Rapid7 InsightIDR - Traffic Indicators Hunting

This playbook queries Rapid7 InsightIDR SIEM for traffic indicators, including URLs, domains, ports, IP addresses, IP ranges (CIDR), email addresses, and geolocations. Note that multiple search values should be separated by commas only (without spaces or any special characters).

Pack

Rapid7_InsightIDR

Tasks

39

Inputs

• IPAddress — A single or multiple IP addresses to search for within Rapid7 InsightIDR logs. Used for both source and destination IP addresses. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRdstIPField — The name of the fields, in Rapid7 InsightIDR, in which to find the destination IPs.
• InsightIDRsrcIPField — The name of the fields, in Rapid7 InsightIDR, in which to find the source IPs.
• PortNumber — A single or multiple IP addresses to search for within Rapid7 InsightIDR logs. Used for both source and destination ports. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRsrcPortField — The name of the fields, in Rapid7 InsightIDR, in which to find the source ports.
• InsightIDRdstPortField — The name of the fields, in Rapid7 InsightIDR, in which to find the destination ports.
• Geolocation — A single or multiple country names or codes to search for within Rapid7 InsightIDR logs. Used for both source and destination geolocations. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRsrcGeolocationField — The name of the fields, in Rapid7 InsightIDR, in which to find the source geolocations.
• InsightIDRSdstGeolocationField — The name of the fields, in Rapid7 InsightIDR, in which to find the destination geolocations.
• URLDomain — Single or multiple URLs and/or domains to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRURLDomainField — The name of the fields, in Rapid7 InsightIDR, in which to find the URLs or domains.
• EmailAddress — A single or multiple email addresses to search for within Rapid7 InsightIDR logs. Used for both sender and recipient email addresses. Separate multiple search values by commas only (without spaces or any special characters).
• InsightIDRSenderField — The name of the fields, in Rapid7 InsightIDR, in which to find the sender's email addresses.
• InsightIDRRecipientField — The name of the fields, in Rapid7 InsightIDR, in which to find the recipient's email addresses.
• CIDR — A single or multiple IP ranges to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
• LogSetId — An identifier for a Rapid7 InsightIDR log set to query.
• time_range — Specify the timeframe in which the Rapid7 InsightIDR logs will be searched. Most start with 'last' (e.g., last 2 months, last 10 minutes). The 'start_time' and 'end_time' inputs should not be used if the time_range input is specified. Supported time units (case insensitive): min(s) or minute(s) hr(s) or hour(s) day(s) week(s) month(s) year(s)
• logs_per_page — Specify the maximum number of log entries to return per page, up to 500 (the maximum allowed). By default, 50 is set.
• sequence_number — The earliest sequence number of a log entry to start searching. If this query parameter is included, the query results will additionally include all log entries received in the 'start_time' millisecond which have sequence numbers larger than the one specified. Sequence numbers are identifiers used to distinguish between log entries received in the same millisecond. If a log entry was split up into several log entries during ingestion, then those chunks are ordered by sequence number.
• start_time — Specify the query start time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds. For example, if you wish to begin searching 1 week ago, the UNIX timestamp value is 604800.
• end_time — Specify the query end time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds. For example, to end searching a day ago, the UNIX timestamp value would be 86400.

Outputs

• Rapid7InsightIDR.HuntingResults — Events log objects containing relevant fields.

Commands used

• rapid7-insight-idr-query-log-set