QRadar Get Hunting Results

This playbook is used to sort the QRadar search results to display the IP addresses, assets, and usernames that the search provided. In addition, the results allow you to differentiate between internal and external IP addresses as well as query the QRadar assets API in order to get the assets details from the IP addresses. You can provide the QRadar fields names and the organizations' IP ranges in order to properly sort the data. The end result of the playbook will be the internal and external IP addresses detected as well as the assets and users.

IBM QRadar · 18 tasks · 4 inputs · 5 outputs

Details

ID	`QRadar Get Hunting Results`
From Version	6.2.0
Tasks	18

README

This playbook is used to sort the QRadar search results to display the IP addresses, assets, and usernames that the search provided. In addition, the results allow you to differentiate between internal and external IP addresses as well as query the QRadar assets API in order to get the assets details from the IP addresses. You can provide the QRadar fields names and the organizations’ IP ranges in order to properly sort the data. The end result of the playbook will be the internal and external IP addresses detected as well as the assets and users.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

QRadar_v3

Scripts

Set
IsIPInRanges
SetAndHandleEmpty

Commands

qradar-assets-list

Playbook Inputs

Name	Description	Default Value	Required
InternalRange	A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: “172.16.0.0/12,10.0.0.0/8,192.168.0.0/16” (without quotes).	lists.PrivateIPs	Optional
InvestigationIPFields	The values of these QRadar fields will be used for the playbook IP addresses outputs.	sourceip,destinationip	Optional
InvestigationUserFields	The values of these QRadar fields will be used for the playbook user name outputs.	username	Optional
SearchResults	The search results of an AQL search.		Optional

Playbook Outputs

Path	Description	Type
QRadar.DetectedUsers	Users detected based on the username field in your search.	string
QRadar.DetectedInternalIPs	Internal IP addresses detected based on fields and inputs in your search.	string
QRadar.DetectedExternalIPs	External IP addresses detected based on fields and inputs in your search.	string
QRadar.DetectedInternalHosts	Internal host names detected based on hosts in your assets table. Note that the data accuracy depends on how the asset mapping is configured in QRadar.	string
QRadar.DetectedExternalHosts	External host names detected based on hosts in your assets table. Note that the data accuracy depends on how the asset mapping is configured in QRadar.	string

Playbook Image

QRadar Get Hunting Results

Inputs

InternalRange — A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
InvestigationIPFields — The values of these QRadar fields will be used for the playbook IP addresses outputs.
InvestigationUserFields — The values of these QRadar fields will be used for the playbook user name outputs.
SearchResults — The search results of an AQL search.

Outputs

QRadar.DetectedUsers — Users detected based on the username field in your search.
QRadar.DetectedInternalIPs — Internal IP addresses detected based on fields and inputs in your search.
QRadar.DetectedExternalIPs — External IP addresses detected based on fields and inputs in your search.
QRadar.DetectedInternalHosts — Internal host names detected based on hosts in your assets table. Note that the data accuracy depends on how the asset mapping is configured in QRadar.
QRadar.DetectedExternalHosts — External host names detected based on hosts in your assets table. Note that the data accuracy depends on how the asset mapping is configured in QRadar.

Commands used

qradar-assets-list

Flowchart

Source

playbook-QRadar_Get_Hunting_Results.yml

Download History Raw

id: QRadar Get Hunting Results
version: -1
description: This playbook is used to sort the QRadar search results to display the IP addresses, assets, and usernames that the search provided. In addition, the results allow you to differentiate between internal and external IP addresses as well as query the QRadar assets API in order to get the assets details from the IP addresses. You can provide the QRadar fields names and the organizations' IP ranges in order to properly sort the data. The end result of the playbook will be the internal and external IP addresses detected as well as the assets and users.
name: QRadar Get Hunting Results
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 471d3946-d66d-4e31-8ad9-6ca8ba1cd448
    type: start
    task:
      id: 471d3946-d66d-4e31-8ad9-6ca8ba1cd448
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '10'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 420,
          "y": 140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '1':
    id: '1'
    taskid: d9e83392-2f8d-4b43-8935-31ba8d824882
    type: title
    task:
      id: d9e83392-2f8d-4b43-8935-31ba8d824882
      version: -1
      name: Sort internal and external IP addresses
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 670,
          "y": 1950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: fb0311c0-88d0-4afa-8d2e-6f54f646df1b
    type: regular
    task:
      id: fb0311c0-88d0-4afa-8d2e-6f54f646df1b
      version: -1
      name: Set detected IP addresses as external
      description: Checks if the specified value exists in context. If the value exists, it will be set in context, otherwise no value will be set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '11'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedExternalIPs
      value:
        complex:
          root: IP
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: IP.InRange
                iscontext: true
              right:
                value:
                  simple: no
          accessor: Address
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 820,
          "y": 2560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '3':
    id: '3'
    taskid: 94bf989c-baf5-4769-8325-f5f5f6226baf
    type: condition
    task:
      id: 94bf989c-baf5-4769-8325-f5f5f6226baf
      version: -1
      name: Are there detected IP addresses?
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '11'
      yes:
      - '4'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: QRadar.DetectedIPs
            iscontext: true
    view: |-
      {
        "position": {
          "x": 670,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '4':
    id: '4'
    taskid: 7ddc4c58-95a6-41ef-8369-01bf13913b89
    type: regular
    task:
      id: 7ddc4c58-95a6-41ef-8369-01bf13913b89
      version: -1
      name: Determine whether the IP address is internal or external
      description: Returns yes if the IP address is in one of the ranges provided. Returns no otherwise.
      scriptName: IsIPInRanges
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '5'
    scriptarguments:
      ip:
        simple: ${QRadar.DetectedIPs}
      ipRanges:
        simple: ${inputs.InternalRange}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 820,
          "y": 2260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '5':
    id: '5'
    taskid: 0b0f085f-c64c-42f5-89c8-019ba8c8878c
    type: regular
    task:
      id: 0b0f085f-c64c-42f5-89c8-019ba8c8878c
      version: -1
      name: Set detected IP addresses as internal
      description: Checks if the specified value exists in context. If the value exists, it will be set in context, otherwise no value will be set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedInternalIPs
      value:
        complex:
          root: IP
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: IP.InRange
                iscontext: true
              right:
                value:
                  simple: yes
          accessor: Address
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 820,
          "y": 2420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '6':
    id: '6'
    taskid: 167285fd-2777-4725-8bc3-f4105974f7b0
    type: regular
    task:
      id: 167285fd-2777-4725-8bc3-f4105974f7b0
      version: -1
      name: Set detected source and destination IP addresses
      description: Sets a value in context with the given context key.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '11'
      - '15'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedIPs
      value:
        complex:
          root: ${
          accessor: =[]}
          transformers:
          - operator: GetValuesOfMultipleFields
            args:
              key:
                value:
                  simple: QRadar.Search.Result.events
                iscontext: true
              list:
                value:
                  simple: inputs.InvestigationIPFields
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 670,
          "y": 945
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '7':
    id: '7'
    taskid: dffced59-ddf3-456a-8b37-64b06d19bccd
    type: regular
    task:
      id: dffced59-ddf3-456a-8b37-64b06d19bccd
      version: -1
      name: Set detected usernames
      description: Sets a value in context with the given context key.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '17'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedUsers
      value:
        complex:
          root: ${
          accessor: =[]}
          transformers:
          - operator: GetValuesOfMultipleFields
            args:
              key:
                value:
                  simple: QRadar.Search.Result.events
                iscontext: true
              list:
                value:
                  simple: inputs.InvestigationUserFields
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 1280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '8':
    id: '8'
    taskid: 8b6eae0b-939e-4fd8-86ec-62f4b674e7dd
    type: regular
    task:
      id: 8b6eae0b-939e-4fd8-86ec-62f4b674e7dd
      version: -1
      name: Get hostnames from assets
      description: Retrieves assets list.
      script: '|||qradar-assets-list'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      filter:
        complex:
          root: ${QRadar
          accessor: DetectedIPs}
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: interfaces contains ip_addresses contains value= "
              suffix:
                value:
                  simple: '"'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 670,
          "y": 1630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '9':
    id: '9'
    taskid: bd2ea70a-3518-4fbb-8c5e-4cb156123200
    type: regular
    task:
      id: bd2ea70a-3518-4fbb-8c5e-4cb156123200
      version: -1
      name: Set detected hostnames from assets
      description: Sets a value in context with the given context key.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedInternalHosts
      value:
        complex:
          root: ${QRadar
          accessor: Asset.Name.Value}
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 670,
          "y": 1790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '10':
    id: '10'
    taskid: 29ec4a5c-63de-49b7-8d46-90a7fd110c62
    type: condition
    task:
      id: 29ec4a5c-63de-49b7-8d46-90a7fd110c62
      version: -1
      name: Have results been detected?
      description: Was the domain or URL detected by QRadar?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '11'
      yes:
      - '16'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SearchResults
            iscontext: true
    view: |-
      {
        "position": {
          "x": 420,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '11':
    id: '11'
    taskid: 0fff2b31-f1a7-4660-8451-2efba965425a
    type: title
    task:
      id: 0fff2b31-f1a7-4660-8451-2efba965425a
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 2730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '12':
    id: '12'
    taskid: fe022e8b-a53c-4fe3-8f81-549b70d3d215
    type: title
    task:
      id: fe022e8b-a53c-4fe3-8f81-549b70d3d215
      version: -1
      name: Set detected values
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '13'
      - '14'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 660,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '13':
    id: '13'
    taskid: 77e73730-45a8-44db-8e4d-fcdf86ad0b5d
    type: condition
    task:
      id: 77e73730-45a8-44db-8e4d-fcdf86ad0b5d
      version: -1
      name: Have IP fields been provided?
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '11'
      yes:
      - '6'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.InvestigationIPFields
            iscontext: true
    view: |-
      {
        "position": {
          "x": 520,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '14':
    id: '14'
    taskid: 083b7307-bfa9-43d4-86c9-eeb375da45f4
    type: condition
    task:
      id: 083b7307-bfa9-43d4-86c9-eeb375da45f4
      version: -1
      name: Have username fields been provided?
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '17'
      yes:
      - '7'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.InvestigationUserFields
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '15':
    id: '15'
    taskid: 1b642c12-b9e1-47fe-8485-d4c00a794d99
    type: condition
    task:
      id: 1b642c12-b9e1-47fe-8485-d4c00a794d99
      version: -1
      name: Are there detected IP addresses?
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '11'
      yes:
      - '8'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: QRadar.DetectedIPs
            iscontext: true
    view: |-
      {
        "position": {
          "x": 670,
          "y": 1290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '16':
    id: '16'
    taskid: 1259eaf4-7c94-4df2-8a1c-50f1dfefcff4
    type: regular
    task:
      id: 1259eaf4-7c94-4df2-8a1c-50f1dfefcff4
      version: -1
      name: Set search results
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '12'
    scriptarguments:
      key:
        simple: QRadar.Search.Result
      value:
        simple: ${inputs.SearchResults}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 660,
          "y": 440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '17':
    id: '17'
    taskid: e75f0edb-3a58-414c-817f-824d32de9238
    type: title
    task:
      id: e75f0edb-3a58-414c-817f-824d32de9238
      version: -1
      name: Done user setting
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '11'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 2590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 2655,
        "width": 1380,
        "x": 280,
        "y": 140
      }
    }
  }
inputs:
- key: InternalRange
  value:
    complex:
      root: lists
      accessor: PrivateIPs
      transformers:
      - operator: RegexExtractAll
        args:
          error_if_no_match: {}
          ignore_case: {}
          multi_line: {}
          period_matches_newline: {}
          regex:
            value:
              simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2})
          unpack_matches: {}
      - operator: join
        args:
          separator:
            value:
              simple: ','
  required: false
  description: 'A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).'
  playbookInputQuery:
- key: InvestigationIPFields
  value:
    simple: sourceip,destinationip
  required: false
  description: The values of these QRadar fields will be used for the playbook IP addresses outputs.
  playbookInputQuery:
- key: InvestigationUserFields
  value:
    simple: username
  required: false
  description: The values of these QRadar fields will be used for the playbook user name outputs.
  playbookInputQuery:
- key: SearchResults
  value: {}
  required: false
  description: The search results of an AQL search.
  playbookInputQuery:
outputs:
- contextPath: QRadar.DetectedUsers
  description: Users detected based on the username field in your search.
  type: string
- contextPath: QRadar.DetectedInternalIPs
  description: Internal IP addresses detected based on fields and inputs in your search.
  type: string
- contextPath: QRadar.DetectedExternalIPs
  description: External IP addresses detected based on fields and inputs in your search.
  type: string
- contextPath: QRadar.DetectedInternalHosts
  description: Internal host names detected based on hosts in your assets table. Note that the data accuracy depends on how the asset mapping is configured in QRadar.
  type: string
- contextPath: QRadar.DetectedExternalHosts
  description: External host names detected based on hosts in your assets table. Note that the data accuracy depends on how the asset mapping is configured in QRadar.
  type: string
tests:
- no test
fromversion: 6.2.0
supportedModules:
- agentix
- xsiam