QRadar Get Hunting Results

This playbook is used to sort the QRadar search results to display the IP addresses, assets, and usernames that the search provided. In addition, the results allow you to differentiate between internal and external IP addresses as well as query the QRadar assets API in order to get the assets details from the IP addresses. You can provide the QRadar fields names and the organizations' IP ranges in order to properly sort the data. The end result of the playbook will be the internal and external IP addresses detected as well as the assets and users.

IBM QRadar · 18 tasks · 4 inputs · 5 outputs

Inputs

  • InternalRange — A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
  • InvestigationIPFields — The values of these QRadar fields will be used for the playbook IP addresses outputs.
  • InvestigationUserFields — The values of these QRadar fields will be used for the playbook user name outputs.
  • SearchResults — The search results of an AQL search.

Outputs

  • QRadar.DetectedUsers — Users detected based on the username field in your search.
  • QRadar.DetectedInternalIPs — Internal IP addresses detected based on fields and inputs in your search.
  • QRadar.DetectedExternalIPs — External IP addresses detected based on fields and inputs in your search.
  • QRadar.DetectedInternalHosts — Internal host names detected based on hosts in your assets table. Note that the data accuracy depends on how the asset mapping is configured in QRadar.
  • QRadar.DetectedExternalHosts — External host names detected based on hosts in your assets table. Note that the data accuracy depends on how the asset mapping is configured in QRadar.

Commands used

qradar-assets-list

Flowchart

true true true true true Start Start Sort internal and external IP addresses Sort internal and externa... Set detected IP addresses as external - SetAndHandleEmpty Set detected IP addresses... SetAndHandleEmpty Are there detected IP addresses? Are there detected IP add... Determine whether the IP address is internal or external - IsIPInRanges Determine whether the IP ... IsIPInRanges Set detected IP addresses as internal - SetAndHandleEmpty Set detected IP addresses... SetAndHandleEmpty Set detected source and destination IP addresses - SetAndHandleEmpty Set detected source and d... SetAndHandleEmpty Set detected usernames - SetAndHandleEmpty Set detected usernames SetAndHandleEmpty Get hostnames from assets - qradar-assets-list Get hostnames from assets qradar-assets-list Set detected hostnames from assets - SetAndHandleEmpty Set detected hostnames fr... SetAndHandleEmpty Have results been detected? Have results been detected? Done Done Set detected values Set detected values Have IP fields been provided? Have IP fields been provi... Have username fields been provided? Have username fields been... Are there detected IP addresses? Are there detected IP add... Set search results - Set Set search results Set Done user setting Done user setting