CrowdStrike Falcon - Search Endpoints By Indicators

This playbooks searches for different indicators (IP,IPV6,File hashes,Domain) in the crowdstrike falcon console. The output will be all the endpoints found associated with provided indicators. Provided agent id as an input will be excluded from the returned list.

CrowdStrike Falcon · 21 tasks · 7 inputs · 10 outputs

Details

ID	`CrowdStrike Falcon - Search Endpoints By Indicators`
From Version	6.10.0
Tasks	21

README

This playbooks searches for different indicators (IP,IPV6,File hashes,Domain) in the crowdstrike falcon console. The output will be all the endpoitns found associated with provided indicators. Provided agent id as an input will be excluded from the returned list.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

CrowdStrike Falcon - Search Endpoints By Hash

Integrations

CrowdStrikeFalcon
CrowdstrikeFalcon

Scripts

IsIntegrationAvailable

Commands

cs-falcon-device-count-ioc
cs-falcon-device-ran-on
endpoint

Playbook Inputs

Name	Description	Default Value	Required
FileSha256	The SHA256 file hash to search for.		Optional
HostId	The host ID which will be excluded from the results.		Optional
SHA1	The SHA1 file hash to search for.		Optional
MD5	The MD5 file hash to search for.		Optional
IP	The IPV4 indicator to search for.	8.8.8.8	Optional
Domain	The Domain Indicator to search for.		Optional
IPV6	The IPv6 Indicator to search for.		Optional

Playbook Outputs

Path	Description	Type
Endpoint	Additional hosts that have the hash present.	string
CrowdStrike.IOC.DeviceCount	The number of devices the IOC ran on.	number
Endpoint.Hostname	The endpoint’s hostname.	unknown
CrowdStrike.IOC.Type	The type of the IOC.	unknown
Endpoint.IPAddress	The endpoint’s IP address.	unknown
CrowdStrike.IOC.Value	The string representation of the indicator.	unknown
Endpoint.OS	The endpoint operation system.	unknown
Endpoint.Status	The endpoint status.	unknown
Endpoint.IsIsolated	The endpoint isolation status.	unknown
CrowdStrike.DeviceID	Device IDs an indicator ran on.	unknown

Playbook Image

CrowdStrike Falcon - Search Endpoints By Indicators

Inputs

FileSha256 — The SHA256 file hash to search for.
HostId — The host ID which will be excluded from the results.
SHA1 — The SHA1 file hash to search for.
MD5 — The MD5 file hash to search for.
IP — The IPV4 indicator to search for.
Domain — The domain indicator to search for.
IPV6 — The IPv6 indicator to search for.

Outputs

Endpoint — Additional hosts that have the hash present.
CrowdStrike.IOC.DeviceCount — The number of devices the IOC ran on.
Endpoint.Hostname — The endpoint's hostname.
CrowdStrike.IOC.Type — The type of the IOC.
Endpoint.IPAddress — The endpoint's IP address.
CrowdStrike.IOC.Value — The string representation of the indicator.
Endpoint.OS — The endpoint operation system.
Endpoint.Status — The endpoint status.
Endpoint.IsIsolated — The endpoint isolation status.
CrowdStrike.DeviceID — Device IDs an indicator ran on.

Commands used

cs-falcon-device-count-ioc cs-falcon-device-ran-on endpoint

Flowchart

Source

playbook-CrowdStrike_Falcon_-_Search_Endpoints_By_Indicators.yml

Download History Raw

contentitemexportablefields:
  contentitemfields:
    propagationLabels:
    - all
id: CrowdStrike Falcon - Search Endpoints By Indicators
inputSections:
- description: Generic group for inputs.
  inputs:
  - FileSha256
  - HostId
  - SHA1
  - MD5
  - IP
  - Domain
  - IPV6
  name: General (Inputs group)
inputs:
- description: The SHA256 file hash to search for.
  key: FileSha256
  playbookInputQuery:
  required: false
  value: {}
- description: The host ID which will be excluded from the results.
  key: HostId
  playbookInputQuery:
  required: false
  value: {}
- description: The SHA1 file hash to search for.
  key: SHA1
  playbookInputQuery:
  required: false
  value: {}
- description: The MD5 file hash to search for.
  key: MD5
  playbookInputQuery:
  required: false
  value: {}
- description: The IPV4 indicator to search for.
  key: IP
  playbookInputQuery:
  required: false
  value: {}
- description: The domain indicator to search for.
  key: Domain
  playbookInputQuery:
  required: false
  value: {}
- description: The IPv6 indicator to search for.
  key: IPV6
  playbookInputQuery:
  required: false
  value: {}
name: CrowdStrike Falcon - Search Endpoints By Indicators
outputSections:
- description: Generic group for outputs.
  name: General (Outputs group)
  outputs:
  - Endpoint
  - CrowdStrike.IOC.DeviceCount
  - Endpoint.Hostname
  - CrowdStrike.IOC.Type
  - Endpoint.IPAddress
  - CrowdStrike.IOC.Value
  - Endpoint.OS
  - Endpoint.Status
  - Endpoint.IsIsolated
  - CrowdStrike.DeviceID
outputs:
- contextPath: Endpoint
  description: Additional hosts that have the hash present.
  type: string
- contextPath: CrowdStrike.IOC.DeviceCount
  description: The number of devices the IOC ran on.
  type: number
- contextPath: Endpoint.Hostname
  description: The endpoint's hostname.
- contextPath: CrowdStrike.IOC.Type
  description: The type of the IOC.
- contextPath: Endpoint.IPAddress
  description: The endpoint's IP address.
- contextPath: CrowdStrike.IOC.Value
  description: The string representation of the indicator.
- contextPath: Endpoint.OS
  description: The endpoint operation system.
- contextPath: Endpoint.Status
  description: The endpoint status.
- contextPath: Endpoint.IsIsolated
  description: The endpoint isolation status.
- contextPath: CrowdStrike.DeviceID
  description: Device IDs an indicator ran on.
starttaskid: "0"
tasks:
  "0":
    continueonerrortype: ""
    id: "0"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "6"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: fdebf4c2-18fa-45ad-8931-a1df035a26d8
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: fdebf4c2-18fa-45ad-8931-a1df035a26d8
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 170,
          "y": -90
        }
      }
  "1":
    continueonerrortype: ""
    id: "1"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "5"
    note: false
    quietmode: 0
    scriptarguments:
      type:
        simple: ipv6
      value:
        complex:
          root: inputs.IPV6
          transformers:
          - operator: uniq
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Returns a list of device IDs that the indicator ran on.
      id: 356a79b4-71c3-4d9b-8e02-84e0b8a308b5
      iscommand: true
      name: Get device ID list by IPv6
      script: '|||cs-falcon-device-ran-on'
      type: regular
      version: -1
    taskid: 356a79b4-71c3-4d9b-8e02-84e0b8a308b5
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 830,
          "y": 950
        }
      }
  "2":
    continueonerrortype: ""
    id: "2"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "19"
    note: false
    quietmode: 0
    scriptarguments:
      type:
        simple: domain
      value:
        complex:
          root: inputs.Domain
          transformers:
          - operator: uniq
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: The number of hosts that observed the provided IOC.
      id: b676297a-78a5-452a-8bef-ab48df93ecbe
      iscommand: true
      name: Count devices in the environment by Domain
      script: '|||cs-falcon-device-count-ioc'
      type: regular
      version: -1
    taskid: b676297a-78a5-452a-8bef-ab48df93ecbe
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 580
        }
      }
  "3":
    continueonerrortype: ""
    id: "3"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 0204bfc2-fc2d-483c-869b-8f85d0580b31
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 0204bfc2-fc2d-483c-869b-8f85d0580b31
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1290
        }
      }
  "4":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: CrowdStrike.IOC.DeviceCount
          operator: lessThanOrEqual
          right:
            value:
              simple: "1"
        - left:
            iscontext: true
            value:
              simple: CrowdStrike.IOC.DeviceCount
          operator: isNotExists
      - - left:
            iscontext: true
            value:
              complex:
                root: inputs.HostId
                transformers:
                - args:
                    condition:
                      value:
                        simple: lhs==rhs
                    conditionB: {}
                    conditionInBetween: {}
                    else:
                      iscontext: true
                      value:
                        simple: inputs.HostId
                    equals: {}
                    lhs:
                      iscontext: true
                      value:
                        simple: CrowdStrike.IOC.DeviceCount
                    lhsB: {}
                    options: {}
                    optionsB: {}
                    rhs: {}
                    rhsB: {}
                    then:
                      value:
                        simple: return empty string
                  operator: If-Then-Else
          operator: isNotEmpty
      label: "no"
    continueonerrortype: ""
    id: "4"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - "16"
      "no":
      - "3"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: |-
        If the hash was found on additional hosts the playbook will enrich the endpoint details.
        In case we provided a host ID and there is no additional endpoints that were found, the playbook will stop and finish without the enrichment.
      id: 9b555544-59aa-45db-81b2-a12eb98fc56e
      iscommand: false
      name: Should enrich the returned results?
      type: condition
      version: -1
    taskid: 9b555544-59aa-45db-81b2-a12eb98fc56e
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 420,
          "y": 760
        }
      }
  "5":
    continueonerrortype: ""
    id: "5"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "3"
    note: false
    quietmode: 0
    scriptarguments:
      id:
        complex:
          filters:
          - - left:
                iscontext: true
                value:
                  simple: CrowdStrike.DeviceID
              operator: notInList
              right:
                iscontext: true
                value:
                  simple: inputs.HostId
          root: CrowdStrike.DeviceID
          transformers:
          - operator: uniq
    separatecontext: false
    skipunavailable: false
    task:
      brand: CrowdstrikeFalcon
      description: Returns information about an endpoint. Does not support regex.
      id: 08a3bbe2-93b6-4bc5-8f50-8b2f3e9cdd9d
      iscommand: true
      name: Enrich endpoint details for non-original host
      script: CrowdstrikeFalcon|||endpoint
      type: regular
      version: -1
    taskid: 08a3bbe2-93b6-4bc5-8f50-8b2f3e9cdd9d
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 830,
          "y": 1120
        }
      }
  "6":
    continueonerrortype: ""
    id: "6"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "10"
      - "9"
      - "8"
      - "21"
    note: false
    quietmode: 0
    scriptarguments:
      brandname:
        simple: CrowdstrikeFalcon
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Returns 'yes' if the integration brand is available. Otherwise returns 'no'.
      id: 13169d17-92b3-4cbf-8930-86e9b5d6f265
      iscommand: false
      name: Is CrowdStrike Falcon enabled?
      scriptName: IsIntegrationAvailable
      type: condition
      version: -1
    taskid: 13169d17-92b3-4cbf-8930-86e9b5d6f265
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 170,
          "y": 50
        }
      }
  "8":
    continueonerrortype: ""
    id: "8"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "15"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 7a763ee5-b65c-46c3-85e9-41611d8d19c8
      iscommand: false
      name: Domain
      type: title
      version: -1
      description: ''
    taskid: 7a763ee5-b65c-46c3-85e9-41611d8d19c8
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 250
        }
      }
  "9":
    continueonerrortype: ""
    id: "9"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "14"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 241f5911-0490-410b-82df-e4b1e4ccaab5
      iscommand: false
      name: IPv6
      type: title
      version: -1
      description: ''
    taskid: 241f5911-0490-410b-82df-e4b1e4ccaab5
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 830,
          "y": 250
        }
      }
  "10":
    continueonerrortype: ""
    id: "10"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "13"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 1bac08d1-e57a-4fa9-84ed-d50fc504eed4
      iscommand: false
      name: IP
      type: title
      version: -1
      description: ''
    taskid: 1bac08d1-e57a-4fa9-84ed-d50fc504eed4
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 420,
          "y": 250
        }
      }
  "11":
    continueonerrortype: ""
    id: "11"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "18"
    note: false
    quietmode: 0
    scriptarguments:
      type:
        simple: ipv6
      value:
        complex:
          root: inputs.IPV6
          transformers:
          - operator: uniq
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: The number of hosts that observed the provided IOC.
      id: 60f0efcc-0d06-4ddc-8d36-1c3fb03f4b96
      iscommand: true
      name: Count devices in the environment by IPV6
      script: '|||cs-falcon-device-count-ioc'
      type: regular
      version: -1
    taskid: 60f0efcc-0d06-4ddc-8d36-1c3fb03f4b96
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 830,
          "y": 580
        }
      }
  "12":
    continueonerrortype: ""
    id: "12"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "4"
    note: false
    quietmode: 0
    scriptarguments:
      type:
        simple: ipv4
      value:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: The number of hosts that observed the provided IOC.
      id: 94e6ed7d-3aed-40aa-855e-b79340d8b87b
      iscommand: true
      name: Count devices in the environment by IP
      script: '|||cs-falcon-device-count-ioc'
      type: regular
      version: -1
    taskid: 94e6ed7d-3aed-40aa-855e-b79340d8b87b
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 420,
          "y": 580
        }
      }
  "13":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: inputs.IP
                transformers:
                - operator: uniq
          operator: isNotEmpty
          right:
            value: {}
      label: "yes"
    continueonerrortype: ""
    id: "13"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "12"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Are there any MD5 files provided?
      id: ed0ee4a1-37e9-4c0d-8b83-0737bc1c2e52
      iscommand: false
      name: Is there any IP?
      type: condition
      version: -1
    taskid: ed0ee4a1-37e9-4c0d-8b83-0737bc1c2e52
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 420,
          "y": 390
        }
      }
  "14":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: inputs.IPV6
                transformers:
                - operator: uniq
          operator: isNotEmpty
          right:
            value: {}
      label: "yes"
    continueonerrortype: ""
    id: "14"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "11"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Are there any SHA1 files provided?
      id: 5e693dcb-ae0a-4871-87de-95f456ce072c
      iscommand: false
      name: Is there any IPV6?
      type: condition
      version: -1
    taskid: 5e693dcb-ae0a-4871-87de-95f456ce072c
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 830,
          "y": 390
        }
      }
  "15":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: inputs.Domain
                transformers:
                - operator: uniq
          operator: isNotEmpty
          right:
            value: {}
      label: "yes"
    continueonerrortype: ""
    id: "15"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Are there any SHA256 files provided?
      id: 1bd17b6b-4847-4f38-8d4a-51cb86c69892
      iscommand: false
      name: Is there any Domain?
      type: condition
      version: -1
    taskid: 1bd17b6b-4847-4f38-8d4a-51cb86c69892
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 390
        }
      }
  "16":
    continueonerrortype: ""
    id: "16"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "5"
    note: false
    quietmode: 0
    scriptarguments:
      type:
        simple: ipv4
      value:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Returns a list of device IDs that the indicator ran on.
      id: 5ab63abd-adf6-4b65-8324-31348720f4a2
      iscommand: true
      name: Get device ID list by IP
      script: '|||cs-falcon-device-ran-on'
      type: regular
      version: -1
    taskid: 5ab63abd-adf6-4b65-8324-31348720f4a2
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 420,
          "y": 950
        }
      }
  "17":
    continueonerrortype: ""
    id: "17"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "5"
    note: false
    quietmode: 0
    scriptarguments:
      type:
        simple: domain
      value:
        complex:
          root: inputs.Domain
          transformers:
          - operator: uniq
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Returns a list of device IDs that the indicator ran on.
      id: 334db2c7-c5f9-451f-8565-ab0a5495c664
      iscommand: true
      name: Get device ID list by Domain
      script: '|||cs-falcon-device-ran-on'
      type: regular
      version: -1
    taskid: 334db2c7-c5f9-451f-8565-ab0a5495c664
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 950
        }
      }
  "18":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: CrowdStrike.IOC.DeviceCount
          operator: lessThanOrEqual
          right:
            value:
              simple: "1"
        - left:
            iscontext: true
            value:
              simple: CrowdStrike.IOC.DeviceCount
          operator: isNotExists
      - - left:
            iscontext: true
            value:
              complex:
                root: inputs.HostId
                transformers:
                - args:
                    condition:
                      value:
                        simple: lhs==rhs
                    conditionB: {}
                    conditionInBetween: {}
                    else:
                      iscontext: true
                      value:
                        simple: inputs.HostId
                    equals: {}
                    lhs:
                      iscontext: true
                      value:
                        simple: CrowdStrike.IOC.DeviceCount
                    lhsB: {}
                    options: {}
                    optionsB: {}
                    rhs: {}
                    rhsB: {}
                    then:
                      value:
                        simple: return empty string
                  operator: If-Then-Else
          operator: isNotEmpty
      label: "no"
    continueonerrortype: ""
    id: "18"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - "1"
      "no":
      - "3"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: |-
        If the hash was found on additional hosts the playbook will enrich the endpoint details.
        In case we provided a host ID and there is no additional endpoints that were found, the playbook will stop and finish without the enrichment.
      id: a69c0320-8da4-4f7d-8c06-e1b3733e544f
      iscommand: false
      name: Should enrich the returned results?
      type: condition
      version: -1
    taskid: a69c0320-8da4-4f7d-8c06-e1b3733e544f
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 830,
          "y": 760
        }
      }
  "19":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: CrowdStrike.IOC.DeviceCount
          operator: lessThanOrEqual
          right:
            value:
              simple: "1"
        - left:
            iscontext: true
            value:
              simple: CrowdStrike.IOC.DeviceCount
          operator: isNotExists
      - - left:
            iscontext: true
            value:
              complex:
                root: inputs.HostId
                transformers:
                - args:
                    condition:
                      value:
                        simple: lhs==rhs
                    conditionB: {}
                    conditionInBetween: {}
                    else:
                      iscontext: true
                      value:
                        simple: inputs.HostId
                    equals: {}
                    lhs:
                      iscontext: true
                      value:
                        simple: CrowdStrike.IOC.DeviceCount
                    lhsB: {}
                    options: {}
                    optionsB: {}
                    rhs: {}
                    rhsB: {}
                    then:
                      value:
                        simple: return empty string
                  operator: If-Then-Else
          operator: isNotEmpty
      label: "no"
    continueonerrortype: ""
    id: "19"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - "17"
      "no":
      - "3"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: "If the hash was found on additional hosts the playbook will enrich the endpoint details.\nIn case we provided a host ID and there is no additional endpoints that were found, the playbook will stop and finish without the enrichment. "
      id: d61e2bb3-62ba-4eaa-850f-e4c4e0ab3342
      iscommand: false
      name: Should enrich the returned results?
      type: condition
      version: -1
    taskid: d61e2bb3-62ba-4eaa-850f-e4c4e0ab3342
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 760
        }
      }
  "20":
    continueonerrortype: ""
    id: "20"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "3"
    note: false
    quietmode: 0
    scriptarguments:
      FileSha256:
        simple: ${inputs.FileSha256}
      HostId:
        simple: ${inputs.HostId}
      MD5:
        simple: ${inputs.MD5}
      SHA1:
        simple: ${inputs.SHA1}
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      description: "This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. \nThis playbook searches across the organization for other endpoints associated with a specific SHA256/MD5/SHA1 hash."
      id: e58490bd-bf66-4153-8181-ba7267d07c25
      iscommand: false
      name: CrowdStrike Falcon - Search Endpoints By Hash
      playbookId: CrowdStrike Falcon - Search Endpoints By Hash
      type: playbook
      version: -1
    taskid: e58490bd-bf66-4153-8181-ba7267d07c25
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 1690,
          "y": 950
        }
      }
  "21":
    continueonerrortype: ""
    id: "21"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "20"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 5b3d3782-289a-4741-8414-0d6519a1bdde
      iscommand: false
      name: File Hashes
      type: title
      version: -1
      description: ''
    taskid: 5b3d3782-289a-4741-8414-0d6519a1bdde
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1690,
          "y": 250
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "13_12_yes": 0.54,
      "13_3_#default#": 0.2,
      "14_11_yes": 0.54,
      "14_3_#default#": 0.14,
      "15_2_yes": 0.5,
      "15_3_#default#": 0.11,
      "18_3_no": 0.2,
      "19_3_no": 0.14,
      "4_3_no": 0.34,
      "6_10_yes": 0.48,
      "6_3_#default#": 0.14,
      "6_8_yes": 0.78,
      "6_9_yes": 0.68
    },
    "paper": {
      "dimensions": {
        "height": 1445,
        "width": 1900,
        "x": 170,
        "y": -90
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.10.0
description: This playbooks searches for different indicators (IP,IPV6,File hashes,Domain) in the crowdstrike falcon console. The output will be all the endpoints found associated with provided indicators. Provided agent id as an input will be excluded from the returned list.
marketplaces:
- xsoar
# Should not appear in marketplacev2