IP Enrichment - Internal - Generic v2

id: IP Enrichment - Internal - Generic v2
version: -1
name: IP Enrichment - Internal - Generic v2
description: |-
  Enrich Internal IP addresses using one or more integrations.

  - Resolve IP address to hostname (DNS)
  - Separate internal and external IP addresses
  - Get host information for IP addresses.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 6635b28b-bdf1-42cf-88bc-14ad75e9ebe0
    type: start
    task:
      id: 6635b28b-bdf1-42cf-88bc-14ad75e9ebe0
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 170,
          "y": 199
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 8149db7c-af8d-41e2-85ee-c9fe2efd5040
    type: title
    task:
      id: 8149db7c-af8d-41e2-85ee-c9fe2efd5040
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1010,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: a22c2045-33e0-4ad3-8627-15886227f805
    type: title
    task:
      id: a22c2045-33e0-4ad3-8627-15886227f805
      version: -1
      name: Enrich internal IP addresses
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "43"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: cd79c4ac-4dec-4872-8ec8-35079ffe9e5d
    type: condition
    task:
      id: cd79c4ac-4dec-4872-8ec8-35079ffe9e5d
      version: -1
      name: Are the IPs already classified?
      description: Checks whether the playbook's input contains at least one IP address.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "41"
      "No":
      - "44"
      "Yes":
      - "26"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.IP
            iscontext: true
          right:
            value: {}
      - - operator: isEqualString
          left:
            value:
              simple: inputs.ExecutedFromParent
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    - label: "No"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.IP
            iscontext: true
    view: |-
      {
        "position": {
          "x": 170,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 8556e257-fee3-46d6-8e63-e06c38c3b7af
    type: condition
    task:
      id: 8556e257-fee3-46d6-8e63-e06c38c3b7af
      version: -1
      name: Resolve the IP address?
      description: Checks whether the ResolveIP parameter is set to "True".
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "35"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.ResolveIP
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 720,
          "y": 1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: abe79100-1944-48db-8ada-f7f05dff4f91
    type: regular
    task:
      id: abe79100-1944-48db-8ada-f7f05dff4f91
      version: -1
      name: IP to Hostname (DNS)
      description: Convert the IP address to a hostname using DNS query.
      scriptName: IPToHost
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      ip:
        complex:
          root: IP
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: IP.InRange
                iscontext: true
              right:
                value:
                  simple: "yes"
          - - operator: containsGeneral
              left:
                value:
                  simple: IP.Address
                iscontext: true
              right:
                value:
                  simple: inputs.IP
                iscontext: true
          accessor: Address
          transformers:
          - operator: uniq
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: ac707a9d-ef3d-4dbc-867d-1bef4287be9d
    type: condition
    task:
      id: ac707a9d-ef3d-4dbc-867d-1bef4287be9d
      version: -1
      name: Is there an internal IP address?
      description: Checks whether the "InRange" attribute is set to "yes".
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "34"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: IP
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: IP.InRange
                      iscontext: true
                    right:
                      value:
                        simple: "yes"
                    ignorecase: true
                accessor: Address
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 720,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 711a6f17-1f6f-4b1f-86d6-2808ea6ea255
    type: regular
    task:
      id: 711a6f17-1f6f-4b1f-86d6-2808ea6ea255
      version: -1
      name: Determine whether the IP address is internal or external
      description: "Checks if the IP address is in the internal IP address ranges.\nIf internal, sets the \"InRange\" attribute to \"yes\".\nIf external, sets the \"InRange\" attribute to \"no\". \n"
      scriptName: IsIPInRanges
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    scriptarguments:
      ip:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
      ipRanges:
        complex:
          root: inputs.InternalRange
          transformers:
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 3dbd6139-a053-466c-8abf-86544d804022
    type: title
    task:
      id: 3dbd6139-a053-466c-8abf-86544d804022
      version: -1
      name: No Internal IP Address
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -580,
          "y": 855
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 955e1140-bb51-446f-86e3-754d5119635b
    type: playbook
    task:
      id: 955e1140-bb51-446f-86e3-754d5119635b
      version: -1
      name: Endpoint Enrichment - Generic v2.1
      playbookName: Endpoint Enrichment - Generic v2.1
      type: playbook
      iscommand: false
      brand: ""
      description: |-
        Enrich an endpoint by hostname using one or more integrations.
        Supported integrations:
        - Active Directory Query v2
        - McAfee ePO v2
        - VMware Carbon Black EDR v2
        - Cylance Protect v2
        - CrowdStrike Falcon
        - ExtraHop Reveal(x)
        - Cortex XDR / Core (endpoint enrichment, reputation and risk)
        - Endpoint reputation using !endpoint command.
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      Hostname:
        complex:
          root: Endpoint
          filters:
          - - operator: inList
              left:
                value:
                  simple: Endpoint.IP
                iscontext: true
              right:
                value:
                  simple: inputs.IP
                iscontext: true
          accessor: Hostname
          transformers:
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: inputs.Hostnames
                iscontext: true
              raw: {}
          - operator: uniq
      IPAddress:
        complex:
          root: IP.Address
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: IP.InRange
                iscontext: true
              right:
                value:
                  simple: "yes"
              ignorecase: true
          - - operator: in
              left:
                value:
                  simple: IP.Address
                iscontext: true
              right:
                value:
                  simple: inputs.IP
                iscontext: true
              ignorecase: true
          transformers:
          - operator: uniq
      UseReputationCommand:
        simple: "True"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: 7be14457-6daf-4880-8ab7-ddc7d9c5f5ea
    type: title
    task:
      id: 7be14457-6daf-4880-8ab7-ddc7d9c5f5ea
      version: -1
      name: Classify & Resolve IPs
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "40"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "28_26_Yes": 0.17,
      "28_41_#default#": 0.27,
      "34_26_#default#": 0.41,
      "39_34_yes": 0.47
    },
    "paper": {
      "dimensions": {
        "height": 1636,
        "width": 1970,
        "x": -580,
        "y": 199
      }
    }
  }
inputs:
- key: IP
  value:
    complex:
      root: IP
      accessor: Address
      transformers:
      - operator: uniq
  required: false
  description: The IP address to enrich.
  playbookInputQuery:
- key: InternalRange
  value:
    complex:
      root: lists
      accessor: PrivateIPs
      transformers:
      - operator: RegexExtractAll
        args:
          error_if_no_match: {}
          ignore_case: {}
          multi_line: {}
          period_matches_newline: {}
          regex:
            value:
              simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2})
          unpack_matches: {}
      - operator: join
        args:
          separator:
            value:
              simple: ','
  required: false
  description: "A comma-separated list of IP address ranges (in CIDR notation). Use this list to check if an IP address is found within a set of IP address ranges. \nFor example: \"172.16.0.0/12,10.0.0.0/8,192.168.0.0/16\" (without quotes)."
  playbookInputQuery:
- key: ResolveIP
  value:
    complex:
      root: inputs.ResolveIP
  required: true
  description: |-
    Whether to convert the IP address to a hostname using a DNS query (True/False).
    The default value is true.
  playbookInputQuery:
- key: ExecutedFromParent
  value:
    simple: "False"
  required: false
  description: |-
    Whether to execute common logic, like the classification of IP addresses to ranges and resolving, in the the main (IP Enrichment - Generic v2) enrichment playbook, instead of in the sub-playbooks.

    Possible values are: True, False.
    Setting this to True will execute the relevant commands in the main playbook instead of executing them in both sub-playbooks.

    Set this to True in the parent playbook if you are using the parent playbook, as opposed to using the sub-playbooks directly in your playbooks, as this will improve the performance of the playbook and reduce the overfall size of the incident.
  playbookInputQuery:
- key: Hostnames
  value: {}
  required: false
  description: Hostnames to enrich. If the ExecutedFromParent playbook is set to True in the IP - Enrichment - Generic v2 playbook, and an internal IP resolves to an endpoint hostname that you want to enrich, the hostnames defined here will be used.
  playbookInputQuery:
outputs:
- contextPath: IP
  description: The IP objects.
  type: unknown
- contextPath: DBotScore
  description: Indicator, Score, Type and Vendor.
  type: unknown
- contextPath: Endpoint
  description: The endpoint's object.
  type: unknown
- contextPath: Endpoint.Hostname
  description: The hostname to enrich.
  type: string
- contextPath: Endpoint.OS
  description: Endpoint operating system.
  type: string
- contextPath: Endpoint.IP
  description: A list of endpoint IP addresses.
- contextPath: Endpoint.MAC
  description: A list of endpoint MAC addresses.
- contextPath: Endpoint.Domain
  description: Endpoint domain name.
  type: string
- contextPath: Endpoint.ID
  description: The endpoint ID.
  type: string
- contextPath: Endpoint.Status
  description: The endpoint status.
  type: string
- contextPath: Endpoint.IsIsolated
  description: The endpoint isolation status.
  type: string
- contextPath: Endpoint.MACAddress
  description: The endpoint MAC address.
  type: string
- contextPath: Endpoint.Vendor
  description: The integration name of the endpoint vendor.
  type: string
- contextPath: Endpoint.Relationships
  description: The endpoint relationships of the endpoint that was enriched.
  type: string
- contextPath: Endpoint.Processor
  description: The model of the processor.
  type: string
- contextPath: Endpoint.Processors
  description: The number of processors.
  type: string
- contextPath: Endpoint.Memory
  description: Memory on this endpoint.
  type: string
- contextPath: Endpoint.Model
  description: The model of the machine or device.
  type: string
- contextPath: Endpoint.BIOSVersion
  description: The endpoint's BIOS version.
  type: string
- contextPath: Endpoint.OSVersion
  description: The endpoint's operation system version.
  type: string
- contextPath: Endpoint.DHCPServer
  description: The DHCP server of the endpoint.
  type: string
- contextPath: Endpoint.Groups
  description: Groups for which the computer is listed as a member.
  type: string
- contextPath: ExtraHop.Device.Macaddr
  description: The MAC Address of the device.
  type: String
- contextPath: ExtraHop.Device.DeviceClass
  description: The class of the device.
  type: String
- contextPath: ExtraHop.Device.UserModTime
  description: The time of the most recent update, expressed in milliseconds since the epoch.
  type: Number
- contextPath: ExtraHop.Device.AutoRole
  description: The role automatically detected by the ExtraHop.
  type: String
- contextPath: ExtraHop.Device.ParentId
  description: The ID of the parent device.
  type: Number
- contextPath: ExtraHop.Device.Vendor
  description: The device vendor.
  type: String
- contextPath: ExtraHop.Device.Analysis
  description: The level of analysis preformed on the device.
  type: string
- contextPath: ExtraHop.Device.DiscoveryId
  description: The UUID given by the Discover appliance.
  type: String
- contextPath: ExtraHop.Device.DefaultName
  description: The default name of the device.
  type: String
- contextPath: ExtraHop.Device.DisplayName
  description: The display name of device.
  type: String
- contextPath: ExtraHop.Device.OnWatchlist
  description: Whether the device is on the advanced analysis allow list.
  type: Boolean
- contextPath: ExtraHop.Device.ModTime
  description: The time of the most recent update, expressed in milliseconds since the epoch.
  type: Number
- contextPath: ExtraHop.Device.IsL3
  description: Indicates whether the device is a Layer 3 device.
  type: Boolean
- contextPath: ExtraHop.Device.Role
  description: The role of the device.
  type: String
- contextPath: ExtraHop.Device.DiscoverTime
  description: The time that the device was discovered.
  type: Number
- contextPath: ExtraHop.Device.Id
  description: The ID of the device.
  type: Number
- contextPath: ExtraHop.Device.Ipaddr4
  description: The IPv4 address of the device.
  type: String
- contextPath: ExtraHop.Device.Vlanid
  description: The ID of VLan.
  type: Number
- contextPath: ExtraHop.Device.Ipaddr6
  description: The IPv6 address of the device.
  type: string
- contextPath: ExtraHop.Device.NodeId
  description: The Node ID of the Discover appliance.
  type: number
- contextPath: ExtraHop.Device.Description
  description: A user customizable description of the device.
  type: string
- contextPath: ExtraHop.Device.DnsName
  description: The DNS name associated with the device.
  type: string
- contextPath: ExtraHop.Device.DhcpName
  description: The DHCP name associated with the device.
  type: string
- contextPath: ExtraHop.Device.CdpName
  description: The Cisco Discovery Protocol name associated with the device.
  type: string
- contextPath: ExtraHop.Device.NetbiosName
  description: The NetBIOS name associated with the device.
  type: string
- contextPath: ExtraHop.Device.Url
  description: Link to the device details page in ExtraHop.
  type: string
- contextPath: McAfee.ePO.Endpoint
  description: The endpoint that was enriched.
  type: string
- contextPath: ActiveDirectory.ComputersPageCookie
  description: An opaque string received in a paged search, used for requesting subsequent entries.
  type: string
- contextPath: ActiveDirectory.Computers
  description: The information about the hostname that was enriched using Active Directory.
  type: string
- contextPath: ActiveDirectory.Computers.dn
  description: The computer distinguished name.
  type: string
- contextPath: ActiveDirectory.Computers.memberOf
  description: Groups for which the computer is listed.
  type: string
- contextPath: ActiveDirectory.Computers.name
  description: The computer name.
  type: string
- contextPath: CrowdStrike.Device
  description: The information about  the endpoint.
  type: string
- contextPath: CarbonBlackEDR.Sensor.systemvolume_total_size
  description: The size, in bytes, of the system volume of the endpoint on which the sensor is installed. installed.
  type: number
- contextPath: CarbonBlackEDR.Sensor.emet_telemetry_path
  description: The path of the EMET telemetry associated with the sensor.
  type: string
- contextPath: CarbonBlackEDR.Sensor.os_environment_display_string
  description: Human-readable string of the installed OS.
  type: string
- contextPath: CarbonBlackEDR.Sensor.emet_version
  description: The EMET version associated with the sensor.
  type: string
- contextPath: CarbonBlackEDR.Sensor.emet_dump_flags
  description: The flags of the EMET dump associated with the sensor.
  type: string
- contextPath: CarbonBlackEDR.Sensor.clock_delta
  description: The clock delta associated with the sensor.
  type: string
- contextPath: CarbonBlackEDR.Sensor.supports_cblr
  description: Whether the sensor supports Carbon Black Live Response (CbLR).
  type: string
- contextPath: CarbonBlackEDR.Sensor.sensor_uptime
  description: The uptime of the process.
  type: string
- contextPath: CarbonBlackEDR.Sensor.last_update
  description: When the sensor was last updated.
  type: string
- contextPath: CarbonBlackEDR.Sensor.physical_memory_size
  description: The size in bytes of physical memory.
  type: number
- contextPath: CarbonBlackEDR.Sensor.build_id
  description: The sensor version installed on this endpoint. From the /api/builds/ endpoint.
  type: string
- contextPath: CarbonBlackEDR.Sensor.uptime
  description: Endpoint uptime in seconds.
  type: string
- contextPath: CarbonBlackEDR.Sensor.is_isolating
  description: Boolean representing sensor-reported isolation status.
  type: boolean
- contextPath: CarbonBlackEDR.Sensor.event_log_flush_time
  description: |-
    If event_log_flush_time is set, the server will instruct the sensor to immediately
    send all data before this date, ignoring all other throttling mechanisms.
    To force a host current, set this value to a value far in the future.
    When the sensor has finished sending its queued data, this value will be null.
  type: string
- contextPath: CarbonBlackEDR.Sensor.computer_dns_name
  description: The DNS name of the endpoint on which the sensor is installed.
  type: string
- contextPath: CarbonBlackEDR.Sensor.emet_report_setting
  description: The report setting of the EMET associated with the sensor.
  type: string
- contextPath: CarbonBlackEDR.Sensor.id
  description: The ID of this sensor.
  type: string
- contextPath: CarbonBlackEDR.Sensor.emet_process_count
  description: The number of EMET processes associated with the sensor.
  type: string
- contextPath: CarbonBlackEDR.Sensor.emet_is_gpo
  description: Whether the EMET is a GPO.
  type: string
- contextPath: CarbonBlackEDR.Sensor.power_state
  description: The sensor power state.
  type: string
- contextPath: CarbonBlackEDR.Sensor.network_isolation_enabled
  description: Boolean representing the network isolation request status.
  type: boolean
- contextPath: CarbonBlackEDR.Sensor.systemvolume_free_size
  description: The amount of free bytes on the system volume.
  type: string
- contextPath: CarbonBlackEDR.Sensor.status
  description: The sensor status.
  type: string
- contextPath: CarbonBlackEDR.Sensor.num_eventlog_bytes
  description: The number of event log bytes.
  type: number
- contextPath: CarbonBlackEDR.Sensor.sensor_health_message
  description: Human-readable string indicating the sensor’s self-reported status.
  type: string
- contextPath: CarbonBlackEDR.Sensor.build_version_string
  description: Human-readable string of the sensor version.
  type: string
- contextPath: CarbonBlackEDR.Sensor.computer_sid
  description: Machine SID of this host.
  type: string
- contextPath: CarbonBlackEDR.Sensor.next_checkin_time
  description: Next expected communication from this computer in server-local time and zone.
  type: string
- contextPath: CarbonBlackEDR.Sensor.node_id
  description: The node ID associated with the sensor.
  type: string
- contextPath: CarbonBlackEDR.Sensor.cookie
  description: The cookie associated with the sensor.
  type: string
- contextPath: CarbonBlackEDR.Sensor.emet_exploit_action
  description: The EMET exploit action associated with the sensor.
  type: string
- contextPath: CarbonBlackEDR.Sensor.computer_name
  description: NetBIOS name of this computer.
  type: string
- contextPath: CarbonBlackEDR.Sensor.license_expiration
  description: When the license of the sensor expires.
  type: string
- contextPath: CarbonBlackEDR.Sensor.supports_isolation
  description: Whether the sensor supports isolation.
  type: string
- contextPath: CarbonBlackEDR.Sensor.parity_host_id
  description: The ID of the parity host associated with the sensor.
  type: string
- contextPath: CarbonBlackEDR.Sensor.supports_2nd_gen_modloads
  description: Whether the sensor support modload of 2nd generation.
  type: string
- contextPath: CarbonBlackEDR.Sensor.network_adapters
  description: A pipe-delimited list of IP,MAC pairs for each network interface.
  type: string
- contextPath: CarbonBlackEDR.Sensor.sensor_health_status
  description: Self-reported health score, from 0 to 100. Higher numbers indicate a better health status.
  type: number
- contextPath: CarbonBlackEDR.Sensor.registration_time
  description: Time this sensor was originally registered in server-local time and zone.
  type: string
- contextPath: CarbonBlackEDR.Sensor.restart_queued
  description: Whether a restart of the sensor is queued.
  type: string
- contextPath: CarbonBlackEDR.Sensor.notes
  description: The notes associated with the sensor.
  type: string
- contextPath: CarbonBlackEDR.Sensor.num_storefiles_bytes
  description: Number of storefiles bytes associated with the sensor.
  type: number
- contextPath: CarbonBlackEDR.Sensor.os_environment_id
  description: The ID of the OS environment of the sensor.
  type: string
- contextPath: CarbonBlackEDR.Sensor.shard_id
  description: The ID of the shard associated with the sensor.
  type: string
- contextPath: CarbonBlackEDR.Sensor.boot_id
  description: A sequential counter of boots since the sensor was installed.
  type: string
- contextPath: CarbonBlackEDR.Sensor.last_checkin_time
  description: Last communication with this computer in server-local time and zone.
  type: string
- contextPath: CarbonBlackEDR.Sensor.os_type
  description: The operating system type of the computer.
  type: string
- contextPath: CarbonBlackEDR.Sensor.group_id
  description: The sensor group ID this sensor is assigned to.
  type: string
- contextPath: CarbonBlackEDR.Sensor.uninstall
  description: When set, indicates that the sensor will be directed to uninstall on next check-in.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_id
  description: The endpoint ID.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_name
  description: The endpoint name.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_type
  description: The endpoint type.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_status
  description: The status of the endpoint.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.os_type
  description: The endpoint OS type.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.ip
  description: A list of IP addresses.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.users
  description: A list of users.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.domain
  description: The endpoint domain.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.alias
  description: The endpoint's aliases.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.first_seen
  description: First seen date/time in Epoch (milliseconds).
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.last_seen
  description: Last seen date/time in Epoch (milliseconds).
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.content_version
  description: Content version.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.installation_package
  description: Installation package.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.active_directory
  description: Active directory.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.install_date
  description: Install date in Epoch (milliseconds).
  type: date
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_version
  description: Endpoint version.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.is_isolated
  description: Whether the endpoint is isolated.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.group_name
  description: The name of the group to which the endpoint belongs.
  type: string
- contextPath: PaloAltoNetworksXDR.Endpoint.count
  description: Number of endpoints returned.
  type: number
- contextPath: Account.Username
  description: The username in the relevant system.
  type: string
- contextPath: Account.Domain
  description: The domain of the account.
  type: string
- contextPath: PaloAltoNetworksXDR.RiskyHost.type
  description: Form of identification element.
  type: string
- contextPath: PaloAltoNetworksXDR.RiskyHost.id
  description: Identification value of the type field.
  type: string
- contextPath: PaloAltoNetworksXDR.RiskyHost.score
  description: The score assigned to the host.
  type: string
- contextPath: PaloAltoNetworksXDR.RiskyHost.reasons
  description: The endpoint risk objects.
  type: string
- contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.date created
  description: Date when the incident was created.
  type: date
- contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.description
  description: Description of the incident.
  type: string
- contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.severity
  description: The severity of the incident.
  type: string
- contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.status
  description: The incident status.
  type: string
- contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.points
  description: The score.
  type: string
- contextPath: Core.Endpoint.endpoint_id
  description: The endpoint ID.
  type: string
- contextPath: Core.Endpoint.endpoint_name
  description: The endpoint name.
  type: string
- contextPath: Core.Endpoint.endpoint_type
  description: The endpoint type.
  type: string
- contextPath: Core.Endpoint.endpoint_status
  description: The status of the endpoint.
  type: string
- contextPath: Core.Endpoint.os_type
  description: The endpoint OS type.
  type: string
- contextPath: Core.Endpoint.ip
  description: A list of IP addresses.
  type: string
- contextPath: Core.Endpoint.users
  description: A list of users.
  type: string
- contextPath: Core.Endpoint.domain
  description: The endpoint domain.
  type: string
- contextPath: Core.Endpoint.alias
  description: The endpoint's aliases.
  type: string
- contextPath: Core.Endpoint.first_seen
  description: First seen date/time in Epoch (milliseconds).
  type: string
- contextPath: Core.Endpoint.last_seen
  description: Last seen date/time in Epoch (milliseconds).
  type: string
- contextPath: Core.Endpoint.content_version
  description: Content version.
  type: string
- contextPath: Core.Endpoint.installation_package
  description: Installation package.
  type: string
- contextPath: Core.Endpoint.active_directory
  description: Active directory.
  type: string
- contextPath: Core.Endpoint.install_date
  description: Install date in Epoch (milliseconds).
  type: date
- contextPath: Core.Endpoint.endpoint_version
  description: Endpoint version.
  type: string
- contextPath: Core.Endpoint.is_isolated
  description: Whether the endpoint is isolated.
  type: string
- contextPath: Core.Endpoint.group_name
  description: The name of the group to which the endpoint belongs.
  type: string
- contextPath: Core.RiskyHost.type
  description: Form of identification element.
  type: string
- contextPath: Core.RiskyHost.id
  description: Identification value of the type field.
  type: string
- contextPath: Core.RiskyHost.score
  description: The score assigned to the host.
  type: string
- contextPath: Core.RiskyHost.reasons
  description: The reasons for the risk level.
  type: string
- contextPath: Core.RiskyHost.reasons.date created
  description: Date when the incident was created.
  type: date
- contextPath: Core.RiskyHost.reasons.description
  description: Description of the incident.
  type: string
- contextPath: Core.RiskyHost.reasons.severity
  description: The severity of the incident.
  type: string
- contextPath: Core.RiskyHost.reasons.status
  description: The incident status.
  type: string
- contextPath: Core.RiskyHost.reasons.points
  description: The score.
  type: string
- contextPath: IP.Address
  description: The IP address.
  type: string
- contextPath: IP.InRange
  description: Is the IP in the input ranges? (could be 'yes' or 'no).
  type: string
fromversion: 5.0.0
tests:
- IP Enrichment - Generic v2 - Test
contentitemexportablefields:
  contentitemfields: {}
system: true