Illusive-Collect-Forensics-On-Demand

This playbook is used to collect forensics on-demand on any compromised host and retrieve the forensics timeline upon successful collection.

Illusive Networks · 8 tasks · 3 inputs · 8 outputs

Details

ID	`Illusive-Collect-Forensics-On-Demand`
From Version	5.0.0
Tasks	8

README

This playbook is used to collect forensics on-demand on any compromised host and retrieve the forensics timeline upon successful collection.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

IllusiveNetworks

Scripts

Commands

illusive-run-forensics-on-demand
illusive-get-forensics-timeline
illusive-get-event-incident-id

Playbook Inputs

Name	Description	Required
fqdn_or_ip	The host fqdn or IP address on which to collect forensics	Required
start_date	The starting date of the forensics timeline.
	Optional
end_date	The last date of the forensics timeline.
	Optional

Playbook Outputs

Path	Description	Type
Illusive.Forensics.Evidence.details	The forensics evidence details	unknown
Illusive.Forensics.Evidence.eventId	The event ID	unknown
Illusive.Forensics.Evidence.id	The forensics evidence ID	unknown
Illusive.Forensics.Evidence.source	The Evidence source	unknown
Illusive.Forensics.Evidence.starred	Whether the forensics evidence has been starred	unknown
Illusive.Forensics.Evidence.time	Date and time of the forensics evidence	unknown
Illusive.Forensics.Evidence.title	The forensics evidence description	unknown
Illusive.Forensics.IncidentId	The Incident Id	unknown

Playbook Image

Inputs

fqdn_or_ip — The host FQDN or IP address on which to collect forensics.
start_date — The starting date of the forensics timeline.
end_date — The last date of the forensics timeline.

Outputs

Illusive.Forensics.Evidence.details — The forensics evidence details.
Illusive.Forensics.Evidence.eventId — The event ID.
Illusive.Forensics.Evidence.id — The forensics evidence ID.
Illusive.Forensics.Evidence.source — The evidence source.
Illusive.Forensics.Evidence.starred — Whether the forensics evidence has been starred.
Illusive.Forensics.Evidence.time — Date and time of the forensics evidence.
Illusive.Forensics.Evidence.title — The forensics evidence description.
Illusive.Forensics.IncidentId — The incident ID.

Commands used

illusive-get-event-incident-id illusive-get-forensics-timeline illusive-run-forensics-on-demand

Flowchart

Source

playbook-Illusive-Collect-Forensics-On-Demand.yml

Download History Raw

id: Illusive-Collect-Forensics-On-Demand
version: -1
name: Illusive-Collect-Forensics-On-Demand
description: This playbook is used to collect forensics on-demand on any compromised host and retrieve the forensics timeline upon successful collection.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 5c5a46fa-b621-45ab-8b8b-dc78415f2965
    type: start
    task:
      id: 5c5a46fa-b621-45ab-8b8b-dc78415f2965
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": -160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 3d5d08b1-8544-487f-8f04-30ed968d8168
    type: regular
    task:
      id: 3d5d08b1-8544-487f-8f04-30ed968d8168
      version: -1
      name: illusive-run-forensics-on-demand
      description: Collect forensics on a specified host and retrieve the forensics timeline.
      tags:
      - forensics
      script: IllusiveNetworks|||illusive-run-forensics-on-demand
      type: regular
      iscommand: true
      brand: IllusiveNetworks
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      fqdn_or_ip:
        complex:
          root: inputs.fqdn_or_ip
      hostname_or_ip:
        complex:
          root: 'inputs.fqdn_or_ip '
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": -10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: da5eee43-a8b5-48bc-889a-923df50b909d
    type: playbook
    task:
      id: da5eee43-a8b5-48bc-889a-923df50b909d
      version: -1
      name: GenericPolling
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      AdditionalPollingCommandArgNames: {}
      AdditionalPollingCommandArgValues: {}
      Ids:
        complex:
          root: Illusive
          accessor: Event.eventId
      Interval:
        simple: "1"
      PollingCommandArgName:
        simple: event_id
      PollingCommandName:
        simple: illusive-get-event-incident-id
      Timeout:
        simple: "5"
      dt:
        simple: Illusive.Event(val.status != 'Done').eventId
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 440,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 17a4a75a-fba1-4981-8b02-347d75fd10ba
    type: regular
    task:
      id: 17a4a75a-fba1-4981-8b02-347d75fd10ba
      version: -1
      name: illusive-get-event-incident-id
      description: event_id
      tags:
      - forensics
      script: IllusiveNetworks|||illusive-get-event-incident-id
      type: regular
      iscommand: true
      brand: IllusiveNetworks
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      event_id:
        complex:
          root: Illusive
          accessor: Event.eventId
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: d1a6b201-4d05-46f2-8781-daf8c46d9f37
    type: playbook
    task:
      id: d1a6b201-4d05-46f2-8781-daf8c46d9f37
      version: -1
      name: GenericPolling
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      AdditionalPollingCommandArgNames: {}
      AdditionalPollingCommandArgValues: {}
      Ids:
        complex:
          root: Illusive
          accessor: Event.incidentId
      Interval:
        simple: "2"
      PollingCommandArgName:
        simple: incident_id
      PollingCommandName:
        simple: illusive-get-forensics-timeline
      Timeout:
        simple: "15"
      dt:
        simple: Illusive.Forensics(val.Status != 'Done').IncidentId
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 440,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 17e61225-ffe1-4c2f-8f57-f444f9cb0902
    type: regular
    task:
      id: 17e61225-ffe1-4c2f-8f57-f444f9cb0902
      version: -1
      name: illusive-get-forensics-timeline
      description: Retrieve forensics timeline for a specific incident.
      tags:
      - forensics
      script: IllusiveNetworks|||illusive-get-forensics-timeline
      type: regular
      iscommand: true
      brand: IllusiveNetworks
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      end_date:
        complex:
          root: inputs.end_date
      incident_id:
        complex:
          root: Illusive
          accessor: Event.incidentId
      start_date:
        complex:
          root: inputs.end_date
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 222a72af-c675-4ea4-8719-ce3285fa2900
    type: regular
    task:
      id: 222a72af-c675-4ea4-8719-ce3285fa2900
      version: -1
      name: Print Forensics Timeline
      description: Prints text to the War Room. (Markdown supported.)
      tags:
      - forensics
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    scriptarguments:
      value:
        complex:
          root: Illusive
          accessor: Forensics.Evidence
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 6a3cbc0f-98d0-42a1-86ae-0eb43a2c1637
    type: regular
    task:
      id: 6a3cbc0f-98d0-42a1-86ae-0eb43a2c1637
      version: -1
      name: Waiter
      description: Sleep for 5 seconds. Waiting for event creation.
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      seconds:
        simple: "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1345,
        "width": 380,
        "x": 440,
        "y": -160
      }
    }
  }
inputs:
- key: fqdn_or_ip
  value:
    simple: 172.27.102.12
  required: true
  description: The host FQDN or IP address on which to collect forensics.
  playbookInputQuery:
- key: start_date
  value: {}
  required: false
  description: |
    The starting date of the forensics timeline.
  playbookInputQuery:
- key: end_date
  value: {}
  required: false
  description: |
    The last date of the forensics timeline.
  playbookInputQuery:
outputs:
- contextPath: Illusive.Forensics.Evidence.details
  description: The forensics evidence details.
- contextPath: Illusive.Forensics.Evidence.eventId
  description: The event ID.
- contextPath: Illusive.Forensics.Evidence.id
  description: The forensics evidence ID.
- contextPath: Illusive.Forensics.Evidence.source
  description: The evidence source.
- contextPath: Illusive.Forensics.Evidence.starred
  description: Whether the forensics evidence has been starred.
- contextPath: Illusive.Forensics.Evidence.time
  description: 'Date and time of the forensics evidence. '
- contextPath: Illusive.Forensics.Evidence.title
  description: The forensics evidence description.
- contextPath: Illusive.Forensics.IncidentId
  description: The incident ID.
fromversion: 5.0.0
tests:
- No tests (auto formatted)