QRadar Indicator Hunting V2

The Playbook queries QRadar SIEM for indicators such as file hashes, IP addresses, domains, or urls.

IBM QRadar · 57 tasks · 14 inputs · 5 outputs

Inputs

  • MD5 — MD5 hash file or an array of hashes to search.
  • QradarMD5Field — MD5 field to search in QRadar. If none are specified, the search will use a payload contains filter.
  • SHA1 — SHA1 hash file or an array of hashes to search.
  • QradarSHA1Field — SHA1 field to search in QRadar. If none are specified, the search will use a payload contains filter.
  • SHA256 — SHA256 hash file or an array of hashes to search.
  • QradarSHA256Field — SHA256 field to search in QRadar. If none are specified, the search will use a payload contains filter.
  • IPAddress — Source or destination IP to search. Can be a single address or an array of addresses.
  • QradarIPfield — IP field to search in QRadar. If none are specified, the search will use sourceip or destinationip (combined).
  • URLDomain — Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used.
  • QradarURLDomainField — URL/Domain field to search in QRadar. If none are specified, the search will use a payload contains filter.
  • TimeFrame — Time frame as used in AQL Examples can be LAST 7 DAYS START '2019-09-25 15:51' STOP '2019-09-25 17:51' For more examples review IBM's AQL documentation.
  • InternalRange — A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
  • InvestigationIPFields — The values of these QRadar fields will be used for the playbook IP addresses outputs.
  • InvestigationUserFields — The values of these QRadar fields will be used for the playbook user name outputs.

Outputs

  • QRadar.DetectedUsers — Users detected based on the username field in your search.
  • QRadar.DetectedInternalIPs — Internal IP addresses detected based on fields and inputs in your search.
  • QRadar.DetectedExternalIPs — External IP addresses detected based on fields and inputs in your search.
  • QRadar.DetectedInternalHosts — Internal host names detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar.
  • QRadar.DetectedExternalHosts — External host names detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar.

Commands used

qradar-assets-list qradar-search-retrieve-events

Flowchart

yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes Start Start Hash Search Hash Search IP Search IP Search Domain/Url Search Domain/Url Search Is there an IP to search? Is there an IP to search? Is there a hash to search? Is there a hash to search? Is there a domain or url to search? Is there a domain or url ... Is there a custom domain or url field? Is there a custom domain ... Is there a custom MD5 field? Is there a custom MD5 field? Is there an MD5 to search? Is there an MD5 to search? MD5 Search MD5 Search SHA1 Search SHA1 Search Is there a SHA1 to search? Is there a SHA1 to search? Was there a custom SHA1 field? Was there a custom SHA1 f... SHA256 Search SHA256 Search Is there a SHA256 to search? Is there a SHA256 to search? Is there a custom SHA256 field? Is there a custom SHA256 ... Is there a custom IP field? Is there a custom IP field? Is Qradar enabled? Is Qradar enabled? QRadar query without custom fields QRadar query without cust... QRadar query with custom fields QRadar query with custom ... QRadar query with custom fields QRadar query with custom ... QRadar query without custom fields QRadar query without cust... QRadar query without custom fields QRadar query without cust... QRadar query with custom fields QRadar query with custom ... QRadar query without custom fields QRadar query without cust... QRadar query with custom fields QRadar query with custom ... QRadar query without custom fields QRadar query without cust... QRadar query with custom fields QRadar query with custom ... Set MD5 to an array - Set Set MD5 to an array Set Set SHA1 to an array - Set Set SHA1 to an array Set Set SHA256 to an array - Set Set SHA256 to an array Set Set IP to an array - Set Set IP to an array Set Set Domain or URL to the array - Set Set Domain or URL to the ... Set Sort internal and external IP addresses Sort internal and externa... Set detected IP addresses as external - SetAndHandleEmpty Set detected IP addresses... SetAndHandleEmpty Are there detected IP addresses? Are there detected IP add... Determine whether the IP address is internal or external - IsIPInRanges Determine whether the IP ... IsIPInRanges Set detected IP addresses as internal - SetAndHandleEmpty Set detected IP addresses... SetAndHandleEmpty Set detected usernames - SetAndHandleEmpty Set detected usernames SetAndHandleEmpty Get hostnames from assets - qradar-assets-list Get hostnames from assets qradar-assets-list Set detected hostnames from assets - SetAndHandleEmpty Set detected hostnames fr... SetAndHandleEmpty Done Done Set detecetd Values Set detecetd Values QRadar Full Search on IP - qradar-search-retrieve-events QRadar Full Search on IP qradar-search-retrieve-events QRadar Full Search on SHA256 - qradar-search-retrieve-events QRadar Full Search on SHA256 qradar-search-retrieve-events QRadar Full Search on SHA256 - qradar-search-retrieve-events QRadar Full Search on SHA256 qradar-search-retrieve-events QRadar Full Search on SHA1 - qradar-search-retrieve-events QRadar Full Search on SHA1 qradar-search-retrieve-events QRadar Full Search on SHA1 - qradar-search-retrieve-events QRadar Full Search on SHA1 qradar-search-retrieve-events QRadar Full Search on IP - qradar-search-retrieve-events QRadar Full Search on IP qradar-search-retrieve-events Qradar Full Search on MD5 - qradar-search-retrieve-events Qradar Full Search on MD5 qradar-search-retrieve-events QRadar Full Search on Domain/URL - qradar-search-retrieve-events QRadar Full Search on Dom... qradar-search-retrieve-events QRadar Full Search on Domain/URL - qradar-search-retrieve-events QRadar Full Search on Dom... qradar-search-retrieve-events Indicator Hunting Indicator Hunting Has query results? Has query results? QRadar Full Search on MD5 - qradar-search-retrieve-events QRadar Full Search on MD5 qradar-search-retrieve-events Set detected source and destination IP addresses - SetAndHandleEmpty Set detected source and d... SetAndHandleEmpty