List Device Events - Chronicle

This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them. Supported integration: - Chronicle - Google SecOps.

Google SecOps · 12 tasks · 4 inputs · 1 output

Inputs

  • chronicleasset_hostname — The hostname associated with the ChronicleAsset.
  • chronicleasset_ip — The IP address associated with the ChronicleAsset.
  • chronicleasset_mac — The MAC address associated with the ChronicleAsset.
  • chronicleasset_product_id — The product ID associated with the ChronicleAsset.

Outputs

  • GoogleChronicleBackstory.Events — List of events associated with the ChronicleAsset.

Commands used

gcb-list-events

Flowchart

yes yes yes yes yes Start Start Done Done Is there a hostname associated with the ChronicleAsset? Is there a hostname assoc... Get the list of events for the IP address - gcb-list-events Get the list of events fo... gcb-list-events Get the list of events for the product ID - gcb-list-events Get the list of events fo... gcb-list-events Get the list of events for the MAC address - gcb-list-events Get the list of events fo... gcb-list-events Get the list of events for the hostname - gcb-list-events Get the list of events fo... gcb-list-events Is there an IP address associated with the ChronicleAsset? Is there an IP address as... Is there a MAC address associated with the ChronicleAsset? Is there a MAC address as... Is there a product ID associated with the ChronicleAsset? Is there a product ID ass... Is the Chronicle or Google SecOps integration enabled? Is the Chronicle or Googl... Clear the list of events fetched for the previous indicator - DeleteContext Clear the list of events ... DeleteContext