FireEye HX - File Indicators Hunting

This playbook queries FireEye Endpoint Security (HX) for file indicators, including MD5 hashes, SHA256 hashes, SHA1 hashes, file names, file paths, and file types. Note that multiple search values should be separated by commas only (without spaces or any special characters).

FireEye HX · 36 tasks · 10 inputs · 19 outputs

Inputs

  • FileName — A single or multiple file names to search for FireEye HX logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).
  • SHA256 — A single or multiple SHA256 file hashes to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
  • SHA1 — A single or multiple SHA1 file hashes to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
  • FilePath — A single or multiple file paths to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
  • FileType — A single or multiple file types to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
  • MD5 — A single or multiple MD5 file hashes to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
  • hostSetName — The name of host set to be searched. Separate multiple search values by commas only (without spaces or any special characters).
  • exhaustive — Whether a search is exhaustive or quick. Possible values are: yes, no. Default is yes.
  • interval_in_seconds — The interval in seconds between each poll. Default is 60.
  • limit — Limits the results count (once the limit is reached, the search is stopped).

Outputs

  • FireEyeHX.HuntingResults — Email message objects and fields that were retrieved from FireEye HX.
  • FireEyeHX.HuntingResults.Timestamp - Event — The timestamp of the event.
  • FireEyeHX.HuntingResults.Timestamp - Accessed — The last accessed time.
  • FireEyeHX.HuntingResults.Timestamp - Modified — The time when the entry was last modified.
  • FireEyeHX.HuntingResults.File Name — The name of the file.
  • FireEyeHX.HuntingResults.File Full Path — The full path of the file.
  • FireEyeHX.HuntingResults.DNS Hostname — The name of the DNS host.
  • FireEyeHX.HuntingResults.URL — The event URL.
  • FireEyeHX.HuntingResults.Username — The event username.
  • FireEyeHX.HuntingResults.File MD5 Hash — The MD5 hash of the file.
  • FireEyeHX.HuntingResults.Port — The Port.
  • FireEyeHX.HuntingResults.Process ID — The ID of the process.
  • FireEyeHX.HuntingResults.Local IP Address — The local IP Address.
  • FireEyeHX.HuntingResults.Local Port — The local Port.
  • FireEyeHX.HuntingResults.Remote Port — The remote port.
  • FireEyeHX.HuntingResults.IP Address — The IP address.
  • FireEyeHX.HuntingResults.Process Name — The process name.
  • FireEyeHX.HuntingResults.type — The type of the event.
  • FireEyeHX.HuntingResults.id — The ID of the result.

Commands used

fireeye-hx-search

Flowchart

yes yes yes yes yes yes yes yes yes yes yes yes yes Start Start Done Done Is FireEye HX enabled? - IsIntegrationAvailable Is FireEye HX enabled? IsIntegrationAvailable File Name Indicators File Name Indicators Any file names to hunt for? Any file names to hunt for? FireEye HX Query - File Name - fireeye-hx-search FireEye HX Query - File Name fireeye-hx-search FireEye HX Query - SHA256 - fireeye-hx-search FireEye HX Query - SHA256 fireeye-hx-search SHA256 Indicators SHA256 Indicators Any SHA1 to hunt for? Any SHA1 to hunt for? Any SHA256 to hunt for? Any SHA256 to hunt for? SHA1 Indicators SHA1 Indicators FireEye HX Query - SHA1 - fireeye-hx-search FireEye HX Query - SHA1 fireeye-hx-search File Path Indicators File Path Indicators Any file paths to hunt for? Any file paths to hunt for? FireEye HX Query - File Path - fireeye-hx-search FireEye HX Query - File Path fireeye-hx-search File Name Hunting Done File Name Hunting Done File Path Hunting Done File Path Hunting Done SHA1 Hunting Done SHA1 Hunting Done MD5 Indicators MD5 Indicators SHA256 Hunting Done SHA256 Hunting Done MD5 Hunting Done MD5 Hunting Done Any MD5 to hunt for? Any MD5 to hunt for? FireEye HX Query - MD5 - fireeye-hx-search FireEye HX Query - MD5 fireeye-hx-search File Type Indicators File Type Indicators Any file types to hunt for? Any file types to hunt for? FireEye HX Query - File Download Type - fireeye-hx-search FireEye HX Query - File D... fireeye-hx-search File Type Hunting Done File Type Hunting Done FireEye HX Query - Executable PE type - fireeye-hx-search FireEye HX Query - Execut... fireeye-hx-search Save Matching Results - Executable PE type - SetAndHandleEmpty Save Matching Results - E... SetAndHandleEmpty Save Matching Results - File Download Type - SetAndHandleEmpty Save Matching Results - F... SetAndHandleEmpty Remove Duplications From Matching Results - SetAndHandleEmpty Remove Duplications From ... SetAndHandleEmpty Save Matching Results - File Name - SetAndHandleEmpty Save Matching Results - F... SetAndHandleEmpty Save Matching Results - File Path - SetAndHandleEmpty Save Matching Results - F... SetAndHandleEmpty Save Matching Results - SHA1 - SetAndHandleEmpty Save Matching Results - SHA1 SetAndHandleEmpty Save Matching Results - SHA256 - SetAndHandleEmpty Save Matching Results - S... SetAndHandleEmpty Save Matching Results - MD5 - SetAndHandleEmpty Save Matching Results - MD5 SetAndHandleEmpty