Illusive-Collect-Forensics-On-Demand

This playbook is used to collect forensics on-demand on any compromised host and retrieve the forensics timeline upon successful collection.

Illusive Networks · 8 tasks · 3 inputs · 8 outputs

Details

IDIllusive-Collect-Forensics-On-Demand
From Version5.0.0
Tasks8

README

This playbook is used to collect forensics on-demand on any compromised host and retrieve the forensics timeline upon successful collection.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

  • IllusiveNetworks

Scripts

  • Print

Commands

  • illusive-run-forensics-on-demand
  • illusive-get-forensics-timeline
  • illusive-get-event-incident-id

Playbook Inputs

Name Description Default Value Required
fqdn_or_ip The host fqdn or IP address on which to collect forensics   Required
start_date The starting date of the forensics timeline.    
  Optional    
end_date The last date of the forensics timeline.    
  Optional    

Playbook Outputs

Path Description Type
Illusive.Forensics.Evidence.details The forensics evidence details unknown
Illusive.Forensics.Evidence.eventId The event ID unknown
Illusive.Forensics.Evidence.id The forensics evidence ID unknown
Illusive.Forensics.Evidence.source The Evidence source unknown
Illusive.Forensics.Evidence.starred Whether the forensics evidence has been starred unknown
Illusive.Forensics.Evidence.time Date and time of the forensics evidence unknown
Illusive.Forensics.Evidence.title The forensics evidence description unknown
Illusive.Forensics.IncidentId The Incident Id unknown

Playbook Image

Inputs

  • fqdn_or_ip — The host FQDN or IP address on which to collect forensics.
  • start_date — The starting date of the forensics timeline.
  • end_date — The last date of the forensics timeline.

Outputs

  • Illusive.Forensics.Evidence.details — The forensics evidence details.
  • Illusive.Forensics.Evidence.eventId — The event ID.
  • Illusive.Forensics.Evidence.id — The forensics evidence ID.
  • Illusive.Forensics.Evidence.source — The evidence source.
  • Illusive.Forensics.Evidence.starred — Whether the forensics evidence has been starred.
  • Illusive.Forensics.Evidence.time — Date and time of the forensics evidence.
  • Illusive.Forensics.Evidence.title — The forensics evidence description.
  • Illusive.Forensics.IncidentId — The incident ID.

Commands used

illusive-get-event-incident-id illusive-get-forensics-timeline illusive-run-forensics-on-demand

Flowchart

Start Start illusive-run-forensics-on-demand - illusive-run-forensics-on-demand illusive-run-forensics-on... illusive-run-forensics-on-demand GenericPolling - GenericPolling GenericPolling GenericPolling illusive-get-event-incident-id - illusive-get-event-incident-id illusive-get-event-incide... illusive-get-event-incident-id GenericPolling - GenericPolling GenericPolling GenericPolling illusive-get-forensics-timeline - illusive-get-forensics-timeline illusive-get-forensics-ti... illusive-get-forensics-timeline Print Forensics Timeline - Print Print Forensics Timeline Print Waiter - Sleep Waiter Sleep

Source

playbook-Illusive-Collect-Forensics-On-Demand.yml
Download History Raw 
id: Illusive-Collect-Forensics-On-Demand
version: -1
name: Illusive-Collect-Forensics-On-Demand
description: This playbook is used to collect forensics on-demand on any compromised host and retrieve the forensics timeline upon successful collection.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 5c5a46fa-b621-45ab-8b8b-dc78415f2965
    type: start
    task:
      id: 5c5a46fa-b621-45ab-8b8b-dc78415f2965
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": -160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 3d5d08b1-8544-487f-8f04-30ed968d8168
    type: regular
    task:
      id: 3d5d08b1-8544-487f-8f04-30ed968d8168
      version: -1
      name: illusive-run-forensics-on-demand
      description: Collect forensics on a specified host and retrieve the forensics timeline.
      tags:
      - forensics
      script: IllusiveNetworks|||illusive-run-forensics-on-demand
      type: regular
      iscommand: true
      brand: IllusiveNetworks
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      fqdn_or_ip:
        complex:
          root: inputs.fqdn_or_ip
      hostname_or_ip:
        complex:
          root: 'inputs.fqdn_or_ip '
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": -10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: da5eee43-a8b5-48bc-889a-923df50b909d
    type: playbook
    task:
      id: da5eee43-a8b5-48bc-889a-923df50b909d
      version: -1
      name: GenericPolling
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      AdditionalPollingCommandArgNames: {}
      AdditionalPollingCommandArgValues: {}
      Ids:
        complex:
          root: Illusive
          accessor: Event.eventId
      Interval:
        simple: "1"
      PollingCommandArgName:
        simple: event_id
      PollingCommandName:
        simple: illusive-get-event-incident-id
      Timeout:
        simple: "5"
      dt:
        simple: Illusive.Event(val.status != 'Done').eventId
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 440,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 17a4a75a-fba1-4981-8b02-347d75fd10ba
    type: regular
    task:
      id: 17a4a75a-fba1-4981-8b02-347d75fd10ba
      version: -1
      name: illusive-get-event-incident-id
      description: event_id
      tags:
      - forensics
      script: IllusiveNetworks|||illusive-get-event-incident-id
      type: regular
      iscommand: true
      brand: IllusiveNetworks
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      event_id:
        complex:
          root: Illusive
          accessor: Event.eventId
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: d1a6b201-4d05-46f2-8781-daf8c46d9f37
    type: playbook
    task:
      id: d1a6b201-4d05-46f2-8781-daf8c46d9f37
      version: -1
      name: GenericPolling
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      AdditionalPollingCommandArgNames: {}
      AdditionalPollingCommandArgValues: {}
      Ids:
        complex:
          root: Illusive
          accessor: Event.incidentId
      Interval:
        simple: "2"
      PollingCommandArgName:
        simple: incident_id
      PollingCommandName:
        simple: illusive-get-forensics-timeline
      Timeout:
        simple: "15"
      dt:
        simple: Illusive.Forensics(val.Status != 'Done').IncidentId
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 440,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 17e61225-ffe1-4c2f-8f57-f444f9cb0902
    type: regular
    task:
      id: 17e61225-ffe1-4c2f-8f57-f444f9cb0902
      version: -1
      name: illusive-get-forensics-timeline
      description: Retrieve forensics timeline for a specific incident.
      tags:
      - forensics
      script: IllusiveNetworks|||illusive-get-forensics-timeline
      type: regular
      iscommand: true
      brand: IllusiveNetworks
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      end_date:
        complex:
          root: inputs.end_date
      incident_id:
        complex:
          root: Illusive
          accessor: Event.incidentId
      start_date:
        complex:
          root: inputs.end_date
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 222a72af-c675-4ea4-8719-ce3285fa2900
    type: regular
    task:
      id: 222a72af-c675-4ea4-8719-ce3285fa2900
      version: -1
      name: Print Forensics Timeline
      description: Prints text to the War Room. (Markdown supported.)
      tags:
      - forensics
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    scriptarguments:
      value:
        complex:
          root: Illusive
          accessor: Forensics.Evidence
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 6a3cbc0f-98d0-42a1-86ae-0eb43a2c1637
    type: regular
    task:
      id: 6a3cbc0f-98d0-42a1-86ae-0eb43a2c1637
      version: -1
      name: Waiter
      description: Sleep for 5 seconds. Waiting for event creation.
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      seconds:
        simple: "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1345,
        "width": 380,
        "x": 440,
        "y": -160
      }
    }
  }
inputs:
- key: fqdn_or_ip
  value:
    simple: 172.27.102.12
  required: true
  description: The host FQDN or IP address on which to collect forensics.
  playbookInputQuery:
- key: start_date
  value: {}
  required: false
  description: |
    The starting date of the forensics timeline.
  playbookInputQuery:
- key: end_date
  value: {}
  required: false
  description: |
    The last date of the forensics timeline.
  playbookInputQuery:
outputs:
- contextPath: Illusive.Forensics.Evidence.details
  description: The forensics evidence details.
- contextPath: Illusive.Forensics.Evidence.eventId
  description: The event ID.
- contextPath: Illusive.Forensics.Evidence.id
  description: The forensics evidence ID.
- contextPath: Illusive.Forensics.Evidence.source
  description: The evidence source.
- contextPath: Illusive.Forensics.Evidence.starred
  description: Whether the forensics evidence has been starred.
- contextPath: Illusive.Forensics.Evidence.time
  description: 'Date and time of the forensics evidence. '
- contextPath: Illusive.Forensics.Evidence.title
  description: The forensics evidence description.
- contextPath: Illusive.Forensics.IncidentId
  description: The incident ID.
fromversion: 5.0.0
tests:
- No tests (auto formatted)