List Device Events - Chronicle

This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them. Supported integration: - Chronicle - Google SecOps.

Google SecOps · 12 tasks · 4 inputs · 1 output

Details

ID	`List Device Events - Chronicle`
From Version	5.0.0
Tasks	12

README

This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them.
Supported integration: Chronicle, Google SecOps

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Chronicle
Google SecOps

Scripts

DeleteContext

Commands

gcb-list-events

Playbook Inputs

Name	Description	Required
chronicleasset_hostname	The hostname associated with the ChronicleAsset.	Optional
chronicleasset_ip	The IP address associated with the ChronicleAsset.	Optional
chronicleasset_mac	The MAC address associated with the ChronicleAsset.	Optional
chronicleasset_product_id	The product ID associated with the ChronicleAsset.	Optional

Playbook Outputs

Path	Description	Type
GoogleChronicleBackstory.Events	List of events associated with the ChronicleAsset.	unknown

Playbook Image

List Device Events - Chronicle

Inputs

chronicleasset_hostname — The hostname associated with the ChronicleAsset.
chronicleasset_ip — The IP address associated with the ChronicleAsset.
chronicleasset_mac — The MAC address associated with the ChronicleAsset.
chronicleasset_product_id — The product ID associated with the ChronicleAsset.

Outputs

GoogleChronicleBackstory.Events — List of events associated with the ChronicleAsset.

Commands used

gcb-list-events

Flowchart

Source

playbook-List_Device_Events_-_Chronicle.yml

Download History Raw

id: List Device Events - Chronicle
version: -1
name: List Device Events - Chronicle
description: |-
  This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them.
  Supported integration:
  - Chronicle
  - Google SecOps.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 748f07e4-7cd5-4c08-8796-72b986943c39
    type: start
    task:
      id: 748f07e4-7cd5-4c08-8796-72b986943c39
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 350,
          "y": -300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: ec8a3378-eb0b-4177-8146-b5f70dfad165
    type: title
    task:
      id: ec8a3378-eb0b-4177-8146-b5f70dfad165
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 350,
          "y": 1530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 8ec83674-1d65-4f01-806e-1cef09eb88dd
    type: condition
    task:
      id: 8ec83674-1d65-4f01-806e-1cef09eb88dd
      version: -1
      name: Is there a hostname associated with the ChronicleAsset?
      description: Checks if there is a hostname associated with the ChronicleAsset.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.chronicleasset_hostname
            iscontext: true
    view: |-
      {
        "position": {
          "x": 120,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 9b07f072-9f31-4e06-8dd8-d000158fac31
    type: regular
    task:
      id: 9b07f072-9f31-4e06-8dd8-d000158fac31
      version: -1
      name: Get the list of events for the IP address
      description: Gets the list of events discovered within your enterprise for the specified IP address within the specified time range.
      script: '|||gcb-list-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      asset_identifier:
        complex:
          root: inputs.chronicleasset_ip
      asset_identifier_type:
        simple: IP Address
      preset_time_range:
        simple: Last 30 days
    reputationcalc: 3
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -110,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: ed8d8fa0-3da8-488d-88f3-642745da7e47
    type: regular
    task:
      id: ed8d8fa0-3da8-488d-88f3-642745da7e47
      version: -1
      name: Get the list of events for the product ID
      description: Gets the list of events discovered within your enterprise for the specified product ID within the specified time range.
      script: '|||gcb-list-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      asset_identifier:
        complex:
          root: inputs.chronicleasset_product_id
      asset_identifier_type:
        simple: Product ID
      preset_time_range:
        simple: Last 30 days
    reputationcalc: 3
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -110,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 164373e3-b86b-4a97-8964-aba5c281f8eb
    type: regular
    task:
      id: 164373e3-b86b-4a97-8964-aba5c281f8eb
      version: -1
      name: Get the list of events for the MAC address
      description: Gets the list of events discovered within your enterprise for the specified MAC address within the specified time range.
      script: '|||gcb-list-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      asset_identifier:
        complex:
          root: inputs.chronicleasset_mac
      asset_identifier_type:
        simple: MAC Address
      preset_time_range:
        simple: Last 30 days
    reputationcalc: 3
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -110,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 607fc131-6d40-44d4-80ec-b3ff599e692a
    type: regular
    task:
      id: 607fc131-6d40-44d4-80ec-b3ff599e692a
      version: -1
      name: Get the list of events for the hostname
      description: Gets the list of events discovered within your enterprise for the specified hostname within the specified time range.
      script: '|||gcb-list-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      asset_identifier:
        complex:
          root: inputs.chronicleasset_hostname
      asset_identifier_type:
        simple: Host Name
      preset_time_range:
        simple: Last 30 days
    reputationcalc: 3
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -110,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 4b5bc9bf-b67f-40b9-80e2-cecb1546568c
    type: condition
    task:
      id: 4b5bc9bf-b67f-40b9-80e2-cecb1546568c
      version: -1
      name: Is there an IP address associated with the ChronicleAsset?
      description: Checks if there is an IP address associated with the ChronicleAsset.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.chronicleasset_ip
            iscontext: true
    view: |-
      {
        "position": {
          "x": 120,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 7e9310ee-f784-4d99-8a2a-72dc2782515d
    type: condition
    task:
      id: 7e9310ee-f784-4d99-8a2a-72dc2782515d
      version: -1
      name: Is there a MAC address associated with the ChronicleAsset?
      description: Checks if there is a MAC address associated with the ChronicleAsset.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.chronicleasset_mac
            iscontext: true
    view: |-
      {
        "position": {
          "x": 120,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: bab568a7-8c26-4fe2-8dd2-9f93c73b7933
    type: condition
    task:
      id: bab568a7-8c26-4fe2-8dd2-9f93c73b7933
      version: -1
      name: Is there a product ID associated with the ChronicleAsset?
      description: Checks if there is a product ID associated with the ChronicleAsset.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.chronicleasset_product_id
            iscontext: true
    view: |-
      {
        "position": {
          "x": 120,
          "y": 1180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 4ade3d59-7c84-4508-8fb9-39746609d52f
    type: condition
    task:
      id: 4ade3d59-7c84-4508-8fb9-39746609d52f
      version: -1
      name: Is the Chronicle or Google SecOps integration enabled?
      description: Checks whether there is an active instance of the Chronicle or Google SecOps integration.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "36"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Google Chronicle Backstory
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
          right:
            value: {}
        - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: GoogleSecOps
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 350,
          "y": -170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 6784ef44-7bb5-46c7-8701-7b03563bc39d
    type: regular
    task:
      id: 6784ef44-7bb5-46c7-8701-7b03563bc39d
      version: -1
      name: Clear the list of events fetched for the previous indicator
      description: Deletes the "GoogleChronicleBackstory.Events" key from the context to clear the list of events fetched for the previous indicator.
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      key:
        simple: GoogleChronicleBackstory.Events
      subplaybook:
        simple: auto
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 120,
          "y": 0
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "14_2_#default#": 0.33,
      "35_2_#default#": 0.11,
      "5_11_yes": 0.47,
      "5_12_#default#": 0.42
    },
    "paper": {
      "dimensions": {
        "height": 1895,
        "width": 840,
        "x": -110,
        "y": -300
      }
    }
  }
inputs:
- key: chronicleasset_hostname
  value: {}
  required: false
  description: The hostname associated with the ChronicleAsset.
  playbookInputQuery:
- key: chronicleasset_ip
  value: {}
  required: false
  description: The IP address associated with the ChronicleAsset.
  playbookInputQuery:
- key: chronicleasset_mac
  value: {}
  required: false
  description: The MAC address associated with the ChronicleAsset.
  playbookInputQuery:
- key: chronicleasset_product_id
  value: {}
  required: false
  description: The product ID associated with the ChronicleAsset.
  playbookInputQuery:
outputs:
- contextPath: GoogleChronicleBackstory.Events
  description: List of events associated with the ChronicleAsset.
  type: unknown
fromversion: 5.0.0
tests:
- No tests (auto formatted)