CrowdStrike Falcon - Search Endpoints By Hash

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook searches across the organization for other endpoints associated with a specific SHA256/MD5/SHA1 hash.

CrowdStrike Falcon · 19 tasks · 4 inputs · 10 outputs

Details

IDCrowdStrike Falcon - Search Endpoints By Hash
From Version6.5.0
Tasks19

README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook searches across the organization for other endpoints associated with a specific SHA256/MD5/SHA1 hash.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

CrowdStrikeFalcon

Scripts

IsIntegrationAvailable

Commands

  • cs-falcon-device-count-ioc
  • cs-falcon-device-ran-on
  • endpoint

Playbook Inputs

Name Description Default Value Required
FileSha256 The SHA256 file hash to search for.   Optional
HostId The ID of the host that originated the detection.   Optional
SHA1 The SHA1 file hash to search for.   Optional
MD5 The MD5 file hash to search for.   Optional

Playbook Outputs

Path Description Type
Endpoint Additional hosts that have the hash present. string
CrowdStrike.IOC.DeviceCount The number of devices the IOC ran on. number
Endpoint.Hostname The endpoint’s hostname. unknown
CrowdStrike.IOC.Type The type of the IOC. unknown
Endpoint.IPAddress The endpoint’s IP address. unknown
CrowdStrike.IOC.Value The string representation of the indicator. unknown
Endpoint.OS The endpoint operation system. unknown
Endpoint.Status The endpoint status. unknown
Endpoint.IsIsolated The endpoint isolation status. unknown
CrowdStrike.DeviceID Device IDs an indicator ran on. unknown

Playbook Image

CrowdStrike Falcon - Search Endpoints By Hash

Inputs

  • FileSha256 — The SHA256 file hash to search for.
  • HostId — The ID of the host that originated the detection.
  • SHA1 — The SHA1 file hash to search for.
  • MD5 — The MD5 file hash to search for.

Outputs

  • Endpoint — Additional hosts that have the hash present.
  • CrowdStrike.IOC.DeviceCount — The number of devices the IOC ran on.
  • Endpoint.Hostname — The endpoint's hostname.
  • CrowdStrike.IOC.Type — The type of the IOC.
  • Endpoint.IPAddress — The endpoint's IP address or list of IP addresses.
  • CrowdStrike.IOC.Value — The string representation of the indicator.
  • Endpoint.OS — The endpoint operation system.
  • Endpoint.Status — The endpoint status.
  • Endpoint.IsIsolated — The endpoint isolation status.
  • CrowdStrike.DeviceID — Device IDs an indicator ran on.

Commands used

cs-falcon-device-count-ioc cs-falcon-device-ran-on endpoint

Flowchart

no yes yes yes yes yes yes no no Start Start Get device ID list by SHA1 - cs-falcon-device-ran-on Get device ID list by SHA1 cs-falcon-device-ran-on Count devices in the environment by SHA256 - cs-falcon-device-count-ioc Count devices in the envi... cs-falcon-device-count-ioc Done Done Should enrich the returned results? Should enrich the returne... Enrich endpoint details for non original host - endpoint Enrich endpoint details f... endpoint Is CrowdStrike Falcon enabled? - IsIntegrationAvailable Is CrowdStrike Falcon ena... IsIntegrationAvailable SHA256 SHA256 SHA1 SHA1 MD5 MD5 Count devices in the environment by SHA1 - cs-falcon-device-count-ioc Count devices in the envi... cs-falcon-device-count-ioc Count devices in the environment by MD5 - cs-falcon-device-count-ioc Count devices in the envi... cs-falcon-device-count-ioc Is there any MD5? Is there any MD5? Is there any SHA1? Is there any SHA1? Is there any SHA256? Is there any SHA256? Get device id list by MD5 - cs-falcon-device-ran-on Get device id list by MD5 cs-falcon-device-ran-on Get device id list by SHA256 - cs-falcon-device-ran-on Get device id list by SHA256 cs-falcon-device-ran-on Should enrich the returned results? Should enrich the returne... Should enrich the returned results? Should enrich the returne...

Source

playbook-CrowdStrike_Falcon_-_Search_Endpoints_By_Hash.yml
Download History Raw 
id: CrowdStrike Falcon - Search Endpoints By Hash
version: -1
fromversion: 6.5.0
name: CrowdStrike Falcon - Search Endpoints By Hash
description: "This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. \nThis playbook searches across the organization for other endpoints associated with a specific SHA256/MD5/SHA1 hash."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: fdebf4c2-18fa-45ad-8931-a1df035a26d8
    type: start
    task:
      id: fdebf4c2-18fa-45ad-8931-a1df035a26d8
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": -90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 9ce410b8-ddde-4690-8625-2cfab080cd83
    type: regular
    task:
      id: 9ce410b8-ddde-4690-8625-2cfab080cd83
      version: -1
      name: Get device ID list by SHA1
      description: Returns a list of device IDs that the indicator ran on.
      script: '|||cs-falcon-device-ran-on'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      type:
        simple: sha1
      value:
        complex:
          root: inputs.SHA1
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 830,
          "y": 950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 04610f87-fee9-4de1-8980-1649f61b38d0
    type: regular
    task:
      id: 04610f87-fee9-4de1-8980-1649f61b38d0
      version: -1
      name: Count devices in the environment by SHA256
      description: The number of hosts that observed the provided IOC.
      script: '|||cs-falcon-device-count-ioc'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      type:
        simple: sha256
      value:
        complex:
          root: inputs.FileSha256
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 0204bfc2-fc2d-483c-869b-8f85d0580b31
    type: title
    task:
      id: 0204bfc2-fc2d-483c-869b-8f85d0580b31
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 9b555544-59aa-45db-81b2-a12eb98fc56e
    type: condition
    task:
      id: 9b555544-59aa-45db-81b2-a12eb98fc56e
      version: -1
      name: Should enrich the returned results?
      description: "If the hash was found on additional hosts the playbook will enrich the endpoint details.\nIn case we provided a host ID and there is no additional endpoints that were found, the playbook will stop and finish without the enrichment."
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "16"
      "no":
      - "3"
    separatecontext: false
    conditions:
    - label: "no"
      condition:
      - - operator: lessThanOrEqual
          left:
            value:
              simple: CrowdStrike.IOC.DeviceCount
            iscontext: true
          right:
            value:
              simple: "1"
        - operator: isNotExists
          left:
            value:
              simple: CrowdStrike.IOC.DeviceCount
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.HostId
                transformers:
                - operator: If-Then-Else
                  args:
                    condition:
                      value:
                        simple: lhs==rhs
                    conditionB: {}
                    conditionInBetween: {}
                    else:
                      value:
                        simple: inputs.HostId
                      iscontext: true
                    equals: {}
                    lhs:
                      value:
                        simple: CrowdStrike.IOC.DeviceCount
                      iscontext: true
                    lhsB: {}
                    options: {}
                    optionsB: {}
                    rhs: {}
                    rhsB: {}
                    then:
                      value:
                        simple: 'return empty string'
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 420,
          "y": 760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: f7a79437-c0fa-4613-84fa-22581196d8ef
    type: regular
    task:
      id: f7a79437-c0fa-4613-84fa-22581196d8ef
      version: -1
      name: Enrich endpoint details for non original host
      description: Returns information about an endpoint.
      script: '|||endpoint'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      id:
        complex:
          root: CrowdStrike.DeviceID
          filters:
          - - operator: notInList
              left:
                value:
                  simple: CrowdStrike.DeviceID
                iscontext: true
              right:
                value:
                  simple: inputs.HostId
                iscontext: true
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 830,
          "y": 1120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 13169d17-92b3-4cbf-8930-86e9b5d6f265
    type: condition
    task:
      id: 13169d17-92b3-4cbf-8930-86e9b5d6f265
      version: -1
      name: Is CrowdStrike Falcon enabled?
      description: Returns 'yes' if the integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "10"
      - "9"
      - "8"
    scriptarguments:
      brandname:
        simple: CrowdstrikeFalcon
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: dbbe5796-a11a-4682-8355-d62b43d44498
    type: title
    task:
      id: dbbe5796-a11a-4682-8355-d62b43d44498
      version: -1
      name: SHA256
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 1e898ed2-5266-4f3e-81fa-101c8497e8ab
    type: title
    task:
      id: 1e898ed2-5266-4f3e-81fa-101c8497e8ab
      version: -1
      name: SHA1
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 830,
          "y": 250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: f9e430dd-d528-4fc6-8266-6bb1678b7d57
    type: title
    task:
      id: f9e430dd-d528-4fc6-8266-6bb1678b7d57
      version: -1
      name: MD5
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 420,
          "y": 250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: e1e46c37-8e78-40f8-811e-06f7b0cd2294
    type: regular
    task:
      id: e1e46c37-8e78-40f8-811e-06f7b0cd2294
      version: -1
      name: Count devices in the environment by SHA1
      description: The number of hosts that observed the provided IOC.
      script: '|||cs-falcon-device-count-ioc'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      type:
        simple: sha1
      value:
        complex:
          root: inputs.SHA1
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 830,
          "y": 580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 7a424a6a-334c-412c-843a-863643c14b36
    type: regular
    task:
      id: 7a424a6a-334c-412c-843a-863643c14b36
      version: -1
      name: Count devices in the environment by MD5
      description: The number of hosts that observed the provided IOC.
      script: '|||cs-falcon-device-count-ioc'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      type:
        simple: md5
      value:
        complex:
          root: inputs.MD5
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 420,
          "y": 580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: b930b6ef-bb8c-417e-88a8-d5cecabb228d
    type: condition
    task:
      id: b930b6ef-bb8c-417e-88a8-d5cecabb228d
      version: -1
      name: Is there any MD5?
      description: Are there any MD5 files provided?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.MD5
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 420,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 169383f7-4adc-460a-8cf3-125b8422fecc
    type: condition
    task:
      id: 169383f7-4adc-460a-8cf3-125b8422fecc
      version: -1
      name: Is there any SHA1?
      description: Are there any SHA1 files provided?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA1
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 830,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 2334a9cf-94c0-4b2c-81fc-90330616c546
    type: condition
    task:
      id: 2334a9cf-94c0-4b2c-81fc-90330616c546
      version: -1
      name: Is there any SHA256?
      description: Are there any SHA256 files provided?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileSha256
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 88326013-5240-41bd-8987-6452a1d73e3c
    type: regular
    task:
      id: 88326013-5240-41bd-8987-6452a1d73e3c
      version: -1
      name: Get device id list by MD5
      description: Returns a list of device IDs that the indicator ran on.
      script: '|||cs-falcon-device-ran-on'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      type:
        simple: md5
      value:
        complex:
          root: inputs.MD5
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 420,
          "y": 950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 89e8a9f8-2b7c-4d41-89e6-06dd3a90561d
    type: regular
    task:
      id: 89e8a9f8-2b7c-4d41-89e6-06dd3a90561d
      version: -1
      name: Get device id list by SHA256
      description: Returns a list of device IDs that the indicator ran on.
      script: '|||cs-falcon-device-ran-on'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      type:
        simple: sha256
      value:
        complex:
          root: inputs.FileSha256
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: a69c0320-8da4-4f7d-8c06-e1b3733e544f
    type: condition
    task:
      id: a69c0320-8da4-4f7d-8c06-e1b3733e544f
      version: -1
      name: Should enrich the returned results?
      description: "If the hash was found on additional hosts the playbook will enrich the endpoint details.\nIn case we provided a host ID and there is no additional endpoints that were found, the playbook will stop and finish without the enrichment."
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "1"
      "no":
      - "3"
    separatecontext: false
    conditions:
    - label: "no"
      condition:
      - - operator: lessThanOrEqual
          left:
            value:
              simple: CrowdStrike.IOC.DeviceCount
            iscontext: true
          right:
            value:
              simple: "1"
        - operator: isNotExists
          left:
            value:
              simple: CrowdStrike.IOC.DeviceCount
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.HostId
                transformers:
                - operator: If-Then-Else
                  args:
                    condition:
                      value:
                        simple: lhs==rhs
                    conditionB: {}
                    conditionInBetween: {}
                    else:
                      value:
                        simple: inputs.HostId
                      iscontext: true
                    equals: {}
                    lhs:
                      value:
                        simple: CrowdStrike.IOC.DeviceCount
                      iscontext: true
                    lhsB: {}
                    options: {}
                    optionsB: {}
                    rhs: {}
                    rhsB: {}
                    then:
                      value:
                        simple: 'return empty string'
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 830,
          "y": 760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: d61e2bb3-62ba-4eaa-850f-e4c4e0ab3342
    type: condition
    task:
      id: d61e2bb3-62ba-4eaa-850f-e4c4e0ab3342
      version: -1
      name: Should enrich the returned results?
      description: "If the hash was found on additional hosts the playbook will enrich the endpoint details.\nIn case we provided a host ID and there is no additional endpoints that were found, the playbook will stop and finish without the enrichment. "
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "17"
      "no":
      - "3"
    separatecontext: false
    conditions:
    - label: "no"
      condition:
      - - operator: lessThanOrEqual
          left:
            value:
              simple: CrowdStrike.IOC.DeviceCount
            iscontext: true
          right:
            value:
              simple: "1"
        - operator: isNotExists
          left:
            value:
              simple: CrowdStrike.IOC.DeviceCount
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.HostId
                transformers:
                - operator: If-Then-Else
                  args:
                    condition:
                      value:
                        simple: lhs==rhs
                    conditionB: {}
                    conditionInBetween: {}
                    else:
                      value:
                        simple: inputs.HostId
                      iscontext: true
                    equals: {}
                    lhs:
                      value:
                        simple: CrowdStrike.IOC.DeviceCount
                      iscontext: true
                    lhsB: {}
                    options: {}
                    optionsB: {}
                    rhs: {}
                    rhsB: {}
                    then:
                      value:
                        simple: 'return empty string'
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "13_12_yes": 0.54,
      "13_3_#default#": 0.2,
      "14_11_yes": 0.54,
      "14_3_#default#": 0.14,
      "15_2_yes": 0.5,
      "15_3_#default#": 0.11,
      "18_3_no": 0.2,
      "19_3_no": 0.14,
      "4_3_no": 0.34,
      "6_10_yes": 0.48,
      "6_3_#default#": 0.14,
      "6_8_yes": 0.78,
      "6_9_yes": 0.68
    },
    "paper": {
      "dimensions": {
        "height": 1445,
        "width": 1450,
        "x": 170,
        "y": -90
      }
    }
  }
inputs:
- key: FileSha256
  value: {}
  required: false
  description: The SHA256 file hash to search for.
  playbookInputQuery:
- key: HostId
  value: {}
  required: false
  description: The ID of the host that originated the detection.
  playbookInputQuery:
- key: SHA1
  value: {}
  required: false
  description: The SHA1 file hash to search for.
  playbookInputQuery:
- key: MD5
  value: {}
  required: false
  description: The MD5 file hash to search for.
  playbookInputQuery:
outputs:
- contextPath: Endpoint
  description: Additional hosts that have the hash present.
  type: string
- contextPath: CrowdStrike.IOC.DeviceCount
  description: The number of devices the IOC ran on.
  type: number
- contextPath: Endpoint.Hostname
  description: The endpoint's hostname.
- contextPath: CrowdStrike.IOC.Type
  description: The type of the IOC.
- contextPath: Endpoint.IPAddress
  description: The endpoint's IP address or list of IP addresses.
- contextPath: CrowdStrike.IOC.Value
  description: The string representation of the indicator.
- contextPath: Endpoint.OS
  description: The endpoint operation system.
- contextPath: Endpoint.Status
  description: The endpoint status.
- contextPath: Endpoint.IsIsolated
  description: The endpoint isolation status.
- contextPath: CrowdStrike.DeviceID
  description: Device IDs an indicator ran on.
tests:
- No tests (auto formatted)
contentitemexportablefields:
  contentitemfields: {}
system: true
marketplaces:
- xsoar
# Should not appear in marketplacev2