LogRhythmRestV2 - Search query

id: LogRhythmRestV2 - Search query
version: -1
name: LogRhythmRestV2 - Search query
description: 'This playbook used generic polling to get query results using the command: lr-execute-search-query.'
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 3526d18a-1838-430e-8c3e-176384cfc476
    type: start
    task:
      id: 3526d18a-1838-430e-8c3e-176384cfc476
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '5'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '5':
    id: '5'
    taskid: 69b4bbd3-aef3-4374-8307-b16fb29724bb
    type: regular
    task:
      id: 69b4bbd3-aef3-4374-8307-b16fb29724bb
      version: -1
      name: Execute search query
      description: Execute a search query to the LogRhythm log database.
      script: '|||lr-execute-search-query'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '6'
    scriptarguments:
      entity_id:
        complex:
          root: inputs.entity_id
      hash:
        complex:
          root: inputs.hash
      host-name:
        complex:
          root: inputs.host-name
      host_name:
        complex:
          root: inputs.host_name
      ip_address:
        complex:
          root: inputs.ip_address
      ipaddress:
        complex:
          root: inputs.ipaddress
      max_massage:
        complex:
          root: inputs.max_massage
      max_message:
        complex:
          root: inputs.max_massage
      number-of-date:
        complex:
          root: inputs.number-of-date
      number_of_date:
        complex:
          root: inputs.number_of_date
      number_of_days:
        complex:
          root: inputs.number_of_days
      object:
        complex:
          root: inputs.object
      process-name:
        complex:
          root: inputs.process-name
      process_name:
        complex:
          root: inputs.process_name
      query_timeout:
        complex:
          root: inputs.query_timeout
      recipient:
        complex:
          root: inputs.recipient
      sender:
        complex:
          root: inputs.sender
      source-type:
        complex:
          root: inputs.source-type
      source_type:
        complex:
          root: inputs.source_type
      subject:
        complex:
          root: inputs.subject
      url:
        complex:
          root: inputs.URL
      username:
        complex:
          root: inputs.username
      search_name:
        complex:
          root: inputs.search_name
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '6':
    id: '6'
    taskid: bbb6ddc2-ed6d-43cd-8f39-89bf5c3fdf57
    type: playbook
    task:
      id: bbb6ddc2-ed6d-43cd-8f39-89bf5c3fdf57
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '7'
    scriptarguments:
      Ids:
        complex:
          root: LogRhythm.Search
          accessor: TaskId
      Interval:
        simple: '1'
      PollingCommandArgName:
        simple: task_id
      PollingCommandName:
        simple: lr-get-query-result
      Timeout:
        simple: '60'
      dt:
        simple: LogRhythm.Search(val.TaskStatus == 'Searching' || val.TaskStatus == 'First Results' || val.TaskStatus == 'Queued' || val.TaskStatus == 'Paused').TaskId
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '7':
    id: '7'
    taskid: 71283421-3034-44cf-8d26-74fcfcdb280a
    type: regular
    task:
      id: 71283421-3034-44cf-8d26-74fcfcdb280a
      version: -1
      name: Get results
      description: Get search query results with task ID output from the lr-execute-search-query command.
      script: '|||lr-get-query-result'
      type: regular
      iscommand: true
      brand: ''
    scriptarguments:
      task_id:
        complex:
          root: LogRhythm.Search
          accessor: TaskId
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 590,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: number_of_days
  value:
    simple: '7'
  required: true
  description: Number of days to search.
  playbookInputQuery:
- key: search_name
  value: {}
  required: false
  description: Name of the search.
  playbookInputQuery:
- key: source_type
  value: {}
  required: false
  description: Log source type.
  playbookInputQuery:
- key: host_name
  value: {}
  required: false
  description: Impacted host name.
  playbookInputQuery:
- key: username
  value: {}
  required: false
  description: Username.
  playbookInputQuery:
- key: subject
  value: {}
  required: false
  description: Email subject.
  playbookInputQuery:
- key: sender
  value: {}
  required: false
  description: Email sender.
  playbookInputQuery:
- key: recipient
  value: {}
  required: false
  description: Email recipient.
  playbookInputQuery:
- key: hash
  value: {}
  required: false
  description: Hash.
  playbookInputQuery:
- key: URL
  value: {}
  required: false
  description: URL.
  playbookInputQuery:
- key: process_name
  value: {}
  required: false
  description: Process name.
  playbookInputQuery:
- key: object
  value: {}
  required: false
  description: Log object.
  playbookInputQuery:
- key: ip_address
  value: {}
  required: false
  description: IP address.
  playbookInputQuery:
- key: max_massage
  value:
    simple: '10'
  required: false
  description: Maximum number of log messages to query.
  playbookInputQuery:
- key: query_timeout
  value:
    simple: '60'
  required: false
  description: The query timeout in seconds.
  playbookInputQuery:
- key: entity_id
  value: {}
  required: false
  description: Entity ID.
  playbookInputQuery:
outputs:
- contextPath: LogRhythm.Search.TaskStatus
  description: Task Status.
  type: string
- contextPath: LogRhythm.Search.TaskId
  description: Task Id.
  type: string
- contextPath: LogRhythm.Search.SearchName
  description: The name of the search query in Cortex XSOAR.
  type: string
- contextPath: LogRhythm.Search.Results.originEntityId
  description: Entity ID.
  type: number
- contextPath: LogRhythm.Search.Results.impactedIp
  description: Impacted IP address.
  type: string
- contextPath: LogRhythm.Search.Results.classificationTypeName
  description: Classification name.
  type: string
- contextPath: LogRhythm.Search.Results.logSourceName
  description: Log source name.
  type: string
- contextPath: LogRhythm.Search.Results.entityName
  description: Entity name.
  type: string
- contextPath: LogRhythm.Search.Results.normalDate
  description: Date.
  type: date
- contextPath: LogRhythm.Search.Results.vendorMessageId
  description: Vendor log message.
  type: string
- contextPath: LogRhythm.Search.Results.priority
  description: Log priority.
  type: number
- contextPath: LogRhythm.Search.Results.sequenceNumber
  description: Sequence number.
  type: string
- contextPath: LogRhythm.Search.Results.originHostId
  description: Origin host ID.
  type: number
- contextPath: LogRhythm.Search.Results.mpeRuleId
  description: LogRhythm rule ID.
  type: number
- contextPath: LogRhythm.Search.Results.originIp
  description: Origin IP address.
  type: string
- contextPath: LogRhythm.Search.Results.mpeRuleName
  description: LogRhythm rule name.
  type: string
- contextPath: LogRhythm.Search.Results.logSourceHostId
  description: Log source host ID.
  type: number
- contextPath: LogRhythm.Search.Results.originHost
  description: Origin host.
  type: string
- contextPath: LogRhythm.Search.Results.logDate
  description: Log date.
  type: date
- contextPath: LogRhythm.Search.Results.classificationName
  description: Log classification name.
  type: string
fromversion: 5.5.0
tests:
- LogRhythmRestV2-test