FireEye HX - File Indicators Hunting

This playbook queries FireEye Endpoint Security (HX) for file indicators, including MD5 hashes, SHA256 hashes, SHA1 hashes, file names, file paths, and file types. Note that multiple search values should be separated by commas only (without spaces or any special characters).

FireEye HX · 36 tasks · 10 inputs · 19 outputs

Details

ID	`FireEye HX - File Indicators Hunting`
From Version	6.5.0
Tasks	36

README

This playbook queries FireEye Endpoint Security (HX) for file indicators, including MD5 hashes, SHA256 hashes, SHA1 hashes, file names, file paths, and file types.

Note that multiple search values should be separated by commas only (without spaces or any special characters).

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

FireEyeHX v2

Scripts

IsIntegrationAvailable
SetAndHandleEmpty

Commands

fireeye-hx-search

Playbook Inputs

Name	Description	Required
FileName	A single or multiple file names to search for FireEye HX logs. By default, the ‘contains’ clause is used. Separate multiple search values by commas only (without spaces or any special characters).	Optional
SHA256	A single or multiple SHA256 file hashes to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).	Optional
SHA1	A single or multiple SHA1 file hashes to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).	Optional
FilePath	A single or multiple file paths to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).	Optional
FileType	A single or multiple file types to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).	Optional
MD5	A single or multiple MD5 file hashes to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).	Optional
hostSetName	The name of host set to be searched. Separate multiple search values by commas only (without spaces or any special characters).	Required
exhaustive	Whether a search is exhaustive or quick. Possible values are: yes, no. Default is yes.	Optional
interval_in_seconds	The interval in seconds between each poll. Default is 60.	Optional
limit	Limits the results count (once the limit is reached, the search is stopped).	Optional

Playbook Outputs

Path	Description	Type
FireEyeHX.HuntingResults	Email message objects and fields that were retrieved from FireEye HX.	string
FireEyeHX.HuntingResults.Timestamp - Event	The timestamp of the event.	number
FireEyeHX.HuntingResults.Timestamp - Accessed	The last accessed time.	number
FireEyeHX.HuntingResults.Timestamp - Modified	The time when the entry was last modified.	number
FireEyeHX.HuntingResults.File Name	The name of the file.	string
FireEyeHX.HuntingResults.File Full Path	The full path of the file.	string
FireEyeHX.HuntingResults.DNS Hostname	The name of the DNS host.	string
FireEyeHX.HuntingResults.URL	The event URL.	string
FireEyeHX.HuntingResults.Username	The event username.	string
FireEyeHX.HuntingResults.File MD5 Hash	The MD5 hash of the file.	string
FireEyeHX.HuntingResults.Port	The Port.	string
FireEyeHX.HuntingResults.Process ID	The ID of the process.	string
FireEyeHX.HuntingResults.Local IP Address	The local IP Address.	string
FireEyeHX.HuntingResults.Local Port	The local Port.	number
FireEyeHX.HuntingResults.Remote Port	The remote port.	number
FireEyeHX.HuntingResults.IP Address	The IP address.	string
FireEyeHX.HuntingResults.Process Name	The process name.	string
FireEyeHX.HuntingResults.type	The type of the event.	string
FireEyeHX.HuntingResults.id	The ID of the result.	string

Playbook Image

FireEye HX - File Indicators Hunting

Inputs

FileName — A single or multiple file names to search for FireEye HX logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).
SHA256 — A single or multiple SHA256 file hashes to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
SHA1 — A single or multiple SHA1 file hashes to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
FilePath — A single or multiple file paths to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
FileType — A single or multiple file types to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
MD5 — A single or multiple MD5 file hashes to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
hostSetName — The name of host set to be searched. Separate multiple search values by commas only (without spaces or any special characters).
exhaustive — Whether a search is exhaustive or quick. Possible values are: yes, no. Default is yes.
interval_in_seconds — The interval in seconds between each poll. Default is 60.
limit — Limits the results count (once the limit is reached, the search is stopped).

Outputs

FireEyeHX.HuntingResults — Email message objects and fields that were retrieved from FireEye HX.
FireEyeHX.HuntingResults.Timestamp - Event — The timestamp of the event.
FireEyeHX.HuntingResults.Timestamp - Accessed — The last accessed time.
FireEyeHX.HuntingResults.Timestamp - Modified — The time when the entry was last modified.
FireEyeHX.HuntingResults.File Name — The name of the file.
FireEyeHX.HuntingResults.File Full Path — The full path of the file.
FireEyeHX.HuntingResults.DNS Hostname — The name of the DNS host.
FireEyeHX.HuntingResults.URL — The event URL.
FireEyeHX.HuntingResults.Username — The event username.
FireEyeHX.HuntingResults.File MD5 Hash — The MD5 hash of the file.
FireEyeHX.HuntingResults.Port — The Port.
FireEyeHX.HuntingResults.Process ID — The ID of the process.
FireEyeHX.HuntingResults.Local IP Address — The local IP Address.
FireEyeHX.HuntingResults.Local Port — The local Port.
FireEyeHX.HuntingResults.Remote Port — The remote port.
FireEyeHX.HuntingResults.IP Address — The IP address.
FireEyeHX.HuntingResults.Process Name — The process name.
FireEyeHX.HuntingResults.type — The type of the event.
FireEyeHX.HuntingResults.id — The ID of the result.

Commands used

fireeye-hx-search

Flowchart

Source

playbook-FireEye_HX_-_File_Indicators_Hunting.yml

Download History Raw

id: FireEye HX - File Indicators Hunting
version: -1
name: FireEye HX - File Indicators Hunting
description: |-
  This playbook queries FireEye Endpoint Security (HX) for file indicators, including MD5 hashes, SHA256 hashes, SHA1 hashes, file names, file paths, and file types.

  Note that multiple search values should be separated by commas only (without spaces or any special characters).
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a52d8420-7a8c-4987-866d-15dd05511bae
    type: start
    task:
      id: a52d8420-7a8c-4987-866d-15dd05511bae
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "56"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2570,
          "y": -360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: c9a4d741-cb13-4350-8973-b2514b1058e9
    type: title
    task:
      id: c9a4d741-cb13-4350-8973-b2514b1058e9
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2570,
          "y": 930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: d6c06566-378b-495f-8c0e-aaa7dd6dc516
    type: condition
    task:
      id: d6c06566-378b-495f-8c0e-aaa7dd6dc516
      version: -1
      name: Is FireEye HX enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "129"
      - "111"
      - "127"
      - "123"
      - "156"
      - "170"
    scriptarguments:
      brandname:
        simple: FireEyeHX v2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2570,
          "y": -220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "111":
    id: "111"
    taskid: 9d79fcf5-bb7e-4fea-829c-6f2aa7614381
    type: title
    task:
      id: 9d79fcf5-bb7e-4fea-829c-6f2aa7614381
      version: -1
      name: File Name Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "112"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1680,
          "y": -40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "112":
    id: "112"
    taskid: 6361f3d7-a338-448b-8f27-e01619deca10
    type: condition
    task:
      id: 6361f3d7-a338-448b-8f27-e01619deca10
      version: -1
      name: Any file names to hunt for?
      description: |
        Checks whether any file names are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "139"
      "yes":
      - "113"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileName
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1680,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "113":
    id: "113"
    taskid: ceb28474-21ca-4e35-8b23-b5086f99dcf5
    type: regular
    task:
      id: ceb28474-21ca-4e35-8b23-b5086f99dcf5
      version: -1
      name: FireEye HX Query - File Name
      description: Searches endpoints to check all hosts or a subset of hosts for a specific file or indicator.
      script: FireEyeHX v2|||fireeye-hx-search
      type: regular
      iscommand: true
      brand: FireEyeHX v2
    nexttasks:
      '#none#':
      - "179"
    scriptarguments:
      exhaustive:
        complex:
          root: inputs.exhaustive
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "yes"
            - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "no"
      fieldSearchName:
        simple: File Name
      fieldSearchOperator:
        simple: contains
      fieldSearchValue:
        complex:
          root: inputs.FileName
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
      hostSetName:
        complex:
          root: inputs.hostSetName
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.hostSetName
                iscontext: true
      interval_in_seconds:
        complex:
          root: inputs.interval_in_seconds
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval_in_seconds
                iscontext: true
      limit:
        complex:
          root: inputs.limit
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.limit
                iscontext: true
      polling:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1430,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "122":
    id: "122"
    taskid: 962406cc-8a4c-4f23-8681-4ef0c08f4e89
    type: regular
    task:
      id: 962406cc-8a4c-4f23-8681-4ef0c08f4e89
      version: -1
      name: FireEye HX Query - SHA256
      description: Searches endpoints to check all hosts or a subset of hosts for a specific file or indicator.
      script: FireEyeHX v2|||fireeye-hx-search
      type: regular
      iscommand: true
      brand: FireEyeHX v2
    nexttasks:
      '#none#':
      - "182"
    scriptarguments:
      exhaustive:
        complex:
          root: inputs.exhaustive
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "yes"
            - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "no"
      fieldSearchName:
        simple: File SHA256 Hash
      fieldSearchOperator:
        simple: equals
      fieldSearchValue:
        complex:
          root: inputs.SHA256
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
      hostSetName:
        complex:
          root: inputs.hostSetName
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.hostSetName
                iscontext: true
      interval_in_seconds:
        complex:
          root: inputs.interval_in_seconds
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval_in_seconds
                iscontext: true
      limit:
        complex:
          root: inputs.limit
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.limit
                iscontext: true
      polling:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3720,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "123":
    id: "123"
    taskid: 3b712ecd-ae80-4229-8f85-21ada9b3d795
    type: title
    task:
      id: 3b712ecd-ae80-4229-8f85-21ada9b3d795
      version: -1
      name: SHA256 Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "126"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3490,
          "y": -40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "124":
    id: "124"
    taskid: 5caa076e-b84a-424a-8669-29e4b8c3af03
    type: condition
    task:
      id: 5caa076e-b84a-424a-8669-29e4b8c3af03
      version: -1
      name: Any SHA1 to hunt for?
      description: |
        Checks whether any SHA1 hashes are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "155"
      "yes":
      - "128"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA1
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2840,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "126":
    id: "126"
    taskid: a0cee128-6f56-4493-8a99-7306e640f385
    type: condition
    task:
      id: a0cee128-6f56-4493-8a99-7306e640f385
      version: -1
      name: Any SHA256 to hunt for?
      description: |
        Checks whether any SHA256 hashes are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "159"
      "yes":
      - "122"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3490,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "127":
    id: "127"
    taskid: ccbdf46f-1553-4d63-8ed1-9054fda0777d
    type: title
    task:
      id: ccbdf46f-1553-4d63-8ed1-9054fda0777d
      version: -1
      name: SHA1 Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "124"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2840,
          "y": -40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "128":
    id: "128"
    taskid: b42874a2-a99e-413d-8ed2-6ba028ea0a03
    type: regular
    task:
      id: b42874a2-a99e-413d-8ed2-6ba028ea0a03
      version: -1
      name: FireEye HX Query - SHA1
      description: Searches endpoints to check all hosts or a subset of hosts for a specific file or indicator.
      script: FireEyeHX v2|||fireeye-hx-search
      type: regular
      iscommand: true
      brand: FireEyeHX v2
    nexttasks:
      '#none#':
      - "181"
    scriptarguments:
      exhaustive:
        complex:
          root: inputs.exhaustive
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "yes"
            - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "no"
      fieldSearchName:
        simple: File SHA1 Hash
      fieldSearchOperator:
        simple: equals
      fieldSearchValue:
        complex:
          root: inputs.SHA1
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
      hostSetName:
        complex:
          root: inputs.hostSetName
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.hostSetName
                iscontext: true
      interval_in_seconds:
        complex:
          root: inputs.interval_in_seconds
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval_in_seconds
                iscontext: true
      limit:
        complex:
          root: inputs.limit
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.limit
                iscontext: true
      polling:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3080,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "129":
    id: "129"
    taskid: d9d46007-38d9-4283-8925-ec5a6bb33700
    type: title
    task:
      id: d9d46007-38d9-4283-8925-ec5a6bb33700
      version: -1
      name: File Path Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "130"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2300,
          "y": -40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "130":
    id: "130"
    taskid: 3bbb390f-2720-49d7-830d-44d987271a4e
    type: condition
    task:
      id: 3bbb390f-2720-49d7-830d-44d987271a4e
      version: -1
      name: Any file paths to hunt for?
      description: |
        Checks whether any file paths are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "142"
      "yes":
      - "131"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FilePath
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2300,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "131":
    id: "131"
    taskid: 903f7c4a-0355-4896-8005-624e41ab8219
    type: regular
    task:
      id: 903f7c4a-0355-4896-8005-624e41ab8219
      version: -1
      name: FireEye HX Query - File Path
      description: Searches endpoints to check all hosts or a subset of hosts for a specific file or indicator.
      script: FireEyeHX v2|||fireeye-hx-search
      type: regular
      iscommand: true
      brand: FireEyeHX v2
    nexttasks:
      '#none#':
      - "180"
    scriptarguments:
      exhaustive:
        complex:
          root: inputs.exhaustive
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "yes"
            - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "no"
      fileFullPath:
        complex:
          root: inputs.FilePath
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
      fileFullPathOperator:
        simple: equals
      hostSetName:
        complex:
          root: inputs.hostSetName
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.hostSetName
                iscontext: true
      interval_in_seconds:
        complex:
          root: inputs.interval_in_seconds
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval_in_seconds
                iscontext: true
      limit:
        complex:
          root: inputs.limit
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.limit
                iscontext: true
      polling:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2040,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "139":
    id: "139"
    taskid: f6b307f0-7506-447f-87b9-d28b1b7de4d6
    type: title
    task:
      id: f6b307f0-7506-447f-87b9-d28b1b7de4d6
      version: -1
      name: File Name Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1680,
          "y": 695
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "142":
    id: "142"
    taskid: 212ef955-354f-48ba-8bb7-56c32d6cedc3
    type: title
    task:
      id: 212ef955-354f-48ba-8bb7-56c32d6cedc3
      version: -1
      name: File Path Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2300,
          "y": 695
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "155":
    id: "155"
    taskid: 6074bf42-45f7-4ff0-8535-c63ca3df130a
    type: title
    task:
      id: 6074bf42-45f7-4ff0-8535-c63ca3df130a
      version: -1
      name: SHA1 Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2840,
          "y": 695
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "156":
    id: "156"
    taskid: 5a7523b8-37e9-47f8-8f37-2e08aff6999d
    type: title
    task:
      id: 5a7523b8-37e9-47f8-8f37-2e08aff6999d
      version: -1
      name: MD5 Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "161"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4130,
          "y": -40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "159":
    id: "159"
    taskid: 59366d3c-f7da-4564-8c19-0411f559a121
    type: title
    task:
      id: 59366d3c-f7da-4564-8c19-0411f559a121
      version: -1
      name: SHA256 Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3490,
          "y": 695
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "160":
    id: "160"
    taskid: dc6db1d4-e6c7-4472-8a78-3a4003a7d0ae
    type: title
    task:
      id: dc6db1d4-e6c7-4472-8a78-3a4003a7d0ae
      version: -1
      name: MD5 Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4130,
          "y": 695
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "161":
    id: "161"
    taskid: af650f41-666e-49ee-8ffb-b9343bf41e57
    type: condition
    task:
      id: af650f41-666e-49ee-8ffb-b9343bf41e57
      version: -1
      name: Any MD5 to hunt for?
      description: |
        Checks whether any MD5 hashes are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "160"
      "yes":
      - "162"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.MD5
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4130,
          "y": 100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "162":
    id: "162"
    taskid: ecd8cb4f-3766-4a02-819b-7ec10c5819cc
    type: regular
    task:
      id: ecd8cb4f-3766-4a02-819b-7ec10c5819cc
      version: -1
      name: FireEye HX Query - MD5
      description: Searches endpoints to check all hosts or a subset of hosts for a specific file or indicator.
      script: FireEyeHX v2|||fireeye-hx-search
      type: regular
      iscommand: true
      brand: FireEyeHX v2
    nexttasks:
      '#none#':
      - "183"
    scriptarguments:
      exhaustive:
        complex:
          root: inputs.exhaustive
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "yes"
            - operator: isEqualString
              left:
                value:
                  simple: inputs.exhaustive
                iscontext: true
              right:
                value:
                  simple: "no"
      fileMD5Hash:
        complex:
          root: inputs.MD5
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
      fileMD5HashOperator:
        simple: equals
      hostSetName:
        complex:
          root: inputs.hostSetName
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.hostSetName
                iscontext: true
      interval_in_seconds:
        complex:
          root: inputs.interval_in_seconds
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval_in_seconds
                iscontext: true
      limit:
        complex:
          root: inputs.limit
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.limit
                iscontext: true
      polling:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4360,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "170":
    id: "170"
    taskid: 6b9a08c0-ef40-46a4-8a5f-cf08ebaba65b
    type: title
    task:
      id: 6b9a08c0-ef40-46a4-8a5f-cf08ebaba65b
      version: -1
      name: File Type Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "171"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1040,
          "y": -40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "171":
    id: "171"
    taskid: 47abcd30-cb21-4b42-8ede-e4ac518e0bc1
    type: condition
    task:
      id: 47abcd30-cb21-4b42-8ede-e4ac518e0bc1
      version: -1
      name: Any file types to hunt for?
      description: |
        Checks whether any file types are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "174"
      "yes":
      - "173"
      - "175"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileType
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1040,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "173":
    id: "173"
    taskid: 0dcb34af-3da8-4f3a-884d-796904770e72
    type: regular
    task:
      id: 0dcb34af-3da8-4f3a-884d-796904770e72
      version: -1
      name: FireEye HX Query - File Download Type
      description: Searches endpoints to check all hosts or a subset of hosts for a specific file or indicator.
      script: FireEyeHX v2|||fireeye-hx-search
      type: regular
      iscommand: true
      brand: FireEyeHX v2
    nexttasks:
      '#none#':
      - "177"
    scriptarguments:
      exhaustive:
        simple: "no"
      fieldSearchName:
        simple: File Download Type
      fieldSearchOperator:
        simple: equals
      fieldSearchValue:
        complex:
          root: inputs.FileType
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
      hostSetName:
        complex:
          root: inputs.hostSetName
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.hostSetName
                iscontext: true
      interval_in_seconds:
        complex:
          root: inputs.interval_in_seconds
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval_in_seconds
                iscontext: true
      limit:
        complex:
          root: inputs.limit
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.limit
                iscontext: true
      polling:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 800,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "174":
    id: "174"
    taskid: 0bf155cd-b735-4f6b-8515-7dacec13b9ae
    type: title
    task:
      id: 0bf155cd-b735-4f6b-8515-7dacec13b9ae
      version: -1
      name: File Type Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1040,
          "y": 785
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "175":
    id: "175"
    taskid: 07fc7a64-0b1b-44a4-89d0-763d67bf64c8
    type: regular
    task:
      id: 07fc7a64-0b1b-44a4-89d0-763d67bf64c8
      version: -1
      name: FireEye HX Query - Executable PE type
      description: Searches endpoints to check all hosts or a subset of hosts for a specific file or indicator.
      script: FireEyeHX v2|||fireeye-hx-search
      type: regular
      iscommand: true
      brand: FireEyeHX v2
    nexttasks:
      '#none#':
      - "176"
    scriptarguments:
      exhaustive:
        simple: "yes"
      fieldSearchName:
        simple: Executable PE Type
      fieldSearchOperator:
        simple: equals
      fieldSearchValue:
        complex:
          root: inputs.FileType
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
      hostSetName:
        complex:
          root: inputs.hostSetName
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.hostSetName
                iscontext: true
      interval_in_seconds:
        complex:
          root: inputs.interval_in_seconds
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval_in_seconds
                iscontext: true
      limit:
        complex:
          root: inputs.limit
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.limit
                iscontext: true
      polling:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 390,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "176":
    id: "176"
    taskid: 0eb40dbb-59bd-4496-8da8-1f08dec8ea6b
    type: regular
    task:
      id: 0eb40dbb-59bd-4496-8da8-1f08dec8ea6b
      version: -1
      name: Save Matching Results - Executable PE type
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "178"
    scriptarguments:
      key:
        simple: HuntingResults2
      value:
        complex:
          root: FireEyeHX.Search.results
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File Name
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File Full Path
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File MD5 Hash
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 390,
          "y": 440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "177":
    id: "177"
    taskid: 59bea744-4e32-4a75-8059-1b9779a22c31
    type: regular
    task:
      id: 59bea744-4e32-4a75-8059-1b9779a22c31
      version: -1
      name: Save Matching Results - File Download Type
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "178"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FireEyeHX.HuntingResults
      value:
        complex:
          root: FireEyeHX.Search.results
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File Name
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File Full Path
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File MD5 Hash
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 800,
          "y": 440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "178":
    id: "178"
    taskid: eb342dbc-4308-4983-88f3-5a28cd2c1f64
    type: regular
    task:
      id: eb342dbc-4308-4983-88f3-5a28cd2c1f64
      version: -1
      name: Remove Duplications From Matching Results
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "174"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FireEyeHX.HuntingResults
      value:
        complex:
          root: HuntingResults2
          filters:
          - - operator: notInList
              left:
                value:
                  simple: HuntingResults2.id
                iscontext: true
              right:
                value:
                  simple: FireEyeHX.HuntingResults.id
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 590,
          "y": 610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "179":
    id: "179"
    taskid: 11b09293-6049-4e1b-8ff2-f309cb18225b
    type: regular
    task:
      id: 11b09293-6049-4e1b-8ff2-f309cb18225b
      version: -1
      name: Save Matching Results - File Name
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "139"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FireEyeHX.HuntingResults
      value:
        complex:
          root: FireEyeHX.Search.results
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File Name
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File Full Path
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File MD5 Hash
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1430,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "180":
    id: "180"
    taskid: 20965e8b-ba4c-44cb-8024-95d0cbbb80a8
    type: regular
    task:
      id: 20965e8b-ba4c-44cb-8024-95d0cbbb80a8
      version: -1
      name: Save Matching Results - File Path
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "142"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FireEyeHX.HuntingResults
      value:
        complex:
          root: FireEyeHX.Search.results
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File Name
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File Full Path
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File MD5 Hash
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2040,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "181":
    id: "181"
    taskid: 8ea3f0e7-f9ff-4be8-8955-9c35f61ac5b3
    type: regular
    task:
      id: 8ea3f0e7-f9ff-4be8-8955-9c35f61ac5b3
      version: -1
      name: Save Matching Results - SHA1
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "155"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FireEyeHX.HuntingResults
      value:
        complex:
          root: FireEyeHX.Search.results
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File Name
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File Full Path
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File MD5 Hash
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3080,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "182":
    id: "182"
    taskid: 57beb8d8-c932-4721-81d9-1c7ed61520b4
    type: regular
    task:
      id: 57beb8d8-c932-4721-81d9-1c7ed61520b4
      version: -1
      name: Save Matching Results - SHA256
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "159"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FireEyeHX.HuntingResults
      value:
        complex:
          root: FireEyeHX.Search.results
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File Name
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File Full Path
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File MD5 Hash
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3720,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "183":
    id: "183"
    taskid: f697cce2-bcf2-4ca5-8e9a-a0b58b1d35c7
    type: regular
    task:
      id: f697cce2-bcf2-4ca5-8e9a-a0b58b1d35c7
      version: -1
      name: Save Matching Results - MD5
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "160"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FireEyeHX.HuntingResults
      value:
        complex:
          root: FireEyeHX.Search.results
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File Name
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File Full Path
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: FireEyeHX.Search.results.data.File MD5 Hash
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 4360,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "56_111_yes": 0.87,
      "56_31_#default#": 0.1
    },
    "paper": {
      "dimensions": {
        "height": 1355,
        "width": 4350,
        "x": 390,
        "y": -360
      }
    }
  }
inputs:
- key: FileName
  value: {}
  required: false
  description: |-
    A single or multiple file names to search for FireEye HX logs.
    By default, the 'contains' clause is used.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: SHA256
  value: {}
  required: false
  description: |-
    A single or multiple SHA256 file hashes to search for within FireEye HX logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: SHA1
  value: {}
  required: false
  description: |-
    A single or multiple SHA1 file hashes to search for within FireEye HX logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: FilePath
  value: {}
  required: false
  description: |-
    A single or multiple file paths to search for within FireEye HX logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: FileType
  value: {}
  required: false
  description: |-
    A single or multiple file types to search for within FireEye HX logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: MD5
  value: {}
  required: false
  description: |-
    A single or multiple MD5 file hashes to search for within FireEye HX logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: hostSetName
  value: {}
  required: true
  description: |-
    The name of host set to be searched.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: exhaustive
  value: {}
  required: false
  description: |-
    Whether a search is exhaustive or quick.
    Possible values are: yes, no. Default is yes.
  playbookInputQuery:
- key: interval_in_seconds
  value: {}
  required: false
  description: "The interval in seconds between each poll. Default is 60.\t"
  playbookInputQuery:
- key: limit
  value: {}
  required: false
  description: Limits the results count (once the limit is reached, the search is stopped).
  playbookInputQuery:
outputs:
- contextPath: FireEyeHX.HuntingResults
  description: Email message objects and fields that were retrieved from FireEye HX.
  type: string
- contextPath: FireEyeHX.HuntingResults.Timestamp - Event
  description: The timestamp of the event.
  type: number
- contextPath: FireEyeHX.HuntingResults.Timestamp - Accessed
  description: The last accessed time.
  type: number
- contextPath: FireEyeHX.HuntingResults.Timestamp - Modified
  description: The time when the entry was last modified.
  type: number
- contextPath: FireEyeHX.HuntingResults.File Name
  description: The name of the file.
  type: string
- contextPath: FireEyeHX.HuntingResults.File Full Path
  description: The full path of the file.
  type: string
- contextPath: FireEyeHX.HuntingResults.DNS Hostname
  description: The name of the DNS host.
  type: string
- contextPath: FireEyeHX.HuntingResults.URL
  description: The event URL.
  type: string
- contextPath: FireEyeHX.HuntingResults.Username
  description: The event username.
  type: string
- contextPath: FireEyeHX.HuntingResults.File MD5 Hash
  description: The MD5 hash of the file.
  type: string
- contextPath: FireEyeHX.HuntingResults.Port
  description: The Port.
  type: string
- contextPath: FireEyeHX.HuntingResults.Process ID
  description: The ID of the process.
  type: string
- contextPath: FireEyeHX.HuntingResults.Local IP Address
  description: The local IP Address.
  type: string
- contextPath: FireEyeHX.HuntingResults.Local Port
  description: The local Port.
  type: number
- contextPath: FireEyeHX.HuntingResults.Remote Port
  description: The remote port.
  type: number
- contextPath: FireEyeHX.HuntingResults.IP Address
  description: The IP address.
  type: string
- contextPath: FireEyeHX.HuntingResults.Process Name
  description: The process name.
  type: string
- contextPath: FireEyeHX.HuntingResults.type
  description: The type of the event.
  type: string
- contextPath: FireEyeHX.HuntingResults.id
  description: The ID of the result.
  type: string
tests:
- No tests (auto formatted)
fromversion: 6.5.0