CrowdStrike Falcon - Get Endpoint Forensics Data

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook extracts data from the host using RTR commands. For example, commands for getting a list of running processes and network connections.

CrowdStrike Falcon · 9 tasks · 1 input · 3 outputs

Details

ID	`CrowdStrike Falcon - Get Endpoint Forensics Data`
From Version	6.5.0
Tasks	9

README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook extracts data from the host using RTR commands. For example, commands for getting a list of running processes and network connections.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

CrowdStrikeFalcon

Scripts

This playbook does not use any scripts.

Commands

cs-falcon-search-device
cs-falcon-rtr-list-network-stats
cs-falcon-rtr-list-processes

Playbook Inputs

Name	Description	Default Value	Required
DeviceId	The ID of the host to use.		Optional

Playbook Outputs

Path	Description	Type
CrowdStrike.Command	The results of the forensics commands.	string
CrowdStrike.Device	CrowdStrike Device’s information.	unknown
Endpoint	Device’s information.	unknown

Playbook Image

CrowdStrike Falcon - Get Endpoint Forensics Data

Inputs

DeviceId — The ID of the host to use.

Outputs

CrowdStrike.Command — The results of the forensics commands.
CrowdStrike.Device — CrowdStrike Device's information.
Endpoint — Device's information.

Commands used

cs-falcon-rtr-list-network-stats cs-falcon-rtr-list-processes cs-falcon-search-device setIncident

Flowchart

Source

playbook-CrowdStrike_Falcon_-_Get_Endpoint_Forensics_Data.yml

Download History Raw

id: CrowdStrike Falcon - Get Endpoint Forensics Data
version: -1
description: |-
  This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
  This playbook extracts data from the host using RTR commands. For example, commands for getting a list of running processes and network connections.
fromversion: 6.5.0
name: CrowdStrike Falcon - Get Endpoint Forensics Data
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 91130fbd-2e6e-4816-825e-3d3eb630cea8
    type: start
    task:
      id: 91130fbd-2e6e-4816-825e-3d3eb630cea8
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 740,
          "y": -680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '3':
    id: '3'
    taskid: 48450f6a-9b2d-481b-8844-e16ac557dfca
    type: regular
    task:
      id: 48450f6a-9b2d-481b-8844-e16ac557dfca
      version: -1
      name: List processes
      description: Executes a RTR active-responder ps command to get a list of active processes across the given host.
      script: '|||cs-falcon-rtr-list-processes'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '5'
    scriptarguments:
      host_id:
        simple: ${inputs.DeviceId}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": 300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '4':
    id: '4'
    taskid: 36e343d9-fef3-4656-8c31-1d284c9e5476
    type: regular
    task:
      id: 36e343d9-fef3-4656-8c31-1d284c9e5476
      version: -1
      name: List network connections
      description: Executes a RTR active-responder netstat command to get a list of network status and protocol statistics across the given host.
      script: '|||cs-falcon-rtr-list-network-stats'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '5'
    scriptarguments:
      host_id:
        simple: ${inputs.DeviceId}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 960,
          "y": 300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '5':
    id: '5'
    taskid: 0bd570e4-be9b-4078-85c3-b3327f53134d
    type: title
    task:
      id: 0bd570e4-be9b-4078-85c3-b3327f53134d
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 740,
          "y": 480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "6":
    id: "6"
    taskid: f1d5ee51-377a-499a-85bf-14bc1b816d5c
    type: condition
    task:
      id: f1d5ee51-377a-499a-85bf-14bc1b816d5c
      version: -1
      name: Check if the device is online
      description: Check if the device is online
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "3"
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Endpoint.Status
            iscontext: true
          right:
            value:
              simple: Online
          ignorecase: true
      - - operator: in
          left:
            value:
              simple: Endpoint.ID
            iscontext: true
          right:
            value:
              simple: inputs.DeviceId
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 740,
          "y": 130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: fc7c593b-2e96-40de-8d2e-1a29f22325d3
    type: condition
    task:
      id: fc7c593b-2e96-40de-8d2e-1a29f22325d3
      version: -1
      name: Check if device ID provided
      description: Check if device ID provided
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.DeviceId
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 740,
          "y": -550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: e6b26677-133f-4eb5-8b9a-33d85675a350
    type: regular
    task:
      id: e6b26677-133f-4eb5-8b9a-33d85675a350
      version: -1
      name: Get Device Status
      description: Searches for a device that matches the query.
      script: '|||cs-falcon-search-device'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      ids:
        complex:
          root: inputs.DeviceId
          transformers:
          - operator: uniq
          - operator: append
            args:
              item:
                value:
                  simple: Provide an Endpoint ID.Answers.0
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 740,
          "y": -35
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 30e8ac38-3a63-43f7-8a36-eb9b807f2015
    type: collection
    task:
      id: 30e8ac38-3a63-43f7-8a36-eb9b807f2015
      version: -1
      name: Provide an Endpoint ID
      description: Provide an Endpoint ID
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": -370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Which endpoints would you like to enrich?
        required: true
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Provide an Endpoint ID
      description: This incident contains no endpoint IDs. Please provide single or multiple endpoint IDs to proceed with endpoint enrichment.
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 7b1c7d74-71a4-46e3-871e-ea7a118a314d
    type: regular
    task:
      id: 7b1c7d74-71a4-46e3-871e-ea7a118a314d
      version: -1
      name: Set the endpoint IDs to the incident field
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      agentsid:
        complex:
          root: Provide an Endpoint ID.Answers.0
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: Provide an Endpoint ID.Answers.0
                iscontext: true
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": -210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1225,
        "width": 850,
        "x": 490,
        "y": -680
      }
    }
  }
inputs:
- key: DeviceId
  value: {}
  required: false
  description: The ID of the host to use.
  playbookInputQuery:
outputs:
- contextPath: CrowdStrike.Command
  description: The results of the forensics commands.
  type: string
- contextPath: CrowdStrike.Device
  description: CrowdStrike Device's information.
  type: unknown
- contextPath: Endpoint
  description: Device's information.
  type: unknown
tests:
- Test Playbook - CrowdStrike Falcon - Get Endpoint Forensics Data
- Test - CrowdStrike Falcon
contentitemexportablefields:
  contentitemfields: {}
system: true
marketplaces:
- xsoar
# Should not appear in marketplacev2