Proactive Threat Hunting

This playbook is the main playbook of the 'Proactive Threat Hunting' pack. It automatically runs during a new hunting session and guides the threat hunter through the session based on the selected hunting method. The available hunting methods are: - SDO Hunt: Constructs the hunting hypothesis based on SDO indicators (Campaign, Malware, Intrusion Set). - Freestyle Hunt: Allows the threat hunter to provide their own queries and IOCs for hunting.

Proactive Threat Hunting · 11 tasks · 3 inputs · 0 outputs

Details

ID	`Proactive Threat Hunting`
From Version	6.9.0
Tasks	11

README

This playbook is the main playbook of the ‘Proactive Threat Hunting’ pack. It automatically runs during a new hunting session and guides the threat hunter through the session based on the selected hunting method. The available hunting methods are:

SDO Hunt: Constructs the hunting hypothesis based on SDO indicators (Campaign, Malware, Intrusion Set).
Freestyle Hunt: Allows the threat hunter to provide their own queries and IOCs for hunting.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Proactive Threat Hunting - SDO Threat Hunting

Integrations

This playbook does not use any integrations.

Scripts

Commands

setIncident

Playbook Inputs

Name	Description	Default Value	Required
IncidentTag	A tag that will be attached to Threat Hunting incidents.	Threat Hunting	Optional
HuntingTimeFrame	Time in relative date or range format (for example: “1 day”, “3 weeks ago”, “between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00”). The query execution script default is the last 24 hours.	7 Days	Optional
StringSimilarityThreshold	StringSimilarity automation threshold. StringSimilarity is being used in this playbook to compare between pattern of malicious use in a tool and command-line arguments found in the environment. Please provide number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.	0.5	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Proactive Threat Hunting

Inputs

IncidentTag — A tag that will be attached to Threat Hunting incidents.
StringSimilarityThreshold — StringSimilarity automation threshold. StringSimilarity is being used in this playbook to compare between pattern of malicious use in a tool and command-line arguments found in the environment. Please provide number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.
HuntingTimeFrame — Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The query execution script default is the last 24 hours.

Commands used

setIncident

Flowchart

Source

Download History Raw

id: Proactive Threat Hunting - Endpoint Isolation
version: -1
name: Proactive Threat Hunting - Endpoint Isolation
description: |
  This playbook will be executed from the "Proactive Threat Hunting" layout button with the objective of isolating a host specified by the analyst.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d8cb08d9-07e7-4890-8e1d-d62d3e3dee96
    type: start
    task:
      id: d8cb08d9-07e7-4890-8e1d-d62d3e3dee96
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: aebc98b0-46ba-46e0-8239-b2b67e256c9b
    type: playbook
    task:
      id: aebc98b0-46ba-46e0-8239-b2b67e256c9b
      version: -1
      name: Isolate Endpoint - Generic V2
      description: |-
        This playbook isolates a given endpoint using various endpoint product integrations.
        Make sure to provide valid playbook inputs for the integration you are using.
      playbookName: Isolate Endpoint - Generic V2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      Endpoint_hostname:
        complex:
          root: Select Endpoint To Isolate.Answers
          accessor: "0"
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Select Endpoint To Isolate.Answers.0
                iscontext: true
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 860,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 66dba88b-62e6-42e7-83a7-c27389fdb346
    type: regular
    task:
      id: 66dba88b-62e6-42e7-83a7-c27389fdb346
      version: -1
      name: Print update to notes
      description: Prints text to the War Room. (Markdown supported).
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      value:
        simple: Endpoint isolation procedure has executed. Follow the work plan to continue.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 0
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Endpoint Isolation Status
      output:
        simple: Executed
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 27544442-9757-4523-84f4-49181805f501
    type: collection
    task:
      id: 27544442-9757-4523-84f4-49181805f501
      version: -1
      name: Select endpoint to isolate
      description: Asking the user to select an endpoint to isolate.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Select Endpoint To Isolate
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - {}
        - complex:
            root: incident
            accessor: affectedhosts
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Select Endpoint To Isolate
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 671ae69a-9ca5-438c-8dc0-e2ddd4b4a743
    type: condition
    task:
      id: 671ae69a-9ca5-438c-8dc0-e2ddd4b4a743
      version: -1
      name: Has endpoint to isolate?
      description: Checks the user's choice in the collection task "Select endpoint to isolate".
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Select Endpoint To Isolate.Answers
                accessor: "0"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: cde3f3de-0a07-487e-8107-9ebb7fd0cdf2
    type: title
    task:
      id: cde3f3de-0a07-487e-8107-9ebb7fd0cdf2
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: c921585f-9766-41de-840d-3b0674bd438e
    type: condition
    task:
      id: c921585f-9766-41de-840d-3b0674bd438e
      version: -1
      name: Executed from freestyle hunt?
      description: Checks if the playbook was executed from the Freestyle Hunt tab.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: freestylehunt
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: f765e0c8-4332-4b21-8571-7cf1268938e5
    type: collection
    task:
      id: f765e0c8-4332-4b21-8571-7cf1268938e5
      version: -1
      name: Enter endpoint name to isolate
      description: Asking the user to select an endpoint to isolate.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 860,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Enter Endpoint Name To Isolate
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg:
        - {}
        - simple: "No"
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Enter Endpoint Name To Isolate
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "4_5_#default#": 0.55,
      "6_3_#default#": 0.53
    },
    "paper": {
      "dimensions": {
        "height": 1035,
        "width": 790,
        "x": 450,
        "y": -130
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.9.0