Hurukai - Get Runkey List

Get the list of RUN keys

HarfangLab EDR · 7 tasks · 1 input · 0 outputs

Details

IDHurukai - Get Runkey List
From Version6.2.0
Tasks7

README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

  • Hurukai

Scripts

This playbook does not use any scripts.

Commands

  • harfanglab-job-runkeylist
  • harfanglab-get-endpoint-info
  • harfanglab-result-runkeylist

Playbook Inputs


Name Description Default Value Required
agentid     Required

Playbook Outputs


There are no outputs for this playbook.

Playbook Image


Hurukai - Get Runkey List

Inputs

  • agentid

Commands used

harfanglab-get-endpoint-info harfanglab-job-runkeylist harfanglab-result-runkeylist

Flowchart

windows Start Start GenericPolling - GenericPolling GenericPolling GenericPolling Done Done harfanglab-job-runkeylist - harfanglab-job-runkeylist harfanglab-job-runkeylist harfanglab-job-runkeylist harfanglab-result-runkeylist - harfanglab-result-runkeylist harfanglab-result-runkeylist harfanglab-result-runkeylist Which platform is the agent running on ? Which platform is the age... harfanglab-get-endpoint-info - harfanglab-get-endpoint-info harfanglab-get-endpoint-info harfanglab-get-endpoint-info
contentitemexportablefields:
  contentitemfields:
    propagationLabels:
    - all
id: Hurukai - Get Runkey List
inputs:
- description: ''
  key: agentid
  playbookInputQuery:
  required: true
  value: {}
name: Hurukai - Get Runkey List
outputs: []
starttaskid: '0'
tasks:
  '0':
    id: '0'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '9'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: b87275e9-81e7-486f-838a-c1c225364a59
      iscommand: false
      name: ''
      version: -1
      description: ''
    taskid: b87275e9-81e7-486f-838a-c1c225364a59
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 600,
          "y": -980
        }
      }
  '3':
    id: '3'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 0
      wait: 1
    nexttasks:
      '#none#':
      - '7'
    note: false
    quietmode: 0
    scriptarguments:
      Ids:
        simple: ${Harfanglab.Job.ID}
      Interval:
        simple: '1'
      PollingCommandArgName:
        simple: ids
      PollingCommandName:
        simple: harfanglab-job-info
      Timeout:
        simple: '60'
      dt:
        simple: Harfanglab.Job.Info(val.Status !== 'finished').ID
    separatecontext: true
    skipunavailable: false
    task:
      brand: ''
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      id: ac82e6d9-d0df-4d68-80e4-7465ad39c978
      iscommand: false
      name: GenericPolling
      playbookId: GenericPolling
      type: playbook
      version: -1
    taskid: ac82e6d9-d0df-4d68-80e4-7465ad39c978
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 700,
          "y": -260
        }
      }
  '5':
    id: '5'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: a9b2d4ee-4b7c-4bf4-844b-09ae8ebb7eac
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: a9b2d4ee-4b7c-4bf4-844b-09ae8ebb7eac
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 550,
          "y": 100
        }
      }
  '6':
    id: '6'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '3'
    note: false
    quietmode: 0
    scriptarguments:
      agent_id:
        simple: ${inputs.agentid}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Hurukai
      description: Start a job to get the list of run keys from a host (Windows)
      id: d0c687ec-57a7-42fb-88a6-1ef3c44ccfa0
      iscommand: true
      name: harfanglab-job-runkeylist
      script: Hurukai|||harfanglab-job-runkeylist
      type: regular
      version: -1
    taskid: d0c687ec-57a7-42fb-88a6-1ef3c44ccfa0
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 700,
          "y": -450
        }
      }
  '7':
    evidencedata:
      customfields: {}
      description:
        simple: Run key list
    id: '7'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '5'
    note: false
    quietmode: 0
    scriptarguments:
      job_id:
        simple: ${Harfanglab.Job.ID}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Hurukai
      description: Get a hostname's list of run keys from job results
      id: 2196ab89-d17c-4bee-8f31-98a2a7d19366
      iscommand: true
      name: harfanglab-result-runkeylist
      script: Hurukai|||harfanglab-result-runkeylist
      type: regular
      version: -1
    taskid: 2196ab89-d17c-4bee-8f31-98a2a7d19366
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 700,
          "y": -90
        }
      }
  '8':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: Agent
                root: Harfanglab
                transformers:
                - args:
                    field:
                      value:
                        simple: ostype
                  operator: getField
          operator: isEqualString
          right:
            value:
              simple: windows
      label: windows
    id: '8'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '5'
      windows:
      - '6'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 3488abf6-cf04-4eae-8e21-cd00b1408871
      iscommand: false
      name: Which platform is the agent running on ?
      type: condition
      version: -1
      description: ''
    taskid: 3488abf6-cf04-4eae-8e21-cd00b1408871
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 600,
          "y": -670
        }
      }
  '9':
    id: '9'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '8'
    note: false
    quietmode: 0
    scriptarguments:
      agent_id:
        simple: ${inputs.agentid}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Hurukai
      description: Get endpoint information from agent_id
      id: db7ddc80-8994-46a5-8345-306acb75c7f6
      iscommand: true
      name: harfanglab-get-endpoint-info
      script: Hurukai|||harfanglab-get-endpoint-info
      type: regular
      version: -1
    taskid: db7ddc80-8994-46a5-8345-306acb75c7f6
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 600,
          "y": -845
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1145,
        "width": 530,
        "x": 550,
        "y": -980
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.2.0
description: Get the list of RUN keys