Anomali Enterprise Forensic Search

Initiates a Forensic Search on IOCs in Anomali Match.

Anomali Enterprise · 6 tasks · 3 inputs · 9 outputs

Details

ID	`Anomali Enterprise Forensic Search`
From Version	5.0.0
Tasks	6

README

Initiates a Forensic Search on IOCs in Anomali Match.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

Anomali Match

Scripts

This playbook does not use any scripts.

Commands

anomali-enterprise-retro-forensic-search-results
anomali-enterprise-retro-forensic-search

Playbook Inputs

Name	Description	Required
from	First appearance time range e.g., 1 hour, 30 minutes).	Required
to	Last appearance time range e.g., 1 hour, 30 minutes). Default is now.	Optional
indicators	Indicators to search.	Required

Playbook Outputs

Path	Description	Type
AnomaliEnterprise.ForensicSearch.job_id	Job ID of the search.	string
AnomaliEnterprise.ForensicSearch.status	Status of the search.	string
AnomaliEnterprise.ForensicSearch.scannedEvents	Number of scanned events.	number
AnomaliEnterprise.ForensicSearch.processedFiles	Number of processed files.	number
AnomaliEnterprise.ForensicSearch.result_file_name	Matched file name.	string
AnomaliEnterprise.ForensicSearch.totalMatches	Number of total matches.	number
AnomaliEnterprise.ForensicSearch.complete	Whether the search was complete.	boolean
AnomaliEnterprise.ForensicSearch.category	Search category.	string
AnomaliEnterprise.ForensicSearch.streamResults	Stream results for the search.	unknown

Inputs

from — First appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes).
to — Last appearance time range (<number> <time unit>, e.g., 1 hour, 30 minutes). Default is now.
indicators — Indicators to search.

Outputs

AnomaliEnterprise.ForensicSearch.job_id — Job ID of the search.
AnomaliEnterprise.ForensicSearch.status — Status of the search.
AnomaliEnterprise.ForensicSearch.scannedEvents — Number of scanned events.
AnomaliEnterprise.ForensicSearch.processedFiles — Number of processed files.
AnomaliEnterprise.ForensicSearch.result_file_name — Matched file name.
AnomaliEnterprise.ForensicSearch.totalMatches — Number of total matches.
AnomaliEnterprise.ForensicSearch.complete — Whether the search was complete.
AnomaliEnterprise.ForensicSearch.category — Search category.
AnomaliEnterprise.ForensicSearch.streamResults — Stream results for the search.

Commands used

anomali-enterprise-retro-forensic-search anomali-enterprise-retro-forensic-search-results

Flowchart

Source

playbook-Anomali_Enterprise-Retro_Forensic_Search.yml

Download History Raw

id: Anomali Enterprise Forensic Search
version: -1
name: Anomali Enterprise Forensic Search
fromversion: 5.0.0
description: Initiates a Forensic Search on IOCs in Anomali Match.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 8bff5d33-9554-4ab9-833c-cc0c0d5fdfd8
    type: start
    task:
      id: 8bff5d33-9554-4ab9-833c-cc0c0d5fdfd8
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 106b8f2e-5106-4857-82ac-122450af4893
    type: condition
    task:
      id: 106b8f2e-5106-4857-82ac-122450af4893
      version: -1
      name: Is Anomali Enterprise enabled?
      description: Checks if there is a valid instance of the Palo Alto Networks PAN-OS
        integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Anomali Enterprise
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 5c9d2630-a40a-4c00-8bae-8fff9da8b2e6
    type: regular
    task:
      id: 5c9d2630-a40a-4c00-8bae-8fff9da8b2e6
      version: -1
      name: Initiate forensic search
      description: Initiates a forensic search of the indicators.
      script: '|||anomali-enterprise-retro-forensic-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      from:
        complex:
          root: inputs.from
      indicators:
        complex:
          root: inputs.indicators
      to:
        complex:
          root: inputs.to
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 34756736-442e-4e28-85ca-2e643dac38a4
    type: playbook
    task:
      id: 34756736-442e-4e28-85ca-2e643dac38a4
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      AdditionalPollingCommandArgNames: {}
      AdditionalPollingCommandArgValues: {}
      Ids:
        complex:
          root: AnomaliEnterprise.ForensicSearch
          accessor: job_id
      Interval:
        simple: "1"
      PollingCommandArgName:
        simple: job_id
      PollingCommandName:
        simple: anomali-enterprise-retro-forensic-search-results
      Timeout:
        simple: "15"
      dt:
        simple: AnomaliEnterprise.ForensicSearch(val.status != 'completed').job_id
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: b9a64f90-518c-463d-8882-219d65e53df0
    type: title
    task:
      id: b9a64f90-518c-463d-8882-219d65e53df0
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: f269b32a-3d73-4e46-8303-44dfece3d765
    type: regular
    task:
      id: f269b32a-3d73-4e46-8303-44dfece3d765
      version: -1
      name: Get forensic search results
      description: Retreive the forensic search results.
      script: '|||anomali-enterprise-retro-forensic-search-results'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      job_id:
        complex:
          root: AnomaliEnterprise.ForensicSearch
          accessor: job_id
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 910,
        "width": 492.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: from
  value: {}
  required: true
  description: First appearance time range (<number> <time unit>, e.g., 1 hour, 30
    minutes).
  playbookInputQuery: null
- key: to
  value: {}
  required: false
  description: Last appearance time range (<number> <time unit>, e.g., 1 hour, 30
    minutes). Default is now.
  playbookInputQuery: null
- key: indicators
  value: {}
  required: true
  description: Indicators to search.
  playbookInputQuery: null
outputs:
- contextPath: AnomaliEnterprise.ForensicSearch.job_id
  description: Job ID of the search.
  type: string
- contextPath: AnomaliEnterprise.ForensicSearch.status
  description: Status of the search.
  type: string
- contextPath: AnomaliEnterprise.ForensicSearch.scannedEvents
  description: Number of scanned events.
  type: number
- contextPath: AnomaliEnterprise.ForensicSearch.processedFiles
  description: Number of processed files.
  type: number
- contextPath: AnomaliEnterprise.ForensicSearch.result_file_name
  description: Matched file name.
  type: string
- contextPath: AnomaliEnterprise.ForensicSearch.totalMatches
  description: Number of total matches.
  type: number
- contextPath: AnomaliEnterprise.ForensicSearch.complete
  description: Whether the search was complete.
  type: boolean
- contextPath: AnomaliEnterprise.ForensicSearch.category
  description: Search category.
  type: string
- contextPath: AnomaliEnterprise.ForensicSearch.streamResults
  description: Stream results for the search.
  type: unknown
tests:
 - Anomali Match Forensic Search - Test