Proactive Threat Hunting

This playbook is the main playbook of the 'Proactive Threat Hunting' pack. It automatically runs during a new hunting session and guides the threat hunter through the session based on the selected hunting method. The available hunting methods are: - SDO Hunt: Constructs the hunting hypothesis based on SDO indicators (Campaign, Malware, Intrusion Set). - Freestyle Hunt: Allows the threat hunter to provide their own queries and IOCs for hunting.

Proactive Threat Hunting · 11 tasks · 3 inputs · 0 outputs

Details

IDProactive Threat Hunting
From Version6.9.0
Tasks11

README

This playbook is the main playbook of the ‘Proactive Threat Hunting’ pack. It automatically runs during a new hunting session and guides the threat hunter through the session based on the selected hunting method. The available hunting methods are:

  • SDO Hunt: Constructs the hunting hypothesis based on SDO indicators (Campaign, Malware, Intrusion Set).
  • Freestyle Hunt: Allows the threat hunter to provide their own queries and IOCs for hunting.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Proactive Threat Hunting - SDO Threat Hunting

Integrations

This playbook does not use any integrations.

Scripts

  • Print

Commands

  • setIncident

Playbook Inputs

Name Description Default Value Required
IncidentTag A tag that will be attached to Threat Hunting incidents. Threat Hunting Optional
HuntingTimeFrame Time in relative date or range format (for example: “1 day”, “3 weeks ago”, “between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00”). The query execution script default is the last 24 hours. 7 Days Optional
StringSimilarityThreshold StringSimilarity automation threshold. StringSimilarity is being used in this playbook to compare between pattern of malicious use in a tool and command-line arguments found in the environment.
Please provide number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.		 0.5 Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Proactive Threat Hunting

Inputs

  • IncidentTag — A tag that will be attached to Threat Hunting incidents.
  • StringSimilarityThreshold — StringSimilarity automation threshold. StringSimilarity is being used in this playbook to compare between pattern of malicious use in a tool and command-line arguments found in the environment. Please provide number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.
  • HuntingTimeFrame — Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The query execution script default is the last 24 hours.

Commands used

setIncident

Flowchart

Yes Freestyle SDO Start Start SDO hunt SDO hunt Set incident tag - setIncident Set incident tag setIncident Done Done Proactive Threat Hunting - SDO Threat Hunting - Proactive Threat Hunting - SDO Threat Hunting Proactive Threat Hunting ... Proactive Threat Hunting - SD... Executed from indicator layout? Executed from indicator l... Print message to notes - Print Print message to notes Print General hypothesis General hypothesis Hunting method chosen Hunting method chosen Set freestyle hunt true - setIncident Set freestyle hunt true setIncident Print message to notes - Print Print message to notes Print

Source

playbook-Proactive_Threat_Hunting.yml playbook-Proactive_Threat_Hunting_-_Block_Account.yml playbook-Proactive_Threat_Hunting_-_Block_Account_README.md playbook-Proactive_Threat_Hunting_-_Block_Indicators.yml playbook-Proactive_Threat_Hunting_-_Block_Indicators_README.md playbook-Proactive_Threat_Hunting_-_Endpoint_Isolation.yml playbook-Proactive_Threat_Hunting_-_Endpoint_Isolation_README.md playbook-Proactive_Threat_Hunting_-_Entity_Enrichment.yml playbook-Proactive_Threat_Hunting_-_Entity_Enrichment_README.md playbook-Proactive_Threat_Hunting_-_Execute_Query.yml playbook-Proactive_Threat_Hunting_-_Execute_Query_README.md playbook-Proactive_Threat_Hunting_-_Quarantine_File.yml playbook-Proactive_Threat_Hunting_-_Quarantine_File_README.md playbook-Proactive_Threat_Hunting_-_SDO_Threat_Hunting.yml playbook-Proactive_Threat_Hunting_-_SDO_Threat_Hunting_README.md
Download History Raw 
This playbook will be executed from the "Proactive Threat Hunting" layout button with the objective of enriching information on hosts and users specified by the analyst.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

* Account Enrichment - Generic v2.1

### Integrations

This playbook does not use any integrations.

### Scripts

* Print
* Set
* DeleteContext
* JsonToTable

### Commands

* endpoint
* xdr-get-alerts
* setIncident

## Playbook Inputs

---
There are no inputs for this playbook.

## Playbook Outputs

---
There are no outputs for this playbook.

## Playbook Image

---

![Proactive Threat Hunting - Entity Enrichment](../doc_files/Proactive_Threat_Hunting_-_Entity_Enrichment.png)