField — The name of the fields, in Rapid7 InsightIDR, in which to find the sender's email addresses.
• InsightIDRRecipientField — The name of the fields, in Rapid7 InsightIDR, in which to find the recipient's email addresses.
• HTTPRequestMethods — A single or multiple HTTP requests methods to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRHttpMethodsField — The name of the fields, in Rapid7 InsightIDR, in which to find the HTTP request methods.
• MD5 — A single or multiple MD5 file hashes to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRMD5Field — The name of the fields, in Rapid7 InsightIDR, in which to find the MD5 hashes.
• SHA256 — A single or multiple SHA256 file hashes to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRSHA256Field — The name of the fields, in Rapid7 InsightIDR, in which to find the SHA256 hashes.
• SHA1 — A single or multiple SHA1 file hashes to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRSHA1Field — The name of the fields, in Rapid7 InsightIDR, in which to find the SHA1 hashes.
• RegistryValue — A single or multiple registry values to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRRegistryValueField — The name of the fields, in Rapid7 InsightIDR, in which to find the registry values.
• RegistryKey — A single or multiple registry keys to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRRegistryKeyField — The name of the fields, in Rapid7 InsightIDR, in which to find the registry keys.
• RegistryHives — Only relevant for hunting on Windows hosts. A single or multiple registry hives to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRRegistryHivesField — The name of the fields, in Rapid7 InsightIDR, in which to find the registry hives.
• CommandLine — A single or multiple commands to parse and set for future use within hunting playbooks. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRCommandLineField — The name of the fields, in Rapid7 InsightIDR, in which to find the command's lines.
• ProcessName — A single or multiple process names to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRProcessNameField — The name of the fields, in Rapid7 InsightIDR, in which to find the process names.
• FilePath — A single or multiple file paths to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRFilePathField — The name of the fields, in Rapid7 InsightIDR, in which to find the file paths.
• CIDR — A single or multiple IP ranges to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• Ja3 — A single or multiple Ja3s to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters). JA3 is a method for creating SSL/TLS client fingerprints that should be easy to produce on any platform and can be easily shared for threat intelligence.
• InsightIDRJa3Field — The name of the fields, in Rapid7 InsightIDR, in which to find the Ja3s.
• LogSetId — An identifier for a Rapid7 InsightIDR log set to query.
• time_range — Specify the timeframe in which the Rapid7 InsightIDR logs will be searched. Most start with 'last' (e.g., last 2 months, last 10 minutes). The 'start_time' and 'end_time' inputs should not be used if the time_range input is specified. Supported time units (case insensitive): min(s) or minute(s) hr(s) or hour(s) day(s) week(s) month(s) year(s)
• logs_per_page — Specify the maximum number of log entries to return per page, up to 500 (the maximum allowed). By default, 50 is set.
• sequence_number — The earliest sequence number of a log entry to start searching. If this query parameter is included, the query results will additionally include all log entries received in the 'start_time' millisecond which have sequence numbers larger than the one specified. Sequence numbers are identifiers used to distinguish between log entries received in the same millisecond. If a log entry was split up into several log entries during ingestion, then those chunks are ordered by sequence number.
• start_time — Specify the query start time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds. For example, if you wish to begin searching 1 week ago, the UNIX timestamp value is 604800.
• end_time — Specify the query end time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds. For example, to end searching a day ago, the UNIX timestamp value would be 86400.

Outputs

• Rapid7InsightIDR.HuntingResults — Events log objects containing relevant fields.