Endpoint data collection Deprecated Hidden

Deprecated. Generic playbook to collect data from endpoints for IR purposes. Will use whichever integrations are configured and available.

Deprecated Content (Deprecated) · 7 tasks · 2 inputs · 0 outputs

Details

ID	`Endpoint data collection`
From Version	5.0.0
Tasks	7

README

Deprecated. Collects data from endpoints for IR purposes. Will use whichever integrations are configured and available.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

D2 - Endpoint data collection
Sentinel One - Endpoint data collection
MAR - Endpoint data collection

Integrations

This playbook does not use any integrations.

Scripts

AreValuesEqual

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
UseD2		False	Optional
Hostname		-	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Endpoint_data_collection

Inputs

UseD2 —
Hostname —

Flowchart

Source

playbook-Endpoint_data_collection.yml

Download History Raw

id: Endpoint data collection
version: -1
name: Endpoint data collection
fromversion: "5.0.0"
description: Deprecated. Generic playbook to collect data from endpoints for IR purposes. Will use whichever integrations are configured and available.
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: 5c790e9c-edcd-4ad9-8a35-05451eb582df
    type: start
    task:
      id: 5c790e9c-edcd-4ad9-8a35-05451eb582df
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 50
        }
      }
  "1":
    id: "1"
    taskid: b2c6a043-bedf-40e9-8b34-064891fa6597
    type: condition
    task:
      id: b2c6a043-bedf-40e9-8b34-064891fa6597
      version: -1
      name: Use D2 agent?
      scriptName: AreValuesEqual
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    scriptarguments:
      left:
        simple: ${inputs.UseD2}
      right:
        simple: "True"
    results:
    - AreValuesEqual
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
  "2":
    id: "2"
    taskid: 8c9dec86-a668-4e3e-8824-075fe18330ac
    type: playbook
    task:
      id: 8c9dec86-a668-4e3e-8824-075fe18330ac
      version: -1
      name: D2 - Endpoint data collection
      description: |-
        Uses Demisto's d2 agent to collect data from an endpoint for IR purposes.

        Input:
        * Hostname (default: ${Endpoint.Hostname})
        * OS (default: windows)
        * Credentials (default: Admin)
        * Path (default: None)
      playbookName: D2 - Endpoint data collection
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Credentials:
        simple: Admin
      Host:
        simple: ${inputs.Hostname}
      OS:
        simple: windows
      Path: {}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 50,
          "y": 515
        }
      }
  "3":
    id: "3"
    taskid: dbfc8aa8-e3e8-4b03-8a20-2dc0edf62cae
    type: title
    task:
      id: dbfc8aa8-e3e8-4b03-8a20-2dc0edf62cae
      version: -1
      name: EDR products
      type: title
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "10"
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 370
        }
      }
    note: false
    timertriggers: []
  "8":
    id: "8"
    taskid: a726afff-a81d-4588-865c-f8085a6f41c2
    type: title
    task:
      id: a726afff-a81d-4588-865c-f8085a6f41c2
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 690
        }
      }
    note: false
    timertriggers: []
  "10":
    id: "10"
    taskid: 3359e593-8218-4132-8a69-d48fc9aa78a7
    type: playbook
    task:
      id: e70f5c75-4cb1-430c-8660-b01ad288ddec
      version: -1
      name: MAR - Endpoint data collection
      playbookName: MAR - Endpoint data collection
      type: playbook
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Hostname:
        simple: ${inputs.Hostname}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 480,
          "y": 515
        }
      }
    note: false
    timertriggers: []
  "11":
    id: "11"
    taskid: 121a30fb-c5ea-41d3-86db-e9753c08ada7
    type: playbook
    task:
      id: 121a30fb-c5ea-41d3-86db-e9753c08ada7
      version: -1
      name: Sentinel One - Endpoint data collection
      playbookName: Sentinel One - Endpoint data collection
      type: playbook
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Hostname:
        simple: ${inputs.Hostname}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 960,
          "y": 515
        }
      }
    note: false
    timertriggers: []
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 705,
        "width": 1290,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: UseD2
  value:
    simple: "False"
  required: false
  description: ""
- key: Hostname
  value: {}
  required: false
  description: ""
outputs: []
tests:
- No tests - Need to add
deprecated: true