Cortex XDR - Search and Compare Process Executions - XQL Engine

This playbook is a generic playbook that receives a process name and a command-line argument. It uses the "Cortex XDR - XQL Engine" integration to search for the given process executions and compare the command-line argument from the results to the command-line argument received from the playbook input. Note: Under the "Processes" input, the playbook should receive an array that contains the following keys: - value: *process name* - commands: *command-line arguments*

Cortex XDR by Palo Alto Networks · 10 tasks · 3 inputs · 2 outputs

Details

ID	`Cortex XDR - Search and Compare Process Executions - XQL Engine`
From Version	6.9.0
Tasks	10

README

This playbook is a generic playbook that receives a process name and a command-line argument. It uses the “Cortex XDR - XQL Engine” integration to search for the given process executions and compares the command-line argument from the results to the command-line argument received from the playbook input.

Note: Under the “Processes” input, the playbook should receive an array that contains the following keys:

value: process name
commands: command-line arguments

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

XQLQueryingEngine

Scripts

StringSimilarity
Set
DeleteContext

Commands

xdr-xql-generic-query

Playbook Inputs

Name	Description	Default Value	Required
Processes	Process name to search and command-line argument to compare. This input should receive an array that contains the following keys: -value: process name -commands: command-line arguments		Optional
HuntingTimeFrame	Time in relative date or range format (for example: “1 day”, “3 weeks ago”, “between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00”). The default is the last 24 hours.	7 days	Optional
StringSimilarityThreshold	StringSimilarity automation threshold. A number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.	0.5	Optional

Playbook Outputs

Path	Description	Type
StringSimilarity	StringSimilarity automation results.	unknown
Findings	Suspicious process executions found.	unknown

Playbook Image

Cortex XDR - Search and Compare Process Executions - XQL Engine

Inputs

Processes — Process name to search and command-line argument to compare. This input should receive an array that contains the following keys: - value: *process name* - commands: *command-line arguments*
HuntingTimeFrame — Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.
StringSimilarityThreshold — StringSimilarity automation threshold: A number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.

Outputs

StringSimilarity — StringSimilarity automation results
Findings — Suspicious process executions found

Commands used

xdr-xql-generic-query

Flowchart

Source

playbook-Cortex_XDR_-_Search_and_Compare_Process_Executions_-_XQL_Engine.yml

Download History Raw

id: Cortex XDR - Search and Compare Process Executions - XQL Engine
version: -1
name: Cortex XDR - Search and Compare Process Executions - XQL Engine
description: |-
  This playbook is a generic playbook that receives a process name and a command-line argument. It uses the "Cortex XDR - XQL Engine" integration to search for the given process executions and compare the command-line argument from the results to the command-line argument received from the playbook input.

  Note: Under the "Processes" input, the playbook should receive an array that contains the following keys:
  - value: *process name*
  - commands: *command-line arguments*
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 92eff83b-1cfb-4e55-875d-efd9c64debde
    type: start
    task:
      id: 92eff83b-1cfb-4e55-875d-efd9c64debde
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: e169c8b6-fc4d-456c-8327-eea2ba7b1cfa
    type: regular
    task:
      id: e169c8b6-fc4d-456c-8327-eea2ba7b1cfa
      version: -1
      name: Set process to search
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      key:
        simple: ProcessToSearch
      value:
        complex:
          root: inputs.Processes
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 780,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 247e6298-919d-4fce-8e68-f98cc3e080a1
    type: condition
    task:
      id: 247e6298-919d-4fce-8e68-f98cc3e080a1
      version: -1
      name: Has query results?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: PaloAltoNetworksXQL.GenericQuery.results
                accessor: cmd
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 780,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: c1e49ce0-5cfc-46ec-82c4-dc3a28b64dd7
    type: title
    task:
      id: c1e49ce0-5cfc-46ec-82c4-dc3a28b64dd7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 663d69c0-4c90-4690-80d4-f54ff8b59a5f
    type: regular
    task:
      id: 663d69c0-4c90-4690-80d4-f54ff8b59a5f
      version: -1
      name: Compare query results to given command-line patterns
      description: This automation calculates the similarity ratio between text and a list of strings and outputs a decimal value between 0.0 and 1.0 (1.0 if the sequences are identical, and 0.0 if they don't have anything in common).
      scriptName: StringSimilarity
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      similarity_threshold:
        complex:
          root: inputs.StringSimilarityThreshold
      similiarity_threshold:
        complex:
          root: inputs.StringSimilarityThreshold
      string_A:
        complex:
          root: PaloAltoNetworksXQL.GenericQuery.results
          accessor: cmd
          transformers:
          - operator: uniq
      string_B:
        complex:
          root: ProcessToSearch
          accessor: commands
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 8466e3c1-e48a-4093-8236-25689e23cb59
    type: regular
    task:
      id: 8466e3c1-e48a-4093-8236-25689e23cb59
      version: -1
      name: Delete context
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      key:
        simple: PaloAltoNetworksXQL
      subplaybook:
        simple: "yes"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 780,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 7243e1ff-bbc2-4958-8f6a-7d2c931e556f
    type: condition
    task:
      id: 7243e1ff-bbc2-4958-8f6a-7d2c931e556f
      version: -1
      name: Execution is suspicious?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: StringSimilarity
                accessor: StringA
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 38361085-b772-49bf-8d5d-b11f3ebab915
    type: regular
    task:
      id: 38361085-b772-49bf-8d5d-b11f3ebab915
      version: -1
      name: Set findings
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Findings
      value:
        complex:
          root: PaloAltoNetworksXQL.GenericQuery.results
          filters:
          - - operator: in
              left:
                value:
                  simple: PaloAltoNetworksXQL.GenericQuery.results.cmd
                iscontext: true
              right:
                value:
                  simple: StringSimilarity.StringA
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Tool Usage Found
      output:
        complex:
          root: PaloAltoNetworksXQL.GenericQuery.results
          filters:
          - - operator: in
              left:
                value:
                  simple: PaloAltoNetworksXQL.GenericQuery.results.cmd
                iscontext: true
              right:
                value:
                  simple: StringSimilarity.StringA
                iscontext: true
              ignorecase: true
          accessor: processname
    - incidentfield: Affected Hosts
      output:
        complex:
          root: PaloAltoNetworksXQL.GenericQuery.results
          filters:
          - - operator: in
              left:
                value:
                  simple: PaloAltoNetworksXQL.GenericQuery.results.cmd
                iscontext: true
              right:
                value:
                  simple: StringSimilarity.StringA
                iscontext: true
              ignorecase: true
          accessor: hostname
    - incidentfield: Affected Users
      output:
        complex:
          root: PaloAltoNetworksXQL.GenericQuery.results
          filters:
          - - operator: in
              left:
                value:
                  simple: PaloAltoNetworksXQL.GenericQuery.results.cmd
                iscontext: true
              right:
                value:
                  simple: StringSimilarity.StringA
                iscontext: true
              ignorecase: true
          accessor: username
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: e6f771d7-f624-49b6-813b-9784f2f3449d
    type: condition
    task:
      id: e6f771d7-f624-49b6-813b-9784f2f3449d
      version: -1
      name: Does XQL Query Engine integration enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cortex XDR - XQL Query Engine
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 5884cd87-5d89-4ef2-8469-a557b677cda1
    type: regular
    task:
      id: 5884cd87-5d89-4ef2-8469-a557b677cda1
      version: -1
      name: Execute query to search given process executions
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      query:
        complex:
          root: ProcessToSearch
          accessor: value
          transformers:
          - operator: StringifyArray
          - operator: replace
            args:
              limit: {}
              replaceWith: {}
              toReplace:
                value:
                  simple: '['
          - operator: replace
            args:
              limit: {}
              replaceWith: {}
              toReplace:
                value:
                  simple: ']'
          - operator: replace
            args:
              limit: {}
              replaceWith:
                value:
                  simple: ' OR action_process_image_name = '
              toReplace:
                value:
                  simple: ','
          - operator: concat
            args:
              prefix:
                value:
                  simple: "config case_sensitive = false\n| dataset = xdr_data  \n| filter action_process_image_name = "
              suffix:
                value:
                  simple: '| fields agent_hostname as hostname, actor_effective_username as username, action_process_image_name as processname, action_process_image_command_line as cmd'
      query_name:
        simple: hunt
      time_frame:
        complex:
          root: inputs.HuntingTimeFrame
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 780,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "3_6_#default#": 0.21,
      "7_6_#default#": 0.57
    },
    "paper": {
      "dimensions": {
        "height": 1555,
        "width": 1030,
        "x": 450,
        "y": -100
      }
    }
  }
inputs:
- key: Processes
  value: {}
  required: false
  description: |-
    Process name to search and command-line argument to compare. This input should receive an array that contains the following keys:
    - value: *process name*
    - commands: *command-line arguments*
  playbookInputQuery:
- key: HuntingTimeFrame
  value:
    simple: 7 days
  required: false
  description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.'
  playbookInputQuery:
- key: StringSimilarityThreshold
  value:
    simple: "0.5"
  required: false
  description: 'StringSimilarity automation threshold: A number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.'
  playbookInputQuery:
outputs:
- contextPath: StringSimilarity
  description: StringSimilarity automation results
  type: unknown
- contextPath: Findings
  description: Suspicious process executions found
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.9.0