Endpoint Enrichment - Generic v2.1

Enrich an endpoint by hostname using one or more integrations. Supported integrations: - Active Directory Query v2 - McAfee ePolicy Orchestrator - Carbon Black Enterprise Response v2 - Cylance Protect v2 - CrowdStrike Falcon Host - ExtraHop Reveal(x) - Endpoint reputation using !endpoint command

Common Playbooks · 28 tasks · 4 inputs · 45 outputs

Inputs

  • Hostname — The hostname of the endpoint to enrich.
  • UseReputationCommand — Define if you would like to use the !endpoint command. Note: This input should be used whenever there is no auto-extract enabled in the investigation flow. Possible values: True / False.
  • IPAddress — The IP address of the endpoint to enrich.
  • EndpointID — The endpoint ID of the endpoint to enrich.

Outputs

  • Endpoint — The endpoint object of the endpoint that was enriched.
  • Endpoint.Hostname — The hostnames of the endpoints that were enriched.
  • Endpoint.OS — The operating systems running on the endpoints that were enriched.
  • Endpoint.IP — A list of the IP addresses of the endpoints.
  • Endpoint.MAC — A list of the MAC addresses of the endpoints that were enriched.
  • Endpoint.Domain — The domain names of the endpoints that were enriched.
  • CylanceProtectDevice — The device information about the hostname that was enriched using Cylance Protect v2.
  • ExtraHop.Device.Macaddr — The MAC Address of the device.
  • ExtraHop.Device.DeviceClass — The class of the device.
  • ExtraHop.Device.UserModTime — The time of the most recent update, expressed in milliseconds since the epoch.
  • ExtraHop.Device.AutoRole — The role automatically detected by the ExtraHop.
  • ExtraHop.Device.ParentId — The ID of the parent device.
  • ExtraHop.Device.Vendor — The device vendor.
  • ExtraHop.Device.Analysis — The level of analysis preformed on the device.
  • ExtraHop.Device.DiscoveryId — The UUID given by the Discover appliance.
  • ExtraHop.Device.DefaultName — The default name of the device.
  • ExtraHop.Device.DisplayName — The display name of device.
  • ExtraHop.Device.OnWatchlist — Whether the device is on the advanced analysis allow list.
  • ExtraHop.Device.ModTime — The time of the most recent update, expressed in milliseconds since the epoch.
  • ExtraHop.Device.IsL3 — Indicates whether the device is a Layer 3 device.
  • ExtraHop.Device.Role — The role of the device.
  • ExtraHop.Device.DiscoverTime — The time that the device was discovered.
  • ExtraHop.Device.Id — The ID of the device.
  • ExtraHop.Device.Ipaddr4 — The IPv4 address of the device.
  • ExtraHop.Device.Vlanid — The ID of VLan.
  • ExtraHop.Device.Ipaddr6 — The IPv6 address of the device.
  • ExtraHop.Device.NodeId — The Node ID of the Discover appliance.
  • ExtraHop.Device.Description — A user customizable description of the device.
  • ExtraHop.Device.DnsName — The DNS name associated with the device.
  • ExtraHop.Device.DhcpName — The DHCP name associated with the device.
  • ExtraHop.Device.CdpName — The Cisco Discovery Protocol name associated with the device.
  • ExtraHop.Device.NetbiosName — The NetBIOS name associated with the device.
  • ExtraHop.Device.Url — Link to the device details page in ExtraHop.
  • Endpoint.IPAddress — The endpoint IP address or list of IP addresses.
  • Endpoint.ID — The endpoint ID.
  • Endpoint.Status — The endpoint status.
  • Endpoint.IsIsolated — The endpoint isolation status.
  • Endpoint.MACAddress — The endpoint MAC address.
  • Endpoint.Vendor — The integration name of the endpoint vendor.
  • ActiveDirectory.Computers — The information about the hostname that was enriched using Active Directory.
  • ActiveDirectory.Computers.dn — The computer distinguished name.
  • ActiveDirectory.Computers.memberOf — Groups for which the computer is listed.
  • ActiveDirectory.Computers.name — The computer name.
  • Endpoint.Groups — Groups for which the computer is listed as a member.
  • ActiveDirectory.ComputersPageCookie — An opaque string received in a paged search, used for requesting subsequent entries.

Commands used

ad-get-computer cb-sensor-info cs-device-details cs-device-search endpoint epo-find-system extrahop-device-search

Flowchart

yes yes yes yes yes yes yes yes yes yes yes Start Start Endpoint Products Endpoint Products Is McAfee ePolicy Orchestrator enabled? - Exists Is McAfee ePolicy Orchest... Exists Is there an endpoint to enrich? Is there an endpoint to e... Done Done Get host information from McAfee ePO - epo-find-system Get host information from... epo-find-system Is Carbon Black Enterprise Response enabled? - Exists Is Carbon Black Enterpris... Exists Get host information from Carbon Black Enterprise Response - cb-sensor-info Get host information from... cb-sensor-info Is CrowdStrike Falcon Host enabled? - Exists Is CrowdStrike Falcon Hos... Exists McAfee ePolicy Orchestrator McAfee ePolicy Orchestrator Carbon Black Enterprise Response Carbon Black Enterprise R... Cylance Protect v2 Cylance Protect v2 CrowdStrike Falcon Host CrowdStrike Falcon Host Is Active Directory Query v2 enabled? Is Active Directory Query... Get host information from Active Directory - ad-get-computer Get host information from... ad-get-computer Active Directory Active Directory Endpoint Enrichment - Cylance Protect v2 - Endpoint Enrichment - Cylance Protect v2 Endpoint Enrichment - Cyl... Endpoint Enrichment - Cylance... Get Crowdstrike device ID - cs-device-search Get Crowdstrike device ID cs-device-search Was a device ID found? Was a device ID found? Get host information from Crowdstrike Falcon Host - cs-device-details Get host information from... cs-device-details ExtraHop Reveal(x) ExtraHop Reveal(x) Is ExtraHop Reveal(x) enabled? - Exists Is ExtraHop Reveal(x) ena... Exists Get host information from ExtraHop Reveal(x) - extrahop-device-search Get host information from... extrahop-device-search is Mcafee ePolicy Orchestrator v2 enabled is Mcafee ePolicy Orchest... Get- host information from McAfee ePO v2 - epo-find-system Get- host information fro... epo-find-system Endpoint Reputation Endpoint Reputation Should use !endpoint command? Should use !endpoint comm... Check Reputation - endpoint Check Reputation endpoint