PCAP Analysis

id: PCAP Analysis
version: -1
name: PCAP Analysis
description: 'This playbook leverages all of the PCAP miner and PCAP file extractor sub playbook capabilities, including: 
* Search for specific values in a PCAP file * Parse and enrich detected indicators such as IP addresses, URLs, email addresses and domains found by the search . 
* Carve (extract) files found in the http, smb and other protocols and perform enrichment and detonation.'
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9dad1664-4299-47a2-8962-08281f4fc1e5
    type: start
    task:
      id: 9dad1664-4299-47a2-8962-08281f4fc1e5
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: aea572b9-9463-40a1-8608-96ec26723825
    type: playbook
    task:
      id: aea572b9-9463-40a1-8608-96ec26723825
      version: -1
      name: PCAP Parsing And Indicator Enrichment
      description: This playbook is used to parse and extract indicators within PCAP
        files and perform enrichment on the detected indicators. Supported file types
        are pcap, cap, pcapng. The playbook can handle one PCAP file per incident.
        The user inputs which indicator types are to be enriched including, email,
        URLs, IP addresses. The user can specify in the inputs which indicators are
        internal or should be treated as internal (not enriched). The user can
        also specify a regex pattern to search for. Another option is to
        specify the protocol types to be printed to context for data extraction. Additional
        inputs allow the user to provide the WPA password for decrypting 802.11 (wireless)
        traffic and add an RSA certificate to decrypt SSL traffic. To display the
        results within the relevant incident fields, the playbook needs to run in
        a PCAP Analysis incident type. For handling of PCAP files larger than 30 MB,
        refer to the PcapMinerV2 documentation.
      playbookName: PCAP Parsing And Indicator Enrichment
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      InternalEmailDomainName:
        simple: ${inputs.InternalEmailDomainName}
      InternalIPRange:
        simple: ${inputs.InternalIPRange}
      InternalUrlName:
        simple: ${inputs.InternalUrlName}
      PcapFileEntryID:
        simple: ${inputs.PcapFileEntryID}
      PcapFilter:
        simple: ${PcapQuery}
      ProtocolsToOutput:
        complex:
          root: DetectedProtocols
          transformers:
          - operator: toUpperCase
          - operator: join
            args:
              separator:
                value:
                  simple: ','
      RegexToSearch:
        simple: ${inputs.RegexToSearch}
      RsaDecryptKeyEntryID:
        simple: ${inputs.RsaDecryptKeyEntryID}
      WhichIndicatorTypeToEnrich:
        simple: ${inputs.WhichIndicatorTypeToEnrich}
      WpaPassword:
        simple: ${inputs.WpaPassword}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -190,
          "y": 1150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: e9ccc667-7efb-4e4f-8dd8-35e16da7c831
    type: title
    task:
      id: e9ccc667-7efb-4e4f-8dd8-35e16da7c831
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 3231ec24-4dba-4c33-861e-147c6bbc128f
    type: condition
    task:
      id: 3231ec24-4dba-4c33-861e-147c6bbc128f
      version: -1
      name: Is there a PCAP file?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.PcapFileEntryID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: c706b943-a071-48b8-8db0-d0825e418456
    type: condition
    task:
      id: c706b943-a071-48b8-8db0-d0825e418456
      version: -1
      name: Run parsing and enrichment?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.RunParsingAndEnrichment
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 70,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 64116075-291c-44ca-884a-d2aab91c991e
    type: condition
    task:
      id: 64116075-291c-44ca-884a-d2aab91c991e
      version: -1
      name: Were there results from the search?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: DetectedProtocols
            iscontext: true
    view: |-
      {
        "position": {
          "x": -50,
          "y": 950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: a92d5882-2440-414e-8ee6-561330cad319
    type: playbook
    task:
      id: a92d5882-2440-414e-8ee6-561330cad319
      version: -1
      name: PCAP Search
      description: This playbook is used to parse and search within PCAP files. Supported
        file types are pcap, cap, pcapng. The playbook can handle one PCAP file per
        incident. The user inputs which objects the playbook should search for in
        the PCAP. The values to search are IP addresses, CIDR ranges, and TCP or UDP
        ports or protocols. In the event that more than one input type was specified,
        specify in the QueryOperator input (such as IP addresses and TCP ports) if
        the PCAP filter query will use an AND or an OR operator between the inputs.  Another
        option is to use advanced filters just like in Wireshark to use refined filters
        or for objects not specified in other inputs. Additional inputs allow the
        user to provide the WPA password for decrypting 802.11 (wireless) traffic
        and adding an RSA certificate to decrypt SSL traffic. To display the results
        within the relevant incident fields, the playbook needs to run in a PCAP Analysis
        incident type. For handling of PCAP files larger than 30 MB, refer to the
        PcapMinerV2 documentation.
      playbookName: PCAP Search
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      AdvancedSearchFilter:
        simple: ${inputs.AdvancedSearchFilter}
      IPAddressToSearch:
        simple: ${inputs.IPAddressToSearch}
      InternalIPRange:
        simple: ${inputs.InternalIPRange}
      PcapFileEntryID:
        simple: ${inputs.PcapFileEntryID}
      ProtocolToSearch:
        simple: ${inputs.ProtocolToSearch}
      QueryOperator:
        simple: ${inputs.QueryOperator}
      RsaDecryptKeyEntryID:
        simple: ${inputs.RsaDecryptKeyEntryID}
      TCPPortsToSearch:
        simple: ${inputs.TCPPortsToSearch}
      UDPPortsToSearch:
        simple: ${inputs.UDPPortsToSearch}
      WpaPassword:
        simple: ${inputs.WpaPassword}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 220,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 28055ce9-9b64-485e-8784-cf63c175368c
    type: playbook
    task:
      id: 28055ce9-9b64-485e-8784-cf63c175368c
      version: -1
      name: PCAP File Carving
      description: This playbook is used to carve (extract) files from within PCAP
        files and perform enrichment and detonation of the extracted files. Supported
        PCAP file types are pcap, cap, pcapng. The playbook can handle one PCAP file
        per incident. Additional inputs allow the user to provide the WPA password
        for decrypting 802.11 (wireless) traffic and adding an RSA certificate to
        decrypt SSL traffic. Additional options enable you to filter the files to
        extract according to the file extension or the file actual type (MIME) and
        limit the amount of files to extract. Another feature enables you to specify
        a filter to create a new smaller PCAP file. To display the results within
        the relevant incident fields, the playbook needs to run in a PCAP Analysis
        incident type. For handling of PCAP files larger than 30 MB, refer to the
        PcapMinerV2 documentation.
      playbookName: PCAP File Carving
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      AutoDetonateFiles:
        simple: ${inputs.AutoDetonateFiles}
      ExtractedFilesLimit:
        simple: ${inputs.ExtractedFilesLimit}
      FileExtensionFilter:
        simple: ${inputs.FileExtensionFilter}
      FileTypeFilter:
        simple: ${inputs.FileTypeFilter}
      FilterType:
        simple: ${inputs.FilterType}
      PcapFileEntryID:
        simple: ${inputs.PcapFileEntryID}
      PcapFilter:
        simple: ${PcapQuery}
      RsaDecryptKeyEntryID:
        simple: ${inputs.RsaDecryptKeyEntryID}
      WpaPassword:
        simple: ${inputs.WpaPassword}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1110,
          "y": 1140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 2c3cfd36-e19f-4417-8583-dd77b610707a
    type: condition
    task:
      id: 2c3cfd36-e19f-4417-8583-dd77b610707a
      version: -1
      name: Were protocols containing files were found?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: inList
          left:
            value:
              simple: DetectedProtocols
            iscontext: true
          right:
            value:
              simple: HTTP,SMB,SMB2,IMF,TFTP,FTP,DICOM
    view: |-
      {
        "position": {
          "x": 970,
          "y": 940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 02be9672-9b93-442b-89ac-a3fc8885c241
    type: condition
    task:
      id: 02be9672-9b93-442b-89ac-a3fc8885c241
      version: -1
      name: Run file carving?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.RunFileCarving
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 830,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 3c254f55-d456-4fdc-8465-bd265f4c924a
    type: condition
    task:
      id: 3c254f55-d456-4fdc-8465-bd265f4c924a
      version: -1
      name: Were there results from the search?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "5"
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: DetectedProtocols
            iscontext: true
    view: |-
      {
        "position": {
          "x": 220,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "10_3_#default#": 0.69,
      "4_3_#default#": 0.81
    },
    "paper": {
      "dimensions": {
        "height": 1355,
        "width": 1680,
        "x": -190,
        "y": 70
      }
    }
  }
inputs:
- key: PcapFileEntryID
  value:
    complex:
      root: File
      filters:
      - - operator: inList
          left:
            value:
              simple: File.Name
            iscontext: true
          right:
            value:
              simple: incident.pcapfile.name
            iscontext: true
        - operator: isEqualString
          left:
            value:
              simple: File.Extension
            iscontext: true
          right:
            value:
              simple: pcap
        - operator: isEqualString
          left:
            value:
              simple: File.Extension
            iscontext: true
          right:
            value:
              simple: cap
        - operator: isEqualString
          left:
            value:
              simple: File.Extension
            iscontext: true
          right:
            value:
              simple: pcapng
      accessor: EntryID
  required: false
  description: This input specifies the file entry ID for the PCAP file if the user
    provided the file in the incident. One PCAP file can run per incident.
  playbookInputQuery:
- key: RunParsingAndEnrichment
  value:
    simple: "true"
  required: false
  description: This input specifies whether to run the parsing and enrichment playbook.
    Values can be true or any other value for false.
  playbookInputQuery:
- key: RunFileCarving
  value:
    simple: "true"
  required: false
  description: This input specifies whether to run the file carving playbook. Values
    can be true or any other value for false.
  playbookInputQuery:
- key: RsaDecryptKeyEntryID
  value:
    complex:
      root: File
      filters:
      - - operator: inList
          left:
            value:
              simple: File.Name
            iscontext: true
          right:
            value:
              simple: incident.pcapencryptionkey.name
            iscontext: true
        - operator: isEqualString
          left:
            value:
              simple: File.Extension
            iscontext: true
          right:
            value:
              simple: key
      accessor: EntryID
  required: false
  description: This input specifies the file entry ID for the RSA decrypt key if the
    user provided the key in the incident.
  playbookInputQuery:
- key: WpaPassword
  value: {}
  required: false
  description: This input value is used to provide a WPA (Wi-Fi Protected Access)
    password to decrypt encrypted 802.11 Wi-FI traffic.
  playbookInputQuery:
- key: QueryOperator
  value:
    simple: and
  required: false
  description: |-
    In case the playbook has several search inputs provided such as IPAddressToSearch, TCPPortsToSearch ,UDPPortsToSearch, ProtocolToSearch and AdvancedSearchFilter. This input will specify if the inputs will be treated as an AND or an OR search for all the PCAP search filter.
    value can be "and" or "or". The default value is "and",
    If the IPAddressToSearch was defined as 192.168.1.1,192.168.1.2
    The TCPPortsToSearch was defined as 445,443
    And the QueryOperator was defined as "and"
    The resultant query will be (ip.addr == 192.168.1.1 or ip.addr ==  192.168.1.2) and (tcp.port == 445 or tcp.port == 443)
    If the QueryOperator was defined as "or"
    The resultant query will be (ip.addr == 192.168.1.1 or ip.addr ==  192.168.1.2) or (tcp.port == 445 or tcp.port == 443)
  playbookInputQuery:
- key: IPAddressToSearch
  value: {}
  required: false
  description: The value of an IP address to search. Can be a single IP or a comma
    delimited list of IP addresses. CIDR ranges are also acceptable. All IPs will
    be treated with the OR operator.
  playbookInputQuery:
- key: TCPPortsToSearch
  value: {}
  required: false
  description: The value of a TCP port number to search. Can be a single port or a
    comma delimited list of ports. All TCP ports will be treated with the OR operator.
  playbookInputQuery:
- key: UDPPortsToSearch
  value: {}
  required: false
  description: The value of a UDP port number to search. Can be a single port or a
    comma delimited list of ports. All UDP ports will be treated with the OR operator.
  playbookInputQuery:
- key: ProtocolToSearch
  value: {}
  required: false
  description: The protocols to search for within the PCAP file. Can be a single protocol
    or a comma delimited list of protocols. The protocol names should be the same
    as searching in Wireshark. For example smb2, dns etc.  All protocols will be treated
    with the OR operator.
  playbookInputQuery:
- key: AdvancedSearchFilter
  value: {}
  required: false
  description: |-
    Filter to apply on PCAP. Wireshark syntax as can be found here: https://www.wireshark.org/docs/man-pages/wireshark-filter.html
    This input is meant to handle more complex filters not covered by the other inputs. For example search by an attribute such as http.host, arp.dst.hw etc.
  playbookInputQuery:
- key: InternalIPRange
  value: {}
  required: false
  description: 'A list of internal IP ranges to check IP addresses against. The list
    should be provided in CIDR format, separated by commas. An example of a list of
    ranges could be: 172.16.0.0/12,10.0.0.0/8,192.168.0.0/16. If a list of IP ranges
    is not provided, the list provided in the IsIPInRanges script (the known IPv4
    private address ranges) is used by default.'
  playbookInputQuery:
- key: InternalUrlName
  value: {}
  required: false
  description: The organization's internal URL name. This is provided for the script
    IsInternalHostName that checks if the detected URLs are internal or external if
    the hosts contain the internal domains suffix. For example demisto.com. If there
    is more than one domain, use comma separation such as demisto.com,paloaltonetworks.com
  playbookInputQuery:
- key: WhichIndicatorTypeToEnrich
  value:
    simple: ip,url,email
  required: false
  description: "This input checks which indicator types that will be extracted from\
    \ the PCAP will be enriched. Values can be\nip\nemail\nurl\nTo provide more than\
    \ one indicator type use comma separation such as \nip,url,email"
  playbookInputQuery:
- key: InternalEmailDomainName
  value: {}
  required: false
  description: The organization's internal email domain name. This is provided for
    the script IsEmailAddressInternal that checks if the detected emails are internal
    or external. This  input can contain a List of internal domains to check, comma
    separated.
  playbookInputQuery:
- key: RegexToSearch
  value: {}
  required: false
  description: This input value is used to provide a python regular expression to
    search in the the packet body. An example can be \w{10} for expressions that have
    10 letter words.
  playbookInputQuery:
- key: ExtractedFilesLimit
  value:
    simple: "5"
  required: false
  description: This input limits the number of files to be extracted from the PCAP
    file. Default value is 5.
  playbookInputQuery:
- key: FileExtensionFilter
  value: {}
  required: false
  description: |-
    This input is used to select which file extensions to include or exclude from the PCAP file. Extensions must be comma separated, for example, png,gif,exe.
    This setting cannot be used with the FileTypeFilter.
  playbookInputQuery:
- key: FileTypeFilter
  value: {}
  required: false
  description: |-
    This input is used to select which file type (MIME type) to include or exclude from the PCAP file. Extensions must be comma separated, for example, image/jpeg,application/x-javascript
    This setting cannot be used with the FileExtensionFilter.
  playbookInputQuery:
- key: FilterType
  value:
    simple: inclusive
  required: false
  description: |-
    This input is combined with the FileExtensionFilter input or the FileTypeFilter input. It specifies if the type/extensions list is inclusive or exclusive. Can be "inclusive" or "exclusive". Default is "inclusive".
    Default value is 'inclusive'
  playbookInputQuery:
- key: AutoDetonateFiles
  value:
    simple: "True"
  required: false
  description: This input specifies whether to detonate files extracted from the PCAP.
    The default value is True, any other value will be considered as false.
  playbookInputQuery:
outputs:
- contextPath: InternalIPAddresses
  description: The internal IP addresses that were found in the PCAP.
  type: string
- contextPath: ExternalIPAddresses
  description: The external IP addresses that were found in the PCAP.
  type: string
- contextPath: DestinationTcpPorts
  description: A list of destination TCP ports that were found in the PCAP.
  type: string
- contextPath: DestinationUdpPorts
  description: A list of destination UDP ports that were found in the PCAP.
  type: string
- contextPath: DetectedProtocols
  description: A list of protocols that were found in the PCAP.
  type: string
- contextPath: ExternalEmailAddresses
  description: The external email addresses that were found in the PCAP.
  type: string
- contextPath: InternalEmailAddresses
  description: The internal email addresses that were found in the PCAP.
  type: string
- contextPath: ExternalUrls
  description: The external URLs that were found in the PCAP.
  type: string
- contextPath: InternalUrls
  description: The internal URLs that were found in the PCAP.
  type: string
- contextPath: PcapResults.Protocols
  description: List of protocols found in the PCAP.
  type: string
- contextPath: File.Malicious
  description: The File malicious description
  type: string
fromversion: 5.0.0
tests:
- PCAP Analysis Test