Acquire And Analyze Host Forensics

This playbook enables gathering forensic data from a host and analyzing the acquired data by using the relevant forensics automations.

Windows Forensics · 5 tasks · 1 input · 0 outputs

Details

ID	`Acquire And Analyze Host Forensics`
From Version	6.0.0
Tasks	5

README

This playbook enables gathering forensic data from a host and analyzing the acquired data by using the relevant forensics automations.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Forensics Tools Analysis
PS-Remote Acquire Host Forensics

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
Host	A single hostname or IP address from which to acquire the forensic data. For example, testpc01.		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Acquire And Analyze Host Forensics

Inputs

Host — A single hostname or IP address from which to acquire the forensic data. For example, testpc01.

Flowchart

Source

playbook-Acquire_And_Analyze_Host_Forensics.yml

Download History Raw

id: Acquire And Analyze Host Forensics
version: -1
name: Acquire And Analyze Host Forensics
description: This playbook enables gathering forensic data from a host
  and analyzing the acquired data by using the relevant forensics automations.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 00a4be27-1ca3-497d-8100-3c001c8fab2c
    type: start
    task:
      id: 00a4be27-1ca3-497d-8100-3c001c8fab2c
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 270,
          "y": -170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: e31fb2e3-3dc8-4099-8e7e-2bf07e1f3e52
    type: playbook
    task:
      id: e31fb2e3-3dc8-4099-8e7e-2bf07e1f3e52
      version: -1
      name: PS-Remote Acquire Host Forensics
      description: This playbook allows the user to gather multiple forensic data
        from a Windows endpoint, including network traffic, MFT (Master File Table),
        and registry export, by using the PS remote automations that enable you to connect
        to a Windows host using just the native Windows management tools. You do not need to install any 3rd-party tools.
      playbookName: PS-Remote Acquire Host Forensics
      playbookId: PS-Remote Acquire Host Forensics
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      GetMft:
        simple: "true"
      GetNetworkTraffic:
        simple: "true"
      GetRegistry:
        simple: "true"
      Host:
        simple: ${inputs.Host}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 500,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 3fc3264f-288c-4360-8972-d5f648ca6a16
    type: title
    task:
      id: 3fc3264f-288c-4360-8972-d5f648ca6a16
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 270,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: abaccea2-7642-47dc-835d-202c037abb96
    type: playbook
    task:
      id: abaccea2-7642-47dc-835d-202c037abb96
      version: -1
      name: Forensics Tools Analysis
      description: This playbook allows the user to analyze forensic evidence acquired
        from a host, such as registry files, memory dump files, and PCAP files.
      playbookName: Forensics Tools Analysis
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    note: false
    quietmode: 0
    scriptarguments:
      PcapEntryID:
        simple: ${PcapDetails.EntryID}
      RegistryEntryId:
        simple: ${RegistryDetails.EntryID}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 500,
          "y": 320
        }
      }
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
  "4":
    id: "4"
    taskid: 149d44c0-a825-4db0-89ae-57d23251de85
    type: condition
    task:
      id: 149d44c0-a825-4db0-89ae-57d23251de85
      version: -1
      name: Was a hostname provided?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Host
            iscontext: true
    view: |-
      {
        "position": {
          "x": 270,
          "y": -30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 735,
        "width": 590,
        "x": 270,
        "y": -170
      }
    }
  }
inputs:
- key: Host
  value: {}
  required: false
  description: 'A single hostname or IP address from which to acquire the forensic data. For example,
    testpc01. '
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0