Malware Investigation and Response - Set Alerts Grid

This playbook sets the alert grid for the Malware Investigation & Response layout.

Malware Investigation and Response · 10 tasks · 7 inputs · 0 outputs

Details

ID	`Malware Investigation and Response - Set Alerts Grid`
From Version	6.5.0
Tasks	10

README

This playbook sets the alert grid for the Malware Investigation & Response layout.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

Set
SetGridField

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Required
AlertName	The alert name.	Optional
HostName	The host name.	Optional
FileName	The file name.	Optional
ProcessID	The process ID.	Optional
SHA256	The SHA256 file hash.	Optional
CommandLine	The command line.	Optional
ParentProcess	The parent process.	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Malware Investigation and Response - Set Alerts Grid

Inputs

AlertName — The alert name.
HostName — The host name.
FileName — The file name.
ProcessID — The process ID.
SHA256 — The SHA256 file hash.
CommandLine — The command line.
ParentProcess — The parent process.

Flowchart

Source

playbook-Malware_Investigation_and_Response_-_Set_Alerts_Grid.yml

Download History Raw

id: Malware Investigation and Response - Set Alerts Grid
version: -1
name: Malware Investigation and Response - Set Alerts Grid
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 3f1ca3bc-b912-44a7-81ef-e8adac0622ae
    type: start
    task:
      id: 3f1ca3bc-b912-44a7-81ef-e8adac0622ae
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '1'
      - '5'
      - '4'
      - '3'
      - '2'
      - '6'
      - '7'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2390,
          "y": 1900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '1':
    id: '1'
    taskid: 35436672-e47c-48df-813a-f19d590233f5
    type: regular
    task:
      id: 35436672-e47c-48df-813a-f19d590233f5
      version: -1
      name: Set alert name to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      key:
        simple: alertsGrid.alertname
      value:
        complex:
          root: inputs.AlertName
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: N/A
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: db8fa0d5-9d62-4689-80f7-812947bafe0d
    type: regular
    task:
      id: db8fa0d5-9d62-4689-80f7-812947bafe0d
      version: -1
      name: Set commandline to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      key:
        simple: alertsGrid.processCommandLine
      value:
        complex:
          root: inputs.CommandLine
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: N/A
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2820,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '3':
    id: '3'
    taskid: 7f4daeb4-d7d0-4f36-8c91-48b3ba290a49
    type: regular
    task:
      id: 7f4daeb4-d7d0-4f36-8c91-48b3ba290a49
      version: -1
      name: Set SHA256 to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      key:
        simple: alertsGrid.sha256
      value:
        complex:
          root: inputs.SHA256
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: N/A
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2390,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '4':
    id: '4'
    taskid: fdb88fac-b0e3-4e67-8055-97ad6d2e4dd2
    type: regular
    task:
      id: fdb88fac-b0e3-4e67-8055-97ad6d2e4dd2
      version: -1
      name: Set process name to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      key:
        simple: alertsGrid.processname
      value:
        complex:
          root: inputs.FileName
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: N/A
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1960,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '5':
    id: '5'
    taskid: 12b53c4a-8f90-4e85-85c0-ee5e335fd662
    type: regular
    task:
      id: 12b53c4a-8f90-4e85-85c0-ee5e335fd662
      version: -1
      name: Set device name to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      key:
        simple: alertsGrid.hostname
      value:
        complex:
          root: inputs.HostName
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: N/A
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '6':
    id: '6'
    taskid: 045ccef5-4889-4e24-8621-097dc1b52c56
    type: regular
    task:
      id: 045ccef5-4889-4e24-8621-097dc1b52c56
      version: -1
      name: Set Parent Process to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      key:
        simple: alertsGrid.parentprocess
      value:
        complex:
          root: inputs.ParentProcess
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: N/A
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3270,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '7':
    id: '7'
    taskid: 20d0dae5-8e56-43ef-8bda-79b1a9dca378
    type: regular
    task:
      id: 20d0dae5-8e56-43ef-8bda-79b1a9dca378
      version: -1
      name: Set Process ID to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      key:
        simple: alertsGrid.processId
      value:
        complex:
          root: inputs.ProcessID
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: N/A
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3720,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '8':
    id: '8'
    taskid: c40f658e-10d3-4a8c-8aa2-ab9230d8ac9a
    type: title
    task:
      id: c40f658e-10d3-4a8c-8aa2-ab9230d8ac9a
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2390,
          "y": 2460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '9':
    id: '9'
    taskid: 439048e5-e282-4b35-857e-6db61f59aabf
    type: regular
    task:
      id: 439048e5-e282-4b35-857e-6db61f59aabf
      version: -1
      name: Set Alerts Table Info in the Layout
      description: Creates a Grid table from items or key-value pairs.
      scriptName: SetGridField
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '8'
    scriptarguments:
      columns:
        simple: Alert Name,Hostname,File Name,Process ID, SHA256,Command Line,Parent Process
      context_path:
        simple: alertsGrid
      grid_id:
        simple: alertsandrelatedinfo
      keys:
        simple: alertname,hostname,processname,processId,sha256,processCommandLine,parentprocess
      overwrite:
        simple: 'true'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2390,
          "y": 2260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 625,
        "width": 3000,
        "x": 1100,
        "y": 1900
      }
    }
  }
inputs:
- key: AlertName
  value: {}
  required: false
  description: The alert name.
  playbookInputQuery:
- key: HostName
  value: {}
  required: false
  description: The host name.
  playbookInputQuery:
- key: FileName
  value: {}
  required: false
  description: The file name.
  playbookInputQuery:
- key: ProcessID
  value: {}
  required: false
  description: The process ID.
  playbookInputQuery:
- key: SHA256
  value: {}
  required: false
  description: The SHA256 file hash.
  playbookInputQuery:
- key: CommandLine
  value: {}
  required: false
  description: The command line.
  playbookInputQuery:
- key: ParentProcess
  value: {}
  required: false
  description: The parent process.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0
description: This playbook sets the alert grid for the Malware Investigation & Response layout.