Carbon Black Rapid IOC Hunting Deprecated Hidden

Deprecated. Use "Search Endpoints By Hash - Carbon Black Response V2" playbook instead. Hunt for malicious indicators using Carbon Black

Deprecated Content (Deprecated) · 5 tasks · 0 inputs · 0 outputs

Details

ID	`Carbon Black Rapid IOC Hunting`
From Version	5.0.0
Tasks	5

README

DEPRECATED. Use “Search Endpoints By Hash - Carbon Black Response V2” playbook instead. Hunts for malicious indicators using Carbon Black.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

Exists
CBFindHash

Commands

This playbook does not use any commands.

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Carbon_Black_Rapid_IOC_Hunting

Flowchart

Source

playbook-Carbon_Black_Rapid_IOC_Hunting.yml

Download History Raw

id: Carbon Black Rapid IOC Hunting
fromversion: 5.0.0
system: true
version: -1
name: Carbon Black Rapid IOC Hunting
description: Deprecated. Use "Search Endpoints By Hash - Carbon Black Response V2" playbook instead. Hunt for malicious indicators using Carbon Black
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: 729a5739-da09-4d2f-8a3c-abc427e3efd2
    type: start
    task:
      id: 729a5739-da09-4d2f-8a3c-abc427e3efd2
      version: -1
      name: ""
      description: Playbook start point
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 1a3ea7e1-aaf3-4df0-89f6-70e2680bda7a
    type: regular
    task:
      id: 1a3ea7e1-aaf3-4df0-89f6-70e2680bda7a
      version: -1
      name: CBFindHash
      description: Search Carbon Black for connection to specified md5 hash(es).
      scriptName: CBFindHash
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      md5:
        simple: ${File.MD5}
    results:
    - found_file_locations
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: c687c04f-ba90-4572-800a-923193bacc32
    type: condition
    task:
      id: c687c04f-ba90-4572-800a-923193bacc32
      version: -1
      name: Is Carbon Black enabled?
      description: Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "4"
    scriptarguments:
      value:
        simple: ${modules(val.brand == 'carbonblack' && val.state == 'active')}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 189b725f-2b0a-42cc-8148-95395f810983
    type: title
    task:
      id: 189b725f-2b0a-42cc-8148-95395f810983
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: a4a842fc-727c-4a64-883d-873968708ded
    type: condition
    task:
      id: a4a842fc-727c-4a64-883d-873968708ded
      version: -1
      name: Do we have files to hunt?
      description: Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "1"
    scriptarguments:
      value:
        simple: ${File.MD5}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "2_3_#default#": 0.27
    },
    "paper": {
      "dimensions": {
        "height": 735,
        "width": 492.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- no test
deprecated: true