Uptycs - Bad IP Incident

Get information about processes which open connections to known Bad IP's

Pack

Uptycs

Tasks

9

Inputs

• alert_id — Unique Uptycs ID for a particular alert

Outputs

• Uptycs.Proc.pid — pid for the process
• Uptycs.Proc.upt_add_time — time that the process was spawned
• Uptycs.Proc.upt_remove_time — time that the process was removed
• Uptycs.Parent.pid — pid of the parent process
• Uptycs.Parent.upt_add_time — time that the process was spawned
• Uptycs.Parent.upt_remove_time — time that the process was removed
• Uptycs.Sockets.local_address — local IP for specified connection
• Uptycs.Sockets.local_port — local port for specified connection
• Uptycs.Sockets.remote_port — remote port for specified connection
• Uptycs.Children.pid — pid of a child process
• Uptycs.Children.upt_add_time — time that the process was spawned
• Uptycs.Children.upt_remove_time — time that the process was removed

Commands used

• uptycs-get-alerts
• uptycs-get-parent-information
• uptycs-get-process-child-processes
• uptycs-get-process-information
• uptycs-get-process-open-sockets
• uptycs-get-threat-indicator
• uptycs-get-threat-source