Get prevalence for IOCs

The playbook queries the analytics module to receive the prevalence of an IOC. Supported IOC: - Process by SHA256 - Process by file name - IP - Domain - CMD - Registry (require key and value)

Common Playbooks · 20 tasks · 7 inputs · 48 outputs

Inputs

  • IP —
  • Hash —
  • Commandline —
  • Process —
  • RegistryKey —
  • RegistryValue —
  • Domain —

Outputs

  • Core.AnalyticsPrevalence.Ip — Whether the IP address is prevalent or not.
  • Core.AnalyticsPrevalence.Ip.value — Whether the IP address is prevalent or not.
  • Core.AnalyticsPrevalence.Ip.data.global_prevalence — The global prevalence of the IP address.
  • Core.AnalyticsPrevalence.Ip.data.global_prevalence.value — The global prevalence of the IP address.
  • Core.AnalyticsPrevalence.Ip.data.local_prevalence — The local prevalence of the IP address.
  • Core.AnalyticsPrevalence.Ip.data.local_prevalence.value — The local prevalence of the IP address.
  • Core.AnalyticsPrevalence.Ip.data.prevalence — The prevalence of the IP address.
  • Core.AnalyticsPrevalence.Ip.data.prevalence.value — The prevalence of the IP address.
  • Core.AnalyticsPrevalence.Hash — The prevalence of the hash.
  • Core.AnalyticsPrevalence.Hash.value — Whether the hash is prevalent or not.
  • Core.AnalyticsPrevalence.Hash.data.global_prevalence — The prevalence of the hash.
  • Core.AnalyticsPrevalence.Hash.data.global_prevalence.value — The global prevalence of the hash.
  • Core.AnalyticsPrevalence.Hash.data.local_prevalence — The local prevalence of the hash.
  • Core.AnalyticsPrevalence.Hash.data.local_prevalence.value — The local prevalence of the hash.
  • Core.AnalyticsPrevalence.Hash.data.prevalence — The prevalence of the hash.
  • Core.AnalyticsPrevalence.Hash.data.prevalence.value — The prevalence of the hash.
  • Core.AnalyticsPrevalence.Domain — The prevalence of the domain.
  • Core.AnalyticsPrevalence.Domain.value — Whether the domain is prevalent or not.
  • Core.AnalyticsPrevalence.Domain.data.global_prevalence — The global prevalence of the domain.
  • Core.AnalyticsPrevalence.Domain.data.global_prevalence.value — The global prevalence of the domain.
  • Core.AnalyticsPrevalence.Domain.data.local_prevalence — The local prevalence of the domain.
  • Core.AnalyticsPrevalence.Domain.data.local_prevalence.value — The local prevalence of the domain.
  • Core.AnalyticsPrevalence.Domain.data.prevalence — The prevalence of the domain.
  • Core.AnalyticsPrevalence.Domain.data.prevalence.value — The prevalence of the domain.
  • Core.AnalyticsPrevalence.Process — The prevalence of the process.
  • Core.AnalyticsPrevalence.Process.value — Whether the process is prevalent or not.
  • Core.AnalyticsPrevalence.Process.data.global_prevalence — The global prevalence of the process.
  • Core.AnalyticsPrevalence.Process.data.global_prevalence.value — The global prevalence of the process.
  • Core.AnalyticsPrevalence.Process.data.local_prevalence — The local prevalence of the process.
  • Core.AnalyticsPrevalence.Process.data.local_prevalence.value — The local prevalence of the process.
  • Core.AnalyticsPrevalence.Process.data.prevalence — The prevalence of the process.
  • Core.AnalyticsPrevalence.Process.data.prevalence.value — The prevalence of the process.
  • Core.AnalyticsPrevalence.Registry — The prevalence of the registry.
  • Core.AnalyticsPrevalence.Registry.value — Whether the registry is prevalent or not.
  • Core.AnalyticsPrevalence.Registry.data.global_prevalence — The global prevalence of the registry.
  • Core.AnalyticsPrevalence.Registry.data.global_prevalence.value — The global prevalence of the registry.
  • Core.AnalyticsPrevalence.Registry.data.local_prevalence — The local prevalence of the registry.
  • Core.AnalyticsPrevalence.Registry.data.local_prevalence.value — The local prevalence of the registry.
  • Core.AnalyticsPrevalence.Registry.data.prevalence — The prevalence of the registry.
  • Core.AnalyticsPrevalence.Registry.data.prevalence.value — The prevalence of the registry.
  • Core.AnalyticsPrevalence.Cmd — The prevalence of the CMD.
  • Core.AnalyticsPrevalence.Cmd.value — Whether the CMD is prevalent or not.
  • Core.AnalyticsPrevalence.Cmd.data.global_prevalence — The global prevalence of the CMD.
  • Core.AnalyticsPrevalence.Cmd.data.global_prevalence.value — The global prevalence of the CMD.
  • Core.AnalyticsPrevalence.Cmd.data.local_prevalence — The local prevalence of the CMD.
  • Core.AnalyticsPrevalence.Cmd.data.local_prevalence.value — The local prevalence of the CMD.
  • Core.AnalyticsPrevalence.Cmd.data.prevalence — The prevalence of the CMD.
  • Core.AnalyticsPrevalence.Cmd.data.prevalence.value — The prevalence of the Cmd.

Commands used

core-get-IP-analytics-prevalence core-get-cmd-analytics-prevalence core-get-domain-analytics-prevalence core-get-hash-analytics-prevalence core-get-process-analytics-prevalence core-get-registry-analytics-prevalence

Flowchart

yes yes yes yes yes yes Start Start IP IP Hash Hash Domain Domain Command Line Command Line Registry Registry Process Name Process Name Is IP exist? Is IP exist? Get prevalence for IP - core-get-IP-analytics-prevalence Get prevalence for IP core-get-IP-analytics-prevalence Done Done Is Hash exist? Is Hash exist? Get prevalence for Hash - core-get-hash-analytics-prevalence Get prevalence for Hash core-get-hash-analytics-preva... Is Domain exist? Is Domain exist? Get prevalence for Domain - core-get-domain-analytics-prevalence Get prevalence for Domain core-get-domain-analytics-pre... Is Process name exist? Is Process name exist? Get prevalence for Process name - core-get-process-analytics-prevalence Get prevalence for Proces... core-get-process-analytics-pr... Are Registry values exists? Are Registry values exists? Get prevalence for Registry key and value - core-get-registry-analytics-prevalence Get prevalence for Regist... core-get-registry-analytics-p... Is Command-line exist? Is Command-line exist? Get prevalence for Command-line - core-get-cmd-analytics-prevalence Get prevalence for Comman... core-get-cmd-analytics-preval...