PCAP Parsing And Indicator Enrichment

This playbook is used to parse and extract indicators within PCAP files and perform enrichment on the detected indicators. Supported file types are pcap, cap, pcapng. The playbook can handle one PCAP file per incident. The user inputs which indicator types are to be enriched including, email, URLs, IP addresses. The user can specify in the inputs which indicators are internal or that will be treated as internal (not enriched). The user can also specify a specific regex pattern to search for. Another option is to specify the protocol types to be printed to context for data extraction. Additional inputs allow the user to provide the WPA password for decrypting 802.11 (wireless) traffic and add an RSA certificate to decrypt SSL traffic. To display the results within the relevant incident fields, the playbook needs to run in a PCAP Analysis incident type. For handling of PCAP files larger than 30 MB, refer to the PcapMinerV2 documentation.

PCAP Analysis · 50 tasks · 10 inputs · 9 outputs

Inputs

  • PcapFilter — This input specifies a search filter to be used on the pcap file. Filters can be used to search only for a specific IP, protocols, and other examples. The syntax is the same as in Wireshark which can be found here: https://www.wireshark.org/docs/man-pages/wireshark-filter.html Using a filter can improve performance and decrease the output results.
  • ProtocolsToOutput — This input provides which protocols to output to context. This can be a single or several protocols from this list HTTP DNS LLMNR SYSLOG SMTP NETBIOS ICMP KERBEROS TELNET SSH IRC FTP SMB2 To provide more than one protocol use comma separation such as DNS,FTP Each selected protocol will have its own unique data displayed in context. Such as HTTP data, SMTP data etc.
  • RegexToSearch — This input value is used to provide a python regular expression to search in the the packet body. An example can be \w{10} for expressions that have 10 letter words.
  • WpaPassword — This input value is used to provide a WPA (Wi-Fi Protected Access) password to decrypt encrypted Wi-FI traffic.
  • WhichIndicatorTypeToEnrich — This input checks which indicator types that will be extracted from the PCAP will be enriched. Values can be ip email url To provide more than one indicator type use comma separation such as ip,url,email
  • InternalUrlName — The organization's internal URL name. This is provided for the script IsInternalHostName that checks if the detected URLs are internal or external if the hosts contain the internal domains suffix. For example demisto.com. If there is more than one domain, use comma separation such as demisto.com,paloaltonetworks.com. Another example value can be localhost.
  • InternalEmailDomainName — The organization's internal email domain name. This is provided for the script IsEmailAddressInternal that checks if the detected emails are internal or external. This input can contain a List of internal domains to check, comma separated
  • InternalIPRange — A list of internal IP ranges to check IP addresses against. The list should be provided in CIDR format, separated by commas. An example of a list of ranges could be: 172.16.0.0/12,10.0.0.0/8,192.168.0.0/16. If a list of IP ranges is not provided, the list provided in the IsIPInRanges script (the known IPv4 private address ranges) is used by default.
  • PcapFileEntryID — This input specifics the file entry id for the PCAP file if the user provided the file in the incident. One PCAP file can run per incident.
  • RsaDecryptKeyEntryID — This input specifics the file entry id for the RSA decrypt key if the user provided the key in the incident.

Outputs

  • InternalIPAddresses — The internal IP addresses that were found in the PCAP.
  • ExternalIPAddresses — The external IP addresses that were found in the PCAP.
  • ExternalEmailAddresses — The external email addresses that were found in the PCAP.
  • InternalEmailAddresses — The internal email addresses that were found in the PCAP.
  • ExternalUrls — The external URLs that were found in the PCAP.
  • InternalUrls — The internal URLs that were found in the PCAP.
  • PCAPResults.Protocols — List of protocols found in the PCAP.
  • DestinationTcpPorts — A list of destination TCP ports that were found in the PCAP.
  • DestinationUdpPorts — A list of destination UDP ports that were found in the PCAP.

Commands used

email ip url

Flowchart

yes yes yes yes yes yes yes yes yes yes yes yes yes yes Start Start Is there a PCAP file? Is there a PCAP file? Are there flow results? Are there flow results? PCAP Miner execution - PcapMinerV2 PCAP Miner execution PcapMinerV2 IPs IPs Are there ip results? Are there ip results? Done IP Done IP Sort internal and external IPs Sort internal and externa... Determine whether the IP addresses are internal or external - IsIPInRanges Determine whether the IP ... IsIPInRanges Set detected IP addresses as internal - SetAndHandleEmpty Set detected IP addresses... SetAndHandleEmpty Set detected IP addresses as external - SetAndHandleEmpty Set detected IP addresses... SetAndHandleEmpty Enrich IP Enrich IP Are there external IP addresses? Are there external IP add... Enrich IPs - ip Enrich IPs ip Auto enrich IPs? Auto enrich IPs? Emails Emails Are there email results? Are there email results? Sort internal and external emails Sort internal and externa... Done emails Done emails Determine whether the emails are internal or external - IsEmailAddressInternal Determine whether the ema... IsEmailAddressInternal Set detected emails as internal - SetAndHandleEmpty Set detected emails as in... SetAndHandleEmpty Set detected emails as external - SetAndHandleEmpty Set detected emails as ex... SetAndHandleEmpty Enrich email Enrich email Are there external emails? Are there external emails? Set detected emails as external - SetAndHandleEmpty Set detected emails as ex... SetAndHandleEmpty Auto enrich emails? Auto enrich emails? Enrich Emails - email Enrich Emails email URLs URLs Are there URL results? Are there URL results? Done URLs Done URLs Sort internal and external urls Sort internal and externa... Has the internal url suffix name been provided? Has the internal url suff... Determine whether the URLs are internal or external - IsUrlPartOfDomain Determine whether the URL... IsUrlPartOfDomain Set internal URLs - SetAndHandleEmpty Set internal URLs SetAndHandleEmpty Set external URLs - SetAndHandleEmpty Set external URLs SetAndHandleEmpty Enrich URLs Enrich URLs Are there external URLs? Are there external URLs? Auto enrich URLs? Auto enrich URLs? Enrich URLs - url Enrich URLs url Set detected URLs as external - SetAndHandleEmpty Set detected URLs as exte... SetAndHandleEmpty Was an internal email domain provided? Was an internal email dom... Done Done Set detected protocols - SetAndHandleEmpty Set detected protocols SetAndHandleEmpty Set internal IP addresses - SetAndHandleEmpty Set internal IP addresses SetAndHandleEmpty Set external IP addresses - SetAndHandleEmpty Set external IP addresses SetAndHandleEmpty Set destination TCP ports - SetAndHandleEmpty Set destination TCP ports SetAndHandleEmpty Set destination UDP ports - SetAndHandleEmpty Set destination UDP ports SetAndHandleEmpty Is this a PCAP analysis incident type? Is this a PCAP analysis i... Set common fields Set common fields Set incident fields - SetGridField Set incident fields SetGridField