FireEye HX - Execution Flow Indicators Hunting

This playbook queries FireEye Endpoint Security (HX) for execution flow indicators, including processes name, registry keys, registry values, and applications. Note that multiple search values should be separated by commas only (without spaces or any special characters).

FireEye HX · 26 tasks · 8 inputs · 19 outputs

Details

IDFireEye HX - Execution Flow Indicators Hunting
From Version6.5.0
Tasks26

README

This playbook queries FireEye Endpoint Security (HX) for execution flow indicators, including processes name, registry keys, registry values, and applications.

Note that multiple search values should be separated by commas only (without spaces or any special characters).

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • FireEyeHX v2

Scripts

  • SetAndHandleEmpty
  • IsIntegrationAvailable

Commands

  • fireeye-hx-search

Playbook Inputs

Name Description Default Value Required
Application Single or multiple application names or codes to search for within FireEye HX logs.
By default, the ‘contains’ clause is used.

Separate multiple search values by commas only (without spaces or any special characters).		   Optional
ProcessName A single or multiple process names to search for within FireEye HX logs.
By default, the ‘contains’ clause is used.

Separate multiple search values by commas only (without spaces or any special characters).		   Optional
RegistryKey A single or multiple registry keys to search for within FireEye HX logs.

Separate multiple search values by commas only (without spaces or any special characters).		   Optional
RegistryValue A single or multiple registry values to search for within FireEye HX logs.
By default, the ‘contains’ clause is used.

Separate multiple search values by commas only (without spaces or any special characters).		   Optional
hostSetName The name of host set to be searched.   Required
exhaustive Whether a search is exhaustive or quick.
Possible values are: yes, no. Default is yes.		   Optional
interval_in_seconds The interval in seconds between each poll. Default is 60.   Optional
limit Limits the results count (once the limit is reached, the search is stopped).   Optional

Playbook Outputs

Path Description Type
FireEyeHX.HuntingResults Email message objects and fields that were retrieved from FireEye HX. string
FireEyeHX.HuntingResults.Timestamp - Event The timestamp of the event. number
FireEyeHX.HuntingResults.Timestamp - Accessed The last accessed time. number
FireEyeHX.HuntingResults.Timestamp - Modified The time when the entry was last modified. number
FireEyeHX.HuntingResults.File Name The name of the file. string
FireEyeHX.HuntingResults.File Full Path The full path of the file. string
FireEyeHX.HuntingResults.DNS Hostname The name of the DNS host. string
FireEyeHX.HuntingResults.URL The event URL. string
FireEyeHX.HuntingResults.Username The event username. string
FireEyeHX.HuntingResults.File MD5 Hash The MD5 hash of the file. string
FireEyeHX.HuntingResults.Port The Port. number
FireEyeHX.HuntingResults.Process ID The ID of the process. string
FireEyeHX.HuntingResults.Local IP Address The local IP Address. string
FireEyeHX.HuntingResults.Local Port The local Port. number
FireEyeHX.HuntingResults.Remote Port The remote port. number
FireEyeHX.HuntingResults.IP Address The IP address. string
FireEyeHX.HuntingResults.Process Name The process name. string
FireEyeHX.HuntingResults.type The type of the event. string
FireEyeHX.HuntingResults.id The ID of the result. string

Playbook Image

FireEye HX - Execution Flow Indicators Hunting

Inputs

  • Application — Single or multiple application names or codes to search for within FireEye HX logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).
  • ProcessName — A single or multiple process names to search for within FireEye HX logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).
  • RegistryKey — A single or multiple registry keys to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
  • RegistryValue — A single or multiple registry values to search for within FireEye HX logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).
  • hostSetName — The name of host set to be searched.
  • exhaustive — Whether a search is exhaustive or quick. Possible values are: yes, no. Default is yes.
  • interval_in_seconds — The interval in seconds between each poll. Default is 60.
  • limit — Limits the results count (once the limit is reached, the search is stopped).

Outputs

  • FireEyeHX.HuntingResults — Email message objects and fields that were retrieved from FireEye HX.
  • FireEyeHX.HuntingResults.Timestamp - Event — The timestamp of the event.
  • FireEyeHX.HuntingResults.Timestamp - Accessed — The last accessed time.
  • FireEyeHX.HuntingResults.Timestamp - Modified — The time when the entry was last modified.
  • FireEyeHX.HuntingResults.File Name — The name of the file.
  • FireEyeHX.HuntingResults.File Full Path — The full path of the file.
  • FireEyeHX.HuntingResults.DNS Hostname — The name of the DNS host.
  • FireEyeHX.HuntingResults.URL — The event URL.
  • FireEyeHX.HuntingResults.Username — The event username.
  • FireEyeHX.HuntingResults.File MD5 Hash — The MD5 hash of the file.
  • FireEyeHX.HuntingResults.Port — The Port.
  • FireEyeHX.HuntingResults.Process ID — The ID of the process.
  • FireEyeHX.HuntingResults.Local IP Address — The local IP Address.
  • FireEyeHX.HuntingResults.Local Port — The local Port.
  • FireEyeHX.HuntingResults.Remote Port — The remote port.
  • FireEyeHX.HuntingResults.IP Address — The IP address.
  • FireEyeHX.HuntingResults.Process Name — The process name.
  • FireEyeHX.HuntingResults.type — The type of the event.
  • FireEyeHX.HuntingResults.id — The ID of the result.

Commands used

fireeye-hx-search

Flowchart

yes yes yes yes yes yes yes yes yes Start Start Application Indicators Application Indicators Done Done Is FireEye HX enabled? - IsIntegrationAvailable Is FireEye HX enabled? IsIntegrationAvailable Any applications to hunt for? Any applications to hunt ... FireEye HX Query - Applications - fireeye-hx-search FireEye HX Query - Applic... fireeye-hx-search Process Name Indicators Process Name Indicators Any process names to hunt for? Any process names to hunt... FireEye HX Query - Parent Process Name - fireeye-hx-search FireEye HX Query - Parent... fireeye-hx-search FireEye HX Query - Process Name - fireeye-hx-search FireEye HX Query - Proces... fireeye-hx-search Application Hunting Done Application Hunting Done Process Name Hunting Done Process Name Hunting Done Save Matching Results - Applications - SetAndHandleEmpty Save Matching Results - A... SetAndHandleEmpty Save Matching Results - Process Name - SetAndHandleEmpty Save Matching Results - P... SetAndHandleEmpty Remove Duplications From Matching Results - SetAndHandleEmpty Remove Duplications From ... SetAndHandleEmpty Save Matching Results - Parent Process name - SetAndHandleEmpty Save Matching Results - P... SetAndHandleEmpty FireEye HX Query - Registry Value - fireeye-hx-search FireEye HX Query - Regist... fireeye-hx-search Registry Value Indicators Registry Value Indicators Registry Key Indicators Registry Key Indicators Any registry values to hunt for? Any registry values to hu... Save Matching Results - Registry Value - SetAndHandleEmpty Save Matching Results - R... SetAndHandleEmpty Registry Value Hunting Done Registry Value Hunting Done Any registry keys to hunt for? Any registry keys to hunt... FireEye HX Query - Registry Key - fireeye-hx-search FireEye HX Query - Regist... fireeye-hx-search Save Matching Results - Registry Key - SetAndHandleEmpty Save Matching Results - R... SetAndHandleEmpty Registry Key Hunting Done Registry Key Hunting Done

Source

playbook-FireEye_HX_-_Execution_Flow_Indicators_Hunting.yml
Download History Raw 
id: FireEye HX - Execution Flow Indicators Hunting
version: -1
name: FireEye HX - Execution Flow Indicators Hunting
description: |-
  This playbook queries FireEye Endpoint Security (HX) for execution flow indicators, including processes name, registry keys, registry values, and applications.

  Note that multiple search values should be separated by commas only (without spaces or any special characters).
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a52d8420-7a8c-4987-866d-15dd05511bae
    type: start
    task:
      id: a52d8420-7a8c-4987-866d-15dd05511bae
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "56"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1750,
          "y": -340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 6d03ca44-9728-4044-879d-9c3228a1ed46
    type: title
    task:
      id: 6d03ca44-9728-4044-879d-9c3228a1ed46
      version: -1
      name: Application Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "107"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2050,
          "y": -40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: c9a4d741-cb13-4350-8973-b2514b1058e9
    type: title
    task:
      id: c9a4d741-cb13-4350-8973-b2514b1058e9
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1750,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: 3ba704c6-3573-47f4-8d53-ef1a0dd7dd71
    type: condition
    task:
      id: 3ba704c6-3573-47f4-8d53-ef1a0dd7dd71
      version: -1
      name: Is FireEye HX enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "118"
      - "14"
      - "155"
      - "156"
    scriptarguments:
      brandname:
        simple: FireEyeHX v2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1750,
          "y": -210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "107":
    id: "107"
    taskid: 3e8617cc-d465-4af2-81e4-7bb9ba502837
    type: condition
    task:
      id: 3e8617cc-d465-4af2-81e4-7bb9ba502837
      version: -1
      name: Any applications to hunt for?
      description: |
        Checks whether any application names are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "133"
      "yes":
      - "108"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Application
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2050,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "108":
    id: "108"
    taskid: 1cf825f5-39f9-4fa2-8871-f2c467e2b037
    type: regular
    task:
      id: 1cf825f5-39f9-4fa2-8871-f2c467e2b037
      version: -1
      name: FireEye HX Query - Applications
      description: Searches endpoints to check all hosts or a subset of hosts for a specific file or indicator.
      script: FireEyeHX v2|||fireeye-hx-search
      type: regular
      iscommand: true
      brand: FireEyeHX v2
    nexttasks:
      '#none#':
      - "149"
    scriptarguments:
      exhaustive:
        simple: "no"
      fieldSearchName:
        simple: Application Name
      fieldSearchOperator:
        simple: contains
      fieldSearchValue:
        complex:
          root: inputs.Application
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
      hostSetName:
        complex:
          root: inputs.hostSetName
      interval_in_seconds:
        complex:
          root: inputs.interval_in_seconds
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval_in_seconds
                iscontext: true
      limit:
        complex:
          root: inputs.limit
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.limit
                iscontext: true
      polling:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2290,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "118":
    id: "118"
    taskid: a898916f-a6c5-4358-8934-f88705079501
    type: title
    task:
      id: a898916f-a6c5-4358-8934-f88705079501
      version: -1
      name: Process Name Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "119"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2690,
          "y": -40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "119":
    id: "119"
    taskid: f9918545-750e-4e26-8eb5-ec7f65371633
    type: condition
    task:
      id: f9918545-750e-4e26-8eb5-ec7f65371633
      version: -1
      name: Any process names to hunt for?
      description: |
        Checks whether any process names are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "145"
      "yes":
      - "121"
      - "120"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.ProcessName
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2690,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "120":
    id: "120"
    taskid: 8fba3425-49a8-4862-82ff-9c2e40427d90
    type: regular
    task:
      id: 8fba3425-49a8-4862-82ff-9c2e40427d90
      version: -1
      name: FireEye HX Query - Parent Process Name
      description: Searches endpoints to check all hosts or a subset of hosts for a specific file or indicator.
      script: FireEyeHX v2|||fireeye-hx-search
      type: regular
      iscommand: true
      brand: FireEyeHX v2
    nexttasks:
      '#none#':
      - "153"
    scriptarguments:
      exhaustive:
        simple: "no"
      fieldSearchName:
        simple: Process Name
      fieldSearchOperator:
        simple: contains
      fieldSearchValue:
        complex:
          root: inputs.ProcessName
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
      hostSetName:
        complex:
          root: inputs.hostSetName
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.hostSetName
                iscontext: true
      interval_in_seconds:
        complex:
          root: inputs.interval_in_seconds
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval_in_seconds
                iscontext: true
      limit:
        complex:
          root: inputs.limit
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.limit
                iscontext: true
      polling:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2930,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "121":
    id: "121"
    taskid: 6de10b58-7f29-4eaa-80d6-4f301f161304
    type: regular
    task:
      id: 6de10b58-7f29-4eaa-80d6-4f301f161304
      version: -1
      name: FireEye HX Query - Process Name
      description: Searches endpoints to check all hosts or a subset of hosts for a specific file or indicator.
      script: FireEyeHX v2|||fireeye-hx-search
      type: regular
      iscommand: true
      brand: FireEyeHX v2
    nexttasks:
      '#none#':
      - "150"
    scriptarguments:
      exhaustive:
        complex:
          root: inputs.exhaustive
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "yes"
            - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "no"
      fieldSearchName:
        simple: Process Name
      fieldSearchOperator:
        simple: contains
      fieldSearchValue:
        complex:
          root: inputs.ProcessName
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
      hostSetName:
        complex:
          root: inputs.hostSetName
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.hostSetName
                iscontext: true
      interval_in_seconds:
        complex:
          root: inputs.interval_in_seconds
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval_in_seconds
                iscontext: true
      limit:
        complex:
          root: inputs.limit
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.limit
                iscontext: true
      polling:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3360,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "133":
    id: "133"
    taskid: 415ec2a5-fd28-4d51-8b6f-8b6d6c223017
    type: title
    task:
      id: 415ec2a5-fd28-4d51-8b6f-8b6d6c223017
      version: -1
      name: Application Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2050,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "145":
    id: "145"
    taskid: 9e29c944-074c-4142-8ac2-85f384c474a0
    type: title
    task:
      id: 9e29c944-074c-4142-8ac2-85f384c474a0
      version: -1
      name: Process Name Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2690,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "149":
    id: "149"
    taskid: d3ab7a54-dd52-48b5-8f0f-3e38d4774573
    type: regular
    task:
      id: d3ab7a54-dd52-48b5-8f0f-3e38d4774573
      version: -1
      name: Save Matching Results - Applications
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "133"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FireEyeHX.HuntingResults
      value:
        complex:
          root: FireEyeHX.Search.results
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.id
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2290,
          "y": 425
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "150":
    id: "150"
    taskid: 4c18d9e4-15d7-48b8-807d-dda56bcea1c8
    type: regular
    task:
      id: 4c18d9e4-15d7-48b8-807d-dda56bcea1c8
      version: -1
      name: Save Matching Results - Process Name
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "152"
    scriptarguments:
      key:
        simple: HuntingResults2
      value:
        complex:
          root: FireEyeHX.Search.results
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.Process ID
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.Process Name
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3360,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "152":
    id: "152"
    taskid: ed7679c0-51c2-4342-86d3-87fa059d2419
    type: regular
    task:
      id: ed7679c0-51c2-4342-86d3-87fa059d2419
      version: -1
      name: Remove Duplications From Matching Results
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "145"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FireEyeHX.HuntingResults
      value:
        complex:
          root: HuntingResults2
          filters:
          - - operator: notInList
              left:
                value:
                  simple: HuntingResults2.id
                iscontext: true
              right:
                value:
                  simple: FireEyeHX.HuntingResults.id
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3140,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "153":
    id: "153"
    taskid: 11b1693a-32d7-4bcb-8151-aa6459e4b5ae
    type: regular
    task:
      id: 11b1693a-32d7-4bcb-8151-aa6459e4b5ae
      version: -1
      name: Save Matching Results - Parent Process name
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "152"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FireEyeHX.HuntingResults
      value:
        complex:
          root: FireEyeHX.Search.results
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.Process ID
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.Process Name
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2930,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "154":
    id: "154"
    taskid: 624d003c-6113-4c63-8e0d-00df43aa191e
    type: regular
    task:
      id: 624d003c-6113-4c63-8e0d-00df43aa191e
      version: -1
      name: FireEye HX Query - Registry Value
      description: Searches endpoints to check all hosts or a subset of hosts for a specific file or indicator.
      script: FireEyeHX v2|||fireeye-hx-search
      type: regular
      iscommand: true
      brand: FireEyeHX v2
    nexttasks:
      '#none#':
      - "159"
    scriptarguments:
      exhaustive:
        complex:
          root: inputs.exhaustive
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "yes"
            - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "no"
      fieldSearchName:
        simple: Registry Key Value Text
      fieldSearchOperator:
        simple: contains
      fieldSearchValue:
        complex:
          root: inputs.RegistryValue
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
      hostSetName:
        complex:
          root: inputs.hostSetName
      interval_in_seconds:
        complex:
          root: inputs.interval_in_seconds
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval_in_seconds
                iscontext: true
      limit:
        complex:
          root: inputs.limit
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.limit
                iscontext: true
      polling:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1230,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "155":
    id: "155"
    taskid: 8cde1c5c-8798-4a55-8f3b-385bf3b115ff
    type: title
    task:
      id: 8cde1c5c-8798-4a55-8f3b-385bf3b115ff
      version: -1
      name: Registry Value Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "157"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1470,
          "y": -40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "156":
    id: "156"
    taskid: 6a34e553-c8bb-41b4-8339-63a086adf5cc
    type: title
    task:
      id: 6a34e553-c8bb-41b4-8339-63a086adf5cc
      version: -1
      name: Registry Key Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "161"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 830,
          "y": -40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "157":
    id: "157"
    taskid: 25f71361-72c3-4462-8f05-ff90e7b0c8be
    type: condition
    task:
      id: 25f71361-72c3-4462-8f05-ff90e7b0c8be
      version: -1
      name: Any registry values to hunt for?
      description: |
        Checks whether any registry values are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "160"
      "yes":
      - "154"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.RegistryValue
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1470,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "159":
    id: "159"
    taskid: fe85c4f9-9d63-4c56-8898-6bc100c5524f
    type: regular
    task:
      id: fe85c4f9-9d63-4c56-8898-6bc100c5524f
      version: -1
      name: Save Matching Results - Registry Value
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "160"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FireEyeHX.HuntingResults
      value:
        complex:
          root: FireEyeHX.Search.results
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.id
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1230,
          "y": 425
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "160":
    id: "160"
    taskid: 07a9fe38-6582-4ddc-8a9d-536935d33e43
    type: title
    task:
      id: 07a9fe38-6582-4ddc-8a9d-536935d33e43
      version: -1
      name: Registry Value Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1470,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "161":
    id: "161"
    taskid: 7b92bf7a-7982-4390-87ad-4686f4984d95
    type: condition
    task:
      id: 7b92bf7a-7982-4390-87ad-4686f4984d95
      version: -1
      name: Any registry keys to hunt for?
      description: |
        Checks whether any registry keys are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "165"
      "yes":
      - "163"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.RegistryKey
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 830,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "163":
    id: "163"
    taskid: 7d3c452c-fd22-4dfb-86ba-bf4f9d8d59e5
    type: regular
    task:
      id: 7d3c452c-fd22-4dfb-86ba-bf4f9d8d59e5
      version: -1
      name: FireEye HX Query - Registry Key
      description: Searches endpoints to check all hosts or a subset of hosts for a specific file or indicator.
      script: FireEyeHX v2|||fireeye-hx-search
      type: regular
      iscommand: true
      brand: FireEyeHX v2
    nexttasks:
      '#none#':
      - "164"
    scriptarguments:
      exhaustive:
        complex:
          root: inputs.exhaustive
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "yes"
            - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "no"
      fieldSearchName:
        simple: Registry Key Value Name
      fieldSearchOperator:
        simple: equals
      fieldSearchValue:
        complex:
          root: inputs.RegistryKey
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
      hostSetName:
        complex:
          root: inputs.hostSetName
      interval_in_seconds:
        complex:
          root: inputs.interval_in_seconds
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval_in_seconds
                iscontext: true
      limit:
        complex:
          root: inputs.limit
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.limit
                iscontext: true
      polling:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 590,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "164":
    id: "164"
    taskid: abc68d68-5960-43eb-84ce-78a283ff0e28
    type: regular
    task:
      id: abc68d68-5960-43eb-84ce-78a283ff0e28
      version: -1
      name: Save Matching Results - Registry Key
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "165"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FireEyeHX.HuntingResults
      value:
        complex:
          root: FireEyeHX.Search.results
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.id
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 590,
          "y": 425
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "165":
    id: "165"
    taskid: bc931338-7d3d-4727-82a5-10a3b95d3830
    type: title
    task:
      id: bc931338-7d3d-4727-82a5-10a3b95d3830
      version: -1
      name: Registry Key Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 830,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "157_160_#default#": 0.74,
      "56_118_yes": 0.74,
      "56_31_#default#": 0.71
    },
    "paper": {
      "dimensions": {
        "height": 1315,
        "width": 3150,
        "x": 590,
        "y": -340
      }
    }
  }
inputs:
- key: Application
  value: {}
  required: false
  description: |-
    Single or multiple application names or codes to search for within FireEye HX logs.
    By default, the 'contains' clause is used.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: ProcessName
  value: {}
  required: false
  description: |-
    A single or multiple process names to search for within FireEye HX logs.
    By default, the 'contains' clause is used.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: RegistryKey
  value: {}
  required: false
  description: |-
    A single or multiple registry keys to search for within FireEye HX logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: RegistryValue
  value: {}
  required: false
  description: |-
    A single or multiple registry values to search for within FireEye HX logs.
    By default, the 'contains' clause is used.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: hostSetName
  value: {}
  required: true
  description: The name of host set to be searched.
  playbookInputQuery:
- key: exhaustive
  value: {}
  required: false
  description: |-
    Whether a search is exhaustive or quick.
    Possible values are: yes, no. Default is yes.
  playbookInputQuery:
- key: interval_in_seconds
  value: {}
  required: false
  description: "The interval in seconds between each poll. Default is 60.\t"
  playbookInputQuery:
- key: limit
  value: {}
  required: false
  description: Limits the results count (once the limit is reached, the search is stopped).
  playbookInputQuery:
outputs:
- contextPath: FireEyeHX.HuntingResults
  description: Email message objects and fields that were retrieved from FireEye HX.
  type: string
- contextPath: FireEyeHX.HuntingResults.Timestamp - Event
  description: The timestamp of the event.
  type: number
- contextPath: FireEyeHX.HuntingResults.Timestamp - Accessed
  description: The last accessed time.
  type: number
- contextPath: FireEyeHX.HuntingResults.Timestamp - Modified
  description: The time when the entry was last modified.
  type: number
- contextPath: FireEyeHX.HuntingResults.File Name
  description: The name of the file.
  type: string
- contextPath: FireEyeHX.HuntingResults.File Full Path
  description: The full path of the file.
  type: string
- contextPath: FireEyeHX.HuntingResults.DNS Hostname
  description: The name of the DNS host.
  type: string
- contextPath: FireEyeHX.HuntingResults.URL
  description: The event URL.
  type: string
- contextPath: FireEyeHX.HuntingResults.Username
  description: The event username.
  type: string
- contextPath: FireEyeHX.HuntingResults.File MD5 Hash
  description: The MD5 hash of the file.
  type: string
- contextPath: FireEyeHX.HuntingResults.Port
  description: The Port.
  type: number
- contextPath: FireEyeHX.HuntingResults.Process ID
  description: The ID of the process.
  type: string
- contextPath: FireEyeHX.HuntingResults.Local IP Address
  description: The local IP Address.
  type: string
- contextPath: FireEyeHX.HuntingResults.Local Port
  description: The local Port.
  type: number
- contextPath: FireEyeHX.HuntingResults.Remote Port
  description: The remote port.
  type: number
- contextPath: FireEyeHX.HuntingResults.IP Address
  description: The IP address.
  type: string
- contextPath: FireEyeHX.HuntingResults.Process Name
  description: The process name.
  type: string
- contextPath: FireEyeHX.HuntingResults.type
  description: The type of the event.
  type: string
- contextPath: FireEyeHX.HuntingResults.id
  description: The ID of the result.
  type: string
tests:
- No tests (auto formatted)
fromversion: 6.5.0