Get host forensics - Generic

This playbook retrieves forensics from hosts for the following integrations: - Illusive Networks - Microsoft Defender For Endpoint.

Common Playbooks · 6 tasks · 4 inputs · 12 outputs

Inputs

  • fqdn_or_ip — If using the Illusive Networks integration to retrieve additional forensics, provide the host fqdn_or_ip from which to get the forensics.
  • start_date — Date_range must be "number date_range_unit", for example 2 hours, 4 minutes, 6 months, 1 day.
  • end_date — Date_range must be "number date_range_unit" for example 2 hours, 4 minutes, 6 months, 1 day.
  • machine_ID — Provide the machine IDs of the systems you want to retrieve.

Outputs

  • MicrosoftATP — An object containing the machine action details.
  • MicrosoftATP.MachineAction — Microsoft Defender For Endpoint machine action details.
  • Illusive.Forensics.Evidence — An object containing evidence from Illusive Networks.
  • Illusive.Forensics.Evidence.details — The forensics evidence details.
  • Illusive.Forensics.Evidence.eventId — The event ID.
  • Illusive.Forensics.Evidence.id — The forensics evidence ID.
  • Illusive.Forensics.Evidence.source — The evidence source.
  • Illusive.Forensics.Evidence.starred — Whether the forensics evidence has been starred.
  • Illusive.Forensics.Evidence.time — Date and time of the forensics evidence.
  • Illusive.Forensics.Evidence.title — The forensics evidence description.
  • Illusive.Forensics — Ab object containing the Incident ID in Illusive Networks.
  • Illusive.Forensics.IncidentId — The incident ID.

Flowchart

yes yes Start Start Is illusive enabled - IsIntegrationAvailable Is illusive enabled IsIntegrationAvailable Done Done Illusive-Collect-Forensics-On-Demand - Illusive-Collect-Forensics-On-Demand Illusive-Collect-Forensic... Illusive-Collect-Forensics-On... Is Microsoft Defender For Endpoint Integration Enabled? - IsIntegrationAvailable Is Microsoft Defender For... IsIntegrationAvailable Microsoft Defender For Endpoint - Collect investigation package - Microsoft Defender For Endpoint - Collect investigation package Microsoft Defender For En... Microsoft Defender For Endpoi...