Get prevalence for IOCs

The playbook queries the analytics module to receive the prevalence of an IOC. Supported IOC: - Process by SHA256 - Process by file name - IP - Domain - CMD - Registry (require key and value)

Common Playbooks · 20 tasks · 7 inputs · 48 outputs

Details

ID	`Get prevalence for IOCs`
From Version	6.6.0
Tasks	20

README

The playbook queries the analytics module to receive the prevalence of an IOC.

Supported IOCs:

Process by SHA256
Process by file name
IP
Domain
CMD
Registry (require key and value)

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

core-get-domain-analytics-prevalence
core-get-IP-analytics-prevalence
core-get-hash-analytics-prevalence
core-get-registry-analytics-prevalence
core-get-cmd-analytics-prevalence
core-get-process-analytics-prevalence

Playbook Inputs

Name	Description	Required
IP	IP address to run the prevalence check.	Optional
Hash	Hash to run the prevalence check.	Optional
Commandline	The CMD to run the prevalence check.	Optional	Optional
Process	The process name to run the prevalence check.	Optional
RegistryKey	The registry key to run the prevalence check. The input registry value must be provided as well.	Optional
RegistryValue	The registry value to run the prevalence check. The input registry key must be provided as well.	Optional
Domain	The domain to run the prevalence check.	Optional

Playbook Outputs

Path	Description	Type
Core.AnalyticsPrevalence.Ip	Whether the IP address is prevalent or not.	unknown
Core.AnalyticsPrevalence.Ip.value	Whether the IP address is prevalent or not.	unknown
Core.AnalyticsPrevalence.Ip.data.global_prevalence	The global prevalence of the IP address.	unknown
Core.AnalyticsPrevalence.Ip.data.global_prevalence.value	The global prevalence of the IP address.	unknown
Core.AnalyticsPrevalence.Ip.data.local_prevalence	The local prevalence of the IP address.	unknown
Core.AnalyticsPrevalence.Ip.data.local_prevalence.value	The local prevalence of the IP address.	unknown
Core.AnalyticsPrevalence.Ip.data.prevalence	The prevalence of the IP address.	unknown
Core.AnalyticsPrevalence.Ip.data.prevalence.value	The prevalence of the IP address.	unknown
Core.AnalyticsPrevalence.Hash	The prevalence of the hash.	unknown
Core.AnalyticsPrevalence.Hash.value	Whether the hash is prevalent or not.	unknown
Core.AnalyticsPrevalence.Hash.data.global_prevalence	The prevalence of the hash.	unknown
Core.AnalyticsPrevalence.Hash.data.global_prevalence.value	The global prevalence of the hash.	unknown
Core.AnalyticsPrevalence.Hash.data.local_prevalence	The local prevalence of the hash.	unknown
Core.AnalyticsPrevalence.Hash.data.local_prevalence.value	The local prevalence of the hash.	unknown
Core.AnalyticsPrevalence.Hash.data.prevalence	The prevalence of the hash.	unknown
Core.AnalyticsPrevalence.Hash.data.prevalence.value	The prevalence of the hash.	unknown
Core.AnalyticsPrevalence.Domain	The prevalence of the domain.	unknown
Core.AnalyticsPrevalence.Domain.value	Whether the domain is prevalent or not.	unknown
Core.AnalyticsPrevalence.Domain.data.global_prevalence	The global prevalence of the domain.	unknown
Core.AnalyticsPrevalence.Domain.data.global_prevalence.value	The global prevalence of the domain.	unknown
Core.AnalyticsPrevalence.Domain.data.local_prevalence	The local prevalence of the domain.	unknown
Core.AnalyticsPrevalence.Domain.data.local_prevalence.value	The local prevalence of the domain.	unknown
Core.AnalyticsPrevalence.Domain.data.prevalence	The prevalence of the domain.	unknown
Core.AnalyticsPrevalence.Domain.data.prevalence.value	The prevalence of the domain.	unknown
Core.AnalyticsPrevalence.Process	The prevalence of the process.	unknown
Core.AnalyticsPrevalence.Process.value	Whether the process is prevalent or not.	unknown
Core.AnalyticsPrevalence.Process.data.global_prevalence	The global prevalence of the process.	unknown
Core.AnalyticsPrevalence.Process.data.global_prevalence.value	The global prevalence of the process.	unknown
Core.AnalyticsPrevalence.Process.data.local_prevalence	The local prevalence of the process.	unknown
Core.AnalyticsPrevalence.Process.data.local_prevalence.value	The local prevalence of the process.	unknown
Core.AnalyticsPrevalence.Process.data.prevalence	The prevalence of the process.	unknown
Core.AnalyticsPrevalence.Process.data.prevalence.value	The prevalence of the process.	unknown
Core.AnalyticsPrevalence.Registry	The prevalence of the registry.	unknown
Core.AnalyticsPrevalence.Registry.value	Whether the registry is prevalent or not.	unknown
Core.AnalyticsPrevalence.Registry.data.global_prevalence	The global prevalence of the registry.	unknown
Core.AnalyticsPrevalence.Registry.data.global_prevalence.value	The global prevalence of the registry.	unknown
Core.AnalyticsPrevalence.Registry.data.local_prevalence	The local prevalence of the registry.	unknown
Core.AnalyticsPrevalence.Registry.data.local_prevalence.value	The local prevalence of the registry.	unknown
Core.AnalyticsPrevalence.Registry.data.prevalence	The prevalence of the registry.	unknown
Core.AnalyticsPrevalence.Registry.data.prevalence.value	The prevalence of the registry.	unknown
Core.AnalyticsPrevalence.Cmd	The prevalence of the CMD.	unknown
Core.AnalyticsPrevalence.Cmd.value	Whether the CMD is prevalent or not.	unknown
Core.AnalyticsPrevalence.Cmd.data.global_prevalence	The global prevalence of the CMD.	unknown
Core.AnalyticsPrevalence.Cmd.data.global_prevalence.value	The global prevalence of the CMD.	unknown
Core.AnalyticsPrevalence.Cmd.data.local_prevalence	The local prevalence of the CMD.	unknown
Core.AnalyticsPrevalence.Cmd.data.local_prevalence.value	The local prevalence of the CMD.	unknown
Core.AnalyticsPrevalence.Cmd.data.prevalence	The prevalence of the CMD.	unknown
Core.AnalyticsPrevalence.Cmd.data.prevalence.value	The prevalence of the Cmd.	unknown

Playbook Image

Get prevalence for IOCs

Inputs

IP —
Hash —
Commandline —
Process —
RegistryKey —
RegistryValue —
Domain —

Outputs

Core.AnalyticsPrevalence.Ip — Whether the IP address is prevalent or not.
Core.AnalyticsPrevalence.Ip.value — Whether the IP address is prevalent or not.
Core.AnalyticsPrevalence.Ip.data.global_prevalence — The global prevalence of the IP address.
Core.AnalyticsPrevalence.Ip.data.global_prevalence.value — The global prevalence of the IP address.
Core.AnalyticsPrevalence.Ip.data.local_prevalence — The local prevalence of the IP address.
Core.AnalyticsPrevalence.Ip.data.local_prevalence.value — The local prevalence of the IP address.
Core.AnalyticsPrevalence.Ip.data.prevalence — The prevalence of the IP address.
Core.AnalyticsPrevalence.Ip.data.prevalence.value — The prevalence of the IP address.
Core.AnalyticsPrevalence.Hash — The prevalence of the hash.
Core.AnalyticsPrevalence.Hash.value — Whether the hash is prevalent or not.
Core.AnalyticsPrevalence.Hash.data.global_prevalence — The prevalence of the hash.
Core.AnalyticsPrevalence.Hash.data.global_prevalence.value — The global prevalence of the hash.
Core.AnalyticsPrevalence.Hash.data.local_prevalence — The local prevalence of the hash.
Core.AnalyticsPrevalence.Hash.data.local_prevalence.value — The local prevalence of the hash.
Core.AnalyticsPrevalence.Hash.data.prevalence — The prevalence of the hash.
Core.AnalyticsPrevalence.Hash.data.prevalence.value — The prevalence of the hash.
Core.AnalyticsPrevalence.Domain — The prevalence of the domain.
Core.AnalyticsPrevalence.Domain.value — Whether the domain is prevalent or not.
Core.AnalyticsPrevalence.Domain.data.global_prevalence — The global prevalence of the domain.
Core.AnalyticsPrevalence.Domain.data.global_prevalence.value — The global prevalence of the domain.
Core.AnalyticsPrevalence.Domain.data.local_prevalence — The local prevalence of the domain.
Core.AnalyticsPrevalence.Domain.data.local_prevalence.value — The local prevalence of the domain.
Core.AnalyticsPrevalence.Domain.data.prevalence — The prevalence of the domain.
Core.AnalyticsPrevalence.Domain.data.prevalence.value — The prevalence of the domain.
Core.AnalyticsPrevalence.Process — The prevalence of the process.
Core.AnalyticsPrevalence.Process.value — Whether the process is prevalent or not.
Core.AnalyticsPrevalence.Process.data.global_prevalence — The global prevalence of the process.
Core.AnalyticsPrevalence.Process.data.global_prevalence.value — The global prevalence of the process.
Core.AnalyticsPrevalence.Process.data.local_prevalence — The local prevalence of the process.
Core.AnalyticsPrevalence.Process.data.local_prevalence.value — The local prevalence of the process.
Core.AnalyticsPrevalence.Process.data.prevalence — The prevalence of the process.
Core.AnalyticsPrevalence.Process.data.prevalence.value — The prevalence of the process.
Core.AnalyticsPrevalence.Registry — The prevalence of the registry.
Core.AnalyticsPrevalence.Registry.value — Whether the registry is prevalent or not.
Core.AnalyticsPrevalence.Registry.data.global_prevalence — The global prevalence of the registry.
Core.AnalyticsPrevalence.Registry.data.global_prevalence.value — The global prevalence of the registry.
Core.AnalyticsPrevalence.Registry.data.local_prevalence — The local prevalence of the registry.
Core.AnalyticsPrevalence.Registry.data.local_prevalence.value — The local prevalence of the registry.
Core.AnalyticsPrevalence.Registry.data.prevalence — The prevalence of the registry.
Core.AnalyticsPrevalence.Registry.data.prevalence.value — The prevalence of the registry.
Core.AnalyticsPrevalence.Cmd — The prevalence of the CMD.
Core.AnalyticsPrevalence.Cmd.value — Whether the CMD is prevalent or not.
Core.AnalyticsPrevalence.Cmd.data.global_prevalence — The global prevalence of the CMD.
Core.AnalyticsPrevalence.Cmd.data.global_prevalence.value — The global prevalence of the CMD.
Core.AnalyticsPrevalence.Cmd.data.local_prevalence — The local prevalence of the CMD.
Core.AnalyticsPrevalence.Cmd.data.local_prevalence.value — The local prevalence of the CMD.
Core.AnalyticsPrevalence.Cmd.data.prevalence — The prevalence of the CMD.
Core.AnalyticsPrevalence.Cmd.data.prevalence.value — The prevalence of the Cmd.

Commands used

core-get-IP-analytics-prevalence core-get-cmd-analytics-prevalence core-get-domain-analytics-prevalence core-get-hash-analytics-prevalence core-get-process-analytics-prevalence core-get-registry-analytics-prevalence

Flowchart

Source

playbook-Get_prevalence_for_IOCs.yml

Download History Raw

id: 'Get prevalence for IOCs'
version: -1
name: 'Get prevalence for IOCs'
marketplaces:
- marketplacev2
- platform
- xpanse
supportedModules:
- cloud
- cloud_runtime_security
- xsiam
- edr
- agentix
description: |+
  The playbook queries the analytics module to receive the prevalence of an IOC.

  Supported IOC:
  - Process by SHA256
  - Process by file name
  - IP
  - Domain
  - CMD
  - Registry (require key and value)

starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d24981a6-e630-426a-8d47-97da09aa8fd8
    type: start
    task:
      id: d24981a6-e630-426a-8d47-97da09aa8fd8
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
      - "2"
      - "3"
      - "4"
      - "5"
      - "6"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 72bdab6d-8f44-4e6d-8074-2b929f75cc83
    type: title
    task:
      id: 72bdab6d-8f44-4e6d-8074-2b929f75cc83
      version: -1
      name: IP
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2130,
          "y": 275
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 7e51572a-d879-45d9-87a0-96e2c6cdc6de
    type: title
    task:
      id: 7e51572a-d879-45d9-87a0-96e2c6cdc6de
      version: -1
      name: Hash
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1460,
          "y": 275
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: ab430fa0-7f67-48bb-80c7-3aaf91a685f2
    type: title
    task:
      id: ab430fa0-7f67-48bb-80c7-3aaf91a685f2
      version: -1
      name: Domain
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 120,
          "y": 275
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: becb735c-ae39-492f-8029-fa445fbe89ca
    type: title
    task:
      id: becb735c-ae39-492f-8029-fa445fbe89ca
      version: -1
      name: Command Line
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -480,
          "y": 275
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 372a4887-887e-44c7-8d8d-0ab2bc4dabfb
    type: title
    task:
      id: 372a4887-887e-44c7-8d8d-0ab2bc4dabfb
      version: -1
      name: Registry
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1080,
          "y": 275
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 61dfc474-c507-47f7-8489-fea7f0e89a26
    type: title
    task:
      id: 61dfc474-c507-47f7-8489-fea7f0e89a26
      version: -1
      name: Process Name
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 810,
          "y": 275
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 8d6f6781-0e11-4ba6-83d4-7a9edf5ca62f
    type: condition
    task:
      id: 8d6f6781-0e11-4ba6-83d4-7a9edf5ca62f
      version: -1
      name: Is IP exist?
      description: Checks whether a IP exist
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.IP
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2130,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: c08cbacc-395f-49ff-86d9-722d5fc03785
    type: regular
    task:
      id: c08cbacc-395f-49ff-86d9-722d5fc03785
      version: -1
      name: Get prevalence for IP
      description: Get the prevalence of an ip, identified by ip_address.
      script: '|||core-get-IP-analytics-prevalence'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      ip_address:
        complex:
          root: inputs.IP
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2300,
          "y": 610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 1229d65a-a5e5-4a24-82ff-26f05589888f
    type: title
    task:
      id: 1229d65a-a5e5-4a24-82ff-26f05589888f
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: df3021a5-526b-4e96-8e9c-ffe1d652882f
    type: condition
    task:
      id: df3021a5-526b-4e96-8e9c-ffe1d652882f
      version: -1
      name: Is Hash exist?
      description: Checks whether hash exist
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Hash
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1450,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 94258428-8091-4d0e-8a1c-3834eeeea151
    type: regular
    task:
      id: 94258428-8091-4d0e-8a1c-3834eeeea151
      version: -1
      name: Get prevalence for Hash
      description: Get the prevalence of a file, identified by sha256.
      script: '|||core-get-hash-analytics-prevalence'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      sha256:
        complex:
          root: inputs.Hash
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1750,
          "y": 610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 094aa4d1-d89b-47e2-8a11-4aa551fcf73f
    type: condition
    task:
      id: 094aa4d1-d89b-47e2-8a11-4aa551fcf73f
      version: -1
      name: Is Domain exist?
      description: Checks whether a domain exist
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Domain
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 120,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 497c0f5c-f9e1-49cc-80ab-e49ea84dde61
    type: regular
    task:
      id: 497c0f5c-f9e1-49cc-80ab-e49ea84dde61
      version: -1
      name: Get prevalence for Domain
      description: Get the prevalence of a domain, identified by domain_name.
      script: '|||core-get-domain-analytics-prevalence'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      domain_name:
        complex:
          root: inputs.Domain
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 6f2eb04f-09d1-4bcc-8a97-27d761646cbf
    type: condition
    task:
      id: 6f2eb04f-09d1-4bcc-8a97-27d761646cbf
      version: -1
      name: Is Process name exist?
      description: Checks whether a process name exist
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Process
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 810,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: b70cff36-a4c9-4793-82a2-aa38b860e1f6
    type: regular
    task:
      id: b70cff36-a4c9-4793-82a2-aa38b860e1f6
      version: -1
      name: Get prevalence for Process name
      description: Get the prevalence of a process, identified by process_name.
      script: '|||core-get-process-analytics-prevalence'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      process_name:
        complex:
          root: inputs.Process
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1080,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 3f0071a0-d9c8-4cf5-8b52-df71fce0d72e
    type: condition
    task:
      id: 3f0071a0-d9c8-4cf5-8b52-df71fce0d72e
      version: -1
      name: Are Registry values exists?
      description: Checks whether a registry values exist
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.RegistryKey
            iscontext: true
          right:
            value: {}
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.RegistryValue
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1080,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 950a0f87-5153-4ca7-8cb3-f93cf87dfda9
    type: regular
    task:
      id: 950a0f87-5153-4ca7-8cb3-f93cf87dfda9
      version: -1
      name: Get prevalence for Registry key and value
      description: Get the prevalence of a registry_path, identified by key_name, value_name.
      script: '|||core-get-registry-analytics-prevalence'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      key_name:
        complex:
          root: inputs.RegistryKey
      value_name:
        complex:
          root: inputs.RegistryValue
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1310,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: e65afe0e-42d6-4114-81fa-d7347b5fabf9
    type: condition
    task:
      id: e65afe0e-42d6-4114-81fa-d7347b5fabf9
      version: -1
      name: Is Command-line exist?
      description: Checks whether a command-line exist
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Commandline
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -480,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 6778b8ba-6111-4875-8947-e7be45ee53a8
    type: regular
    task:
      id: 6778b8ba-6111-4875-8947-e7be45ee53a8
      version: -1
      name: Get prevalence for Command-line
      description: Get the prevalence of a process_command_line, identified by process_command_line.
      script: '|||core-get-cmd-analytics-prevalence'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      process_command_line:
        complex:
          root: inputs.Commandline
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -710,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_9_#default#": 0.13,
      "12_9_#default#": 0.28,
      "14_9_#default#": 0.26,
      "16_9_#default#": 0.1,
      "18_19_yes": 0.71,
      "18_9_#default#": 0.15,
      "7_9_#default#": 0.1
    },
    "paper": {
      "dimensions": {
        "height": 715,
        "width": 3990,
        "x": -1310,
        "y": 130
      }
    }
  }
inputs:
- key: IP
  value: {}
  required: false
  description: ""
  playbookInputQuery:
- key: Hash
  value: {}
  required: false
  description: ""
  playbookInputQuery:
- key: Commandline
  value: {}
  required: false
  description: ""
  playbookInputQuery:
- key: Process
  value: {}
  required: false
  description: ""
  playbookInputQuery:
- key: RegistryKey
  value: {}
  required: false
  description: ""
  playbookInputQuery:
- key: RegistryValue
  value: {}
  required: false
  description: ""
  playbookInputQuery:
- key: Domain
  value: {}
  required: false
  description: ""
  playbookInputQuery:
outputs:
- contextPath: Core.AnalyticsPrevalence.Ip
  description: Whether the IP address is prevalent or not.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Ip.value
  description: Whether the IP address is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Ip.data.global_prevalence
  description: The global prevalence of the IP address.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Ip.data.global_prevalence.value
  description: The global prevalence of the IP address.
- contextPath: Core.AnalyticsPrevalence.Ip.data.local_prevalence
  description: The local prevalence of the IP address.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Ip.data.local_prevalence.value
  description: The local prevalence of the IP address.
- contextPath: Core.AnalyticsPrevalence.Ip.data.prevalence
  description: The prevalence of the IP address.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Ip.data.prevalence.value
  description: The prevalence of the IP address.
- contextPath: Core.AnalyticsPrevalence.Hash
  description: The prevalence of the hash.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Hash.value
  description: Whether the hash is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Hash.data.global_prevalence
  description: The prevalence of the hash.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Hash.data.global_prevalence.value
  description: The global prevalence of the hash.
- contextPath: Core.AnalyticsPrevalence.Hash.data.local_prevalence
  description: The local prevalence of the hash.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Hash.data.local_prevalence.value
  description: The local prevalence of the hash.
- contextPath: Core.AnalyticsPrevalence.Hash.data.prevalence
  description: The prevalence of the hash.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Hash.data.prevalence.value
  description: The prevalence of the hash.
- contextPath: Core.AnalyticsPrevalence.Domain
  description: The prevalence of the domain.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Domain.value
  description: Whether the domain is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Domain.data.global_prevalence
  description: The global prevalence of the domain.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Domain.data.global_prevalence.value
  description: The global prevalence of the domain.
- contextPath: Core.AnalyticsPrevalence.Domain.data.local_prevalence
  description: The local prevalence of the domain.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Domain.data.local_prevalence.value
  description: The local prevalence of the domain.
- contextPath: Core.AnalyticsPrevalence.Domain.data.prevalence
  description: The prevalence of the domain.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Domain.data.prevalence.value
  description: The prevalence of the domain.
- contextPath: Core.AnalyticsPrevalence.Process
  description: The prevalence of the process.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Process.value
  description: Whether the process is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Process.data.global_prevalence
  description: The global prevalence of the process.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Process.data.global_prevalence.value
  description: The global prevalence of the process.
- contextPath: Core.AnalyticsPrevalence.Process.data.local_prevalence
  description: The local prevalence of the process.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Process.data.local_prevalence.value
  description: The local prevalence of the process.
- contextPath: Core.AnalyticsPrevalence.Process.data.prevalence
  description: The prevalence of the process.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Process.data.prevalence.value
  description: The prevalence of the process.
- contextPath: Core.AnalyticsPrevalence.Registry
  description: The prevalence of the registry.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Registry.value
  description: Whether the registry is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Registry.data.global_prevalence
  description: The global prevalence of the registry.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Registry.data.global_prevalence.value
  description: The global prevalence of the registry.
- contextPath: Core.AnalyticsPrevalence.Registry.data.local_prevalence
  description: The local  prevalence of the registry.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Registry.data.local_prevalence.value
  description: The local prevalence of the registry.
- contextPath: Core.AnalyticsPrevalence.Registry.data.prevalence
  description: The prevalence of the registry.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Registry.data.prevalence.value
  description: The prevalence of the registry.
- contextPath: Core.AnalyticsPrevalence.Cmd
  description: The prevalence of the CMD.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Cmd.value
  description: Whether the CMD is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Cmd.data.global_prevalence
  description: The global prevalence of the CMD.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Cmd.data.global_prevalence.value
  description: The global prevalence of the CMD.
- contextPath: Core.AnalyticsPrevalence.Cmd.data.local_prevalence
  description: The local prevalence of the CMD.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Cmd.data.local_prevalence.value
  description: The local prevalence of the CMD.
- contextPath: Core.AnalyticsPrevalence.Cmd.data.prevalence
  description: The prevalence of the CMD.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Cmd.data.prevalence.value
  description: The prevalence of the Cmd.
tests:
- No tests (auto formatted)
fromversion: 6.6.0