QRadar Indicator Hunting V2
The Playbook queries QRadar SIEM for indicators such as file hashes, IP addresses, domains, or urls.
IBM QRadar · 57 tasks · 14 inputs · 5 outputs
Details
| ID | QRadar Indicator Hunting V2 |
|---|---|
| From Version | 5.0.0 |
| Tasks | 57 |
README
The Playbook queries QRadar SIEM for indicators such as file hashes, IP addresses, domains, or urls.
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
This playbook does not use any sub-playbooks.
Integrations
- QRadar_v3
Scripts
- IsIPInRanges
- Set
- SetAndHandleEmpty
Commands
- qradar-assets-list
- qradar-search-retrieve-events
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| MD5 | MD5 hash file or an array of hashes to search. | Optional | |
| QradarMD5Field | MD5 field to search in QRadar. If none are specified, the search will use a payload contains filter. | Optional | |
| SHA1 | SHA1 hash file or an array of hashes to search. | Optional | |
| QradarSHA1Field | SHA1 field to search in QRadar. If none are specified, the search will use a payload contains filter. | Optional | |
| SHA256 | SHA256 hash file or an array of hashes to search. | Optional | |
| QradarSHA256Field | SHA256 field to search in QRadar. If none are specified, the search will use a payload contains filter. | Optional | |
| IPAddress | Source or destination IP to search. Can be a single address or an array of addresses. |
Optional | |
| QradarIPfield | IP field to search in QRadar. If none are specified, the search will use sourceip or destinationip (combined). | sourceip,destinationip | Optional |
| URLDomain | Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used. |
Optional | |
| QradarURLDomainField | URL/Domain field to search in QRadar. If none are specified, the search will use a payload contains filter. | Optional | |
| TimeFrame | Time frame as used in AQL Examples can be LAST 7 DAYS START ‘2019-09-25 15:51’ STOP ‘2019-09-25 17:51’ For more examples review IBM’s AQL documentation. |
LAST 7 DAYS | Optional |
| InternalRange | A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: “172.16.0.0/12,10.0.0.0/8,192.168.0.0/16” (without quotes). | lists.PrivateIPs | Optional |
| InvestigationIPFields | The values of these QRadar fields will be used for the playbook IP addresses outputs. | sourceip,destinationip | Required |
| InvestigationUserFields | The values of these QRadar fields will be used for the playbook user name outputs. | username | Required |
Playbook Outputs
| Path | Description | Type |
|---|---|---|
| QRadar.DetectedUsers | Users detected based on the username field in your search. | string |
| QRadar.DetectedInternalIPs | Internal IP addresses detected based on fields and inputs in your search. | string |
| QRadar.DetectedExternalIPs | External IP addresses detected based on fields and inputs in your search. | string |
| QRadar.DetectedInternalHosts | Internal host names detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar. | string |
| QRadar.DetectedExternalHosts | External host names detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar. | string |
Playbook Image
Inputs
MD5— MD5 hash file or an array of hashes to search.QradarMD5Field— MD5 field to search in QRadar. If none are specified, the search will use a payload contains filter.SHA1— SHA1 hash file or an array of hashes to search.QradarSHA1Field— SHA1 field to search in QRadar. If none are specified, the search will use a payload contains filter.SHA256— SHA256 hash file or an array of hashes to search.QradarSHA256Field— SHA256 field to search in QRadar. If none are specified, the search will use a payload contains filter.IPAddress— Source or destination IP to search. Can be a single address or an array of addresses.QradarIPfield— IP field to search in QRadar. If none are specified, the search will use sourceip or destinationip (combined).URLDomain— Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used.QradarURLDomainField— URL/Domain field to search in QRadar. If none are specified, the search will use a payload contains filter.TimeFrame— Time frame as used in AQL Examples can be LAST 7 DAYS START '2019-09-25 15:51' STOP '2019-09-25 17:51' For more examples review IBM's AQL documentation.InternalRange— A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).InvestigationIPFields— The values of these QRadar fields will be used for the playbook IP addresses outputs.InvestigationUserFields— The values of these QRadar fields will be used for the playbook user name outputs.
Outputs
QRadar.DetectedUsers— Users detected based on the username field in your search.QRadar.DetectedInternalIPs— Internal IP addresses detected based on fields and inputs in your search.QRadar.DetectedExternalIPs— External IP addresses detected based on fields and inputs in your search.QRadar.DetectedInternalHosts— Internal host names detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar.QRadar.DetectedExternalHosts— External host names detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar.
Commands used
qradar-assets-list
qradar-search-retrieve-events
Flowchart
id: QRadar Indicator Hunting V2 version: -1 contentitemexportablefields: contentitemfields: {} name: QRadar Indicator Hunting V2 description: 'The Playbook queries QRadar SIEM for indicators such as file hashes, IP addresses, domains, or urls. ' starttaskid: "0" tasks: "0": id: "0" taskid: a2b99d88-69c8-4a87-8d60-74d21ca2db74 type: start task: id: a2b99d88-69c8-4a87-8d60-74d21ca2db74 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "55" separatecontext: false view: |- { "position": { "x": 1875, "y": -125 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: 30250b5a-c4ae-4477-8d7d-aa586c6a5c2f type: title task: id: 30250b5a-c4ae-4477-8d7d-aa586c6a5c2f version: -1 name: Hash Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "8" separatecontext: false view: |- { "position": { "x": 842.5, "y": 350 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: b4ad1b02-a07b-4f3b-8949-2389d2c0c08e type: title task: id: b4ad1b02-a07b-4f3b-8949-2389d2c0c08e version: -1 name: IP Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "7" separatecontext: false view: |- { "position": { "x": 1875, "y": 360 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: b2482cd1-e6f4-45ab-84c4-0faf3d9e96ae type: title task: id: b2482cd1-e6f4-45ab-84c4-0faf3d9e96ae version: -1 name: Domain/Url Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "9" separatecontext: false view: |- { "position": { "x": 2775, "y": 350 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: b3700546-6a71-4c26-89dc-6ac3ffe0439a type: condition task: id: b3700546-6a71-4c26-89dc-6ac3ffe0439a version: -1 name: Is there an IP to search? description: Is there an IP on which to search? type: condition iscommand: false brand: "" nexttasks: '#default#': - "166" "yes": - "50" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.IPAddress iscontext: true view: |- { "position": { "x": 1875, "y": 490 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 4ca411b2-9118-4c88-80ba-fd45cf7dc4d4 type: condition task: id: 4ca411b2-9118-4c88-80ba-fd45cf7dc4d4 version: -1 name: Is there a hash to search? description: Is there a hash on which to search? type: condition iscommand: false brand: "" nexttasks: '#default#': - "166" "yes": - "26" - "27" - "38" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.MD5 iscontext: true - operator: isNotEmpty left: value: simple: inputs.SHA1 iscontext: true - operator: isNotEmpty left: value: simple: inputs.SHA256 iscontext: true view: |- { "position": { "x": 842.5, "y": 475 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: 8a910c41-e636-4df8-873d-55961fd9f5ff type: condition task: id: 8a910c41-e636-4df8-873d-55961fd9f5ff version: -1 name: Is there a domain or url to search? description: Is there a domain or URL on which to search? type: condition iscommand: false brand: "" nexttasks: '#default#': - "166" "yes": - "11" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.URLDomain iscontext: true view: |- { "position": { "x": 2775, "y": 475 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 2afade2a-c653-4db2-8fc2-7dc20abba4f6 type: condition task: id: 2afade2a-c653-4db2-8fc2-7dc20abba4f6 version: -1 name: Is there a custom domain or url field? description: Is there a custom domain or url field? type: condition iscommand: false brand: "" nexttasks: '#default#': - "56" "yes": - "57" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.QradarURLDomainField iscontext: true view: |- { "position": { "x": 2775, "y": 660 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: 9dbc1709-6693-4705-8a81-90432e69bbc5 type: condition task: id: 9dbc1709-6693-4705-8a81-90432e69bbc5 version: -1 name: Is there a custom MD5 field? description: Is there a custom MD5 field? type: condition iscommand: false brand: "" nexttasks: '#default#': - "64" "yes": - "65" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.QradarMD5Field iscontext: true view: |- { "position": { "x": -1385, "y": 950 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "22": id: "22" taskid: 9719193a-aa81-4017-8fe3-9b9c54f7c510 type: condition task: id: 9719193a-aa81-4017-8fe3-9b9c54f7c510 version: -1 name: Is there an MD5 to search? description: Is there an MD5 on which to search? type: condition iscommand: false brand: "" nexttasks: '#default#': - "166" "yes": - "21" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.MD5 iscontext: true view: |- { "position": { "x": -1385, "y": 775 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: 37b3d830-4401-42fa-8c4a-ec9952bf39fd type: title task: id: 37b3d830-4401-42fa-8c4a-ec9952bf39fd version: -1 name: MD5 Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "22" separatecontext: false view: |- { "position": { "x": -1385, "y": 650 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 2f6a1090-e0b8-4485-8185-83165e489c33 type: title task: id: 2f6a1090-e0b8-4485-8185-83165e489c33 version: -1 name: SHA1 Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "29" separatecontext: false view: |- { "position": { "x": -505, "y": 650 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: eab04f66-1e17-4945-8f72-a5cdda1bc308 type: condition task: id: eab04f66-1e17-4945-8f72-a5cdda1bc308 version: -1 name: Is there a SHA1 to search? description: Is there a SHA1 hash on which to search? type: condition iscommand: false brand: "" nexttasks: '#default#': - "166" "yes": - "31" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.SHA1 iscontext: true view: |- { "position": { "x": -515, "y": 775 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: d6eb18bc-0884-47a5-829b-d1ae0060d3bc type: condition task: id: d6eb18bc-0884-47a5-829b-d1ae0060d3bc version: -1 name: Was there a custom SHA1 field? description: Was there a custom SHA1 field? type: condition iscommand: false brand: "" nexttasks: '#default#': - "62" "yes": - "63" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.QradarSHA1Field iscontext: true view: |- { "position": { "x": -505, "y": 940 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "38": id: "38" taskid: 7a308843-7a82-4f8a-8273-bc8c81ac4d39 type: title task: id: 7a308843-7a82-4f8a-8273-bc8c81ac4d39 version: -1 name: SHA256 Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "39" separatecontext: false view: |- { "position": { "x": 372.5, "y": 650 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "39": id: "39" taskid: d4834696-2334-462e-8fbb-d978b9079097 type: condition task: id: d4834696-2334-462e-8fbb-d978b9079097 version: -1 name: Is there a SHA256 to search? description: Is there a SHA256 hash on which to search? type: condition iscommand: false brand: "" nexttasks: '#default#': - "166" "yes": - "41" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.SHA256 iscontext: true view: |- { "position": { "x": 372.5, "y": 775 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "41": id: "41" taskid: 9202b39d-89cd-4fde-83a5-4912e2a7913b type: condition task: id: 9202b39d-89cd-4fde-83a5-4912e2a7913b version: -1 name: Is there a custom SHA256 field? description: Is there a custom SHA256 field? type: condition iscommand: false brand: "" nexttasks: '#default#': - "60" "yes": - "61" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.QradarSHA256Field iscontext: true view: |- { "position": { "x": 372.5, "y": 950 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "50": id: "50" taskid: e9557ca0-59b9-4011-85df-20107a011f2c type: condition task: id: e9557ca0-59b9-4011-85df-20107a011f2c version: -1 name: Is there a custom IP field? description: Is there a custom IP field? type: condition iscommand: false brand: "" nexttasks: '#default#': - "59" "yes": - "58" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.QradarIPfield iscontext: true view: |- { "position": { "x": 1575, "y": 660 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "55": id: "55" taskid: a9fa4f2d-8daf-456c-8d88-7c1c7eb830b4 type: condition task: id: a9fa4f2d-8daf-456c-8d88-7c1c7eb830b4 version: -1 name: Is Qradar enabled? description: Is Qradar enabled? type: condition iscommand: false brand: "" nexttasks: '#default#': - "165" "yes": - "176" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: inList left: value: simple: modules.brand iscontext: true right: value: simple: QRadar,QRadar_v2,QRadar v3 - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active iscontext: true view: |- { "position": { "x": 1350, "y": 30 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "56": id: "56" taskid: caed8241-b8b1-4f34-8f29-2177fdb3e10f type: title task: id: caed8241-b8b1-4f34-8f29-2177fdb3e10f version: -1 name: QRadar query without custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "102" separatecontext: false view: |- { "position": { "x": 2570, "y": 845 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "57": id: "57" taskid: 148ec15e-e700-43d9-80a1-6867e0e697c4 type: title task: id: 148ec15e-e700-43d9-80a1-6867e0e697c4 version: -1 name: QRadar query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "175" separatecontext: false view: |- { "position": { "x": 3000, "y": 840 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "58": id: "58" taskid: b376ca7c-0ef3-4ce6-8188-27c49b3d14f3 type: title task: id: b376ca7c-0ef3-4ce6-8188-27c49b3d14f3 version: -1 name: QRadar query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "172" separatecontext: false view: |- { "position": { "x": 2100, "y": 840 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "59": id: "59" taskid: 352bb2ce-fe56-4415-805b-d15436205a16 type: title task: id: 352bb2ce-fe56-4415-805b-d15436205a16 version: -1 name: QRadar query without custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "101" separatecontext: false view: |- { "position": { "x": 1670, "y": 840 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "60": id: "60" taskid: 7c514669-525a-41e6-89b3-4b03683cd2cd type: title task: id: 7c514669-525a-41e6-89b3-4b03683cd2cd version: -1 name: QRadar query without custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "100" separatecontext: false view: |- { "position": { "x": 170, "y": 1125 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "61": id: "61" taskid: 3fb63155-a852-454d-8c8a-7e77db25eb7f type: title task: id: 3fb63155-a852-454d-8c8a-7e77db25eb7f version: -1 name: QRadar query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "169" separatecontext: false view: |- { "position": { "x": 600, "y": 1125 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "62": id: "62" taskid: 3aae3e82-5aad-4f67-83df-46ed41175b6d type: title task: id: 3aae3e82-5aad-4f67-83df-46ed41175b6d version: -1 name: QRadar query without custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "99" separatecontext: false view: |- { "position": { "x": -710, "y": 1125 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "63": id: "63" taskid: 289810bf-110b-4c31-8ebc-907f334ad50a type: title task: id: 289810bf-110b-4c31-8ebc-907f334ad50a version: -1 name: QRadar query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "170" separatecontext: false view: |- { "position": { "x": -280, "y": 1125 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "64": id: "64" taskid: ce8af6fc-bdde-4ba4-8df1-81430d419c3b type: title task: id: ce8af6fc-bdde-4ba4-8df1-81430d419c3b version: -1 name: QRadar query without custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "98" separatecontext: false view: |- { "position": { "x": -1590, "y": 1125 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "65": id: "65" taskid: dc5b8a0d-79f6-4865-8e9c-3a2638bbd6c7 type: title task: id: dc5b8a0d-79f6-4865-8e9c-3a2638bbd6c7 version: -1 name: QRadar query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "181" separatecontext: false view: |- { "position": { "x": -1160, "y": 1125 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "98": id: "98" taskid: dff6c803-c9df-4549-89ce-8713862e29fe type: regular task: id: dff6c803-c9df-4549-89ce-8713862e29fe version: -1 name: Set MD5 to an array description: Sets a value into the context with the given context key scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "173" scriptarguments: append: simple: "true" key: simple: FileMD5 value: complex: root: inputs.MD5 transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": -1590, "y": 1290 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "99": id: "99" taskid: e5f785bb-75ea-4ff2-87e2-7ed44fdcf134 type: regular task: id: e5f785bb-75ea-4ff2-87e2-7ed44fdcf134 version: -1 name: Set SHA1 to an array description: Sets a value into the context with the given context key scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "171" scriptarguments: append: simple: "true" key: simple: FileSHA1 value: complex: root: inputs.SHA1 transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": -710, "y": 1290 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "100": id: "100" taskid: 6cc731ba-436e-4959-887e-973dffd05aa4 type: regular task: id: 6cc731ba-436e-4959-887e-973dffd05aa4 version: -1 name: Set SHA256 to an array description: Sets a value into the context with the given context key scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "168" scriptarguments: append: simple: "true" key: simple: FileSHA256 value: complex: root: inputs.SHA256 transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": 170, "y": 1270 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "101": id: "101" taskid: 9699d2e9-2d1f-48ba-85fc-144e59bcf3a1 type: regular task: id: 9699d2e9-2d1f-48ba-85fc-144e59bcf3a1 version: -1 name: Set IP to an array description: Sets a value into the context with the given context key scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "167" scriptarguments: append: simple: "true" key: simple: IPAddress value: complex: root: inputs.IPAddress transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": 1670, "y": 1000 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "102": id: "102" taskid: 2e9bf4dc-56ce-4125-86b0-66f99fdf4651 type: regular task: id: 2e9bf4dc-56ce-4125-86b0-66f99fdf4651 version: -1 name: Set Domain or URL to the array description: Sets a value into the context with the given context key scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "174" scriptarguments: append: simple: "true" key: simple: DomainURL value: complex: root: inputs.URLDomain transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": 2570, "y": 990 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "120": id: "120" taskid: f1aaa2dc-6ab1-408e-8851-d73171be6244 type: title task: id: f1aaa2dc-6ab1-408e-8851-d73171be6244 version: -1 name: Sort internal and external IP addresses type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "124" separatecontext: false view: |- { "position": { "x": 1875, "y": 2640 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "123": id: "123" taskid: 777b2d48-c9f0-433d-8de3-7b015ba4c472 type: regular task: id: 777b2d48-c9f0-433d-8de3-7b015ba4c472 version: -1 name: Set detected IP addresses as external description: Checks if the specified value exists in context. If the value exists, it will be set in context, otherwise no value will be set it context. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "165" scriptarguments: append: simple: "true" key: simple: QRadar.DetectedExternalIPs value: complex: root: IP filters: - - operator: isEqualString left: value: simple: IP.InRange iscontext: true right: value: simple: "no" accessor: Address transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": 2080, "y": 3280 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "124": id: "124" taskid: 62deb054-e2c8-4fc9-88c5-ecc24d8fd88f type: condition task: id: 62deb054-e2c8-4fc9-88c5-ecc24d8fd88f version: -1 name: Are there detected IP addresses? description: Are there detected IP addresses? type: condition iscommand: false brand: "" nexttasks: '#default#': - "165" "yes": - "142" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: QRadar.DetectedIPs iscontext: true view: |- { "position": { "x": 1875, "y": 2775 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "142": id: "142" taskid: 1b6be11a-d587-4ef8-8784-8541d2761d85 type: regular task: id: 1b6be11a-d587-4ef8-8784-8541d2761d85 version: -1 name: Determine whether the IP address is internal or external description: Returns yes if the IP is in one of the ranges provided, returns no otherwise. scriptName: IsIPInRanges type: regular iscommand: false brand: "" nexttasks: '#none#': - "143" scriptarguments: ip: simple: ${QRadar.DetectedIPs} ipRanges: simple: ${inputs.InternalRange} separatecontext: false view: |- { "position": { "x": 2080, "y": 2950 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "143": id: "143" taskid: 61ca426a-bbab-45f5-8594-a0cadbd399b7 type: regular task: id: 61ca426a-bbab-45f5-8594-a0cadbd399b7 version: -1 name: Set detected IP addresses as internal description: Checks if the specified value exists in context. If the value exists, it will be set in context, otherwise no value will be set it context. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "123" scriptarguments: append: simple: "true" key: simple: QRadar.DetectedInternalIPs value: complex: root: IP filters: - - operator: isEqualString left: value: simple: IP.InRange iscontext: true right: value: simple: "yes" accessor: Address transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": 2080, "y": 3115 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "161": id: "161" taskid: f7b5c63c-7cbb-4907-8317-2dd39f6ed397 type: regular task: id: f7b5c63c-7cbb-4907-8317-2dd39f6ed397 version: -1 name: Set detected usernames description: Sets a value into the context with the given context key scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "162" scriptarguments: append: simple: "true" key: simple: QRadar.DetectedUsers value: complex: root: ${ accessor: =[]} transformers: - operator: GetValuesOfMultipleFields args: key: value: simple: QRadar.SearchEvents.Events iscontext: true list: value: simple: inputs.InvestigationUserFields iscontext: true separatecontext: false view: |- { "position": { "x": 2305, "y": 2110 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "162": id: "162" taskid: 1a600002-c821-46b1-82ac-d8b5ece75e26 type: regular task: id: 1a600002-c821-46b1-82ac-d8b5ece75e26 version: -1 name: Get hostnames from assets description: Retrieves assets list. script: '|||qradar-assets-list' type: regular iscommand: true brand: "" nexttasks: '#none#': - "163" scriptarguments: filter: complex: root: QRadar accessor: DetectedIPs transformers: - operator: concat args: prefix: value: simple: interfaces contains ip_addresses contains value= " suffix: value: simple: '"' - operator: join args: separator: value: simple: ' OR ' separatecontext: false continueonerror: true view: |- { "position": { "x": 2305, "y": 2290 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "163": id: "163" taskid: 7b5105b2-a7fe-4909-8226-8afb3bbcdee4 type: regular task: id: 7b5105b2-a7fe-4909-8226-8afb3bbcdee4 version: -1 name: Set detected hostnames from assets description: Sets a value into the context with the given context key scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "120" scriptarguments: append: simple: "true" key: simple: QRadar.DetectedInternalHosts value: complex: root: QRadar.Asset.Name accessor: Value transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2305, "y": 2460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "165": id: "165" taskid: b35aeb4f-d9f1-41f6-850a-a4b482a2bb8c type: title task: id: b35aeb4f-d9f1-41f6-850a-a4b482a2bb8c version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 1875, "y": 3455 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "166": id: "166" taskid: 5590f9d8-8ff3-4775-8bd0-16d911adb755 type: title task: id: 5590f9d8-8ff3-4775-8bd0-16d911adb755 version: -1 name: Set detecetd Values type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "178" separatecontext: false view: |- { "position": { "x": 1875, "y": 1640 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "167": id: "167" taskid: 483eaadc-4742-47fa-8f9e-f39f02c8eefd type: regular task: id: 483eaadc-4742-47fa-8f9e-f39f02c8eefd version: -1 name: | QRadar Full Search on IP description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: IPAddress transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) ILIKE '%$1%' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: DATEFORMAT(devicetime,'dd-MM-yyyy hh:mm'),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid), suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1670, "y": 1175 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "168": id: "168" taskid: 97d66679-4345-44cc-8e45-7682f562c85b type: regular task: id: 97d66679-4345-44cc-8e45-7682f562c85b version: -1 name: QRadar Full Search on SHA256 description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: FileSHA256 transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) ILIKE '%$1%' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: DATEFORMAT(devicetime,'dd-MM-yyyy hh:mm'),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid), suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 170, "y": 1445 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "169": id: "169" taskid: c6fc16a8-fb56-46d7-8053-384a433b5771 type: regular task: id: c6fc16a8-fb56-46d7-8053-384a433b5771 version: -1 name: QRadar Full Search on SHA256 description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: inputs.QradarSHA256Field transformers: - operator: ProductJoin args: join: value: simple: "=" list2: value: simple: inputs.SHA256 iscontext: true - operator: join args: separator: value: simple: ''' OR "' - operator: replaceMatch args: regex: value: simple: "=" replaceWith: value: simple: '" = ''' - operator: concat args: prefix: value: simple: ' from events where "' suffix: {} - operator: concat args: prefix: value: simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) ' suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ''' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 600, "y": 1445 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "170": id: "170" taskid: 6621a3dc-3b43-471a-8294-1e1fb8238276 type: regular task: id: 6621a3dc-3b43-471a-8294-1e1fb8238276 version: -1 name: QRadar Full Search on SHA1 description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: inputs.QradarSHA1Field transformers: - operator: ProductJoin args: join: value: simple: "=" list2: value: simple: inputs.SHA1 iscontext: true - operator: join args: separator: value: simple: ''' OR "' - operator: replaceMatch args: regex: value: simple: "=" replaceWith: value: simple: '" = ''' - operator: concat args: prefix: value: simple: ' from events where "' suffix: {} - operator: concat args: prefix: value: simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) ' suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ''' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -280, "y": 1465 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "171": id: "171" taskid: b9df3e96-97ba-453d-8070-dfb8338c6ee9 type: regular task: id: b9df3e96-97ba-453d-8070-dfb8338c6ee9 version: -1 name: QRadar Full Search on SHA1 description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: FileSHA1 transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) ILIKE '%$1%' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: DATEFORMAT(devicetime,'dd-MM-yyyy hh:mm'),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid), suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -710, "y": 1465 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "172": id: "172" taskid: 1260ad7c-2e3f-4cb1-8137-cfd4d023d16d type: regular task: id: 1260ad7c-2e3f-4cb1-8137-cfd4d023d16d version: -1 name: QRadar Full Search on IP description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: inputs.QradarIPfield transformers: - operator: ProductJoin args: join: value: simple: "=" list2: value: simple: inputs.IPAddress iscontext: true - operator: join args: separator: value: simple: ''' OR "' - operator: replaceMatch args: regex: value: simple: "=" replaceWith: value: simple: '" = ''' - operator: concat args: prefix: value: simple: ' from events where "' suffix: {} - operator: concat args: prefix: value: simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) ' suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ''' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2100, "y": 1175 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "173": id: "173" taskid: e4a747c0-ca2e-4a51-859d-e33a002a979b type: regular task: id: e4a747c0-ca2e-4a51-859d-e33a002a979b version: -1 name: Qradar Full Search on MD5 description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: FileMD5 transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) ILIKE '%$1%' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: DATEFORMAT(devicetime,'dd-MM-yyyy hh:mm'),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid), suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1590, "y": 1465 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "174": id: "174" taskid: a468e334-bc35-4395-88d0-55cec984dc60 type: regular task: id: a468e334-bc35-4395-88d0-55cec984dc60 version: -1 name: QRadar Full Search on Domain/URL description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: DomainURL transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) ILIKE '%$1%' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) ' suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2570, "y": 1165 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "175": id: "175" taskid: d2f85e1c-d849-42a9-8783-e3afbea7c91b type: regular task: id: d2f85e1c-d849-42a9-8783-e3afbea7c91b version: -1 name: QRadar Full Search on Domain/URL description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: inputs.QradarURLDomainField transformers: - operator: ProductJoin args: join: value: simple: ILIKE list2: value: simple: inputs.URLDomain iscontext: true - operator: join args: separator: value: simple: '%'' OR "' - operator: replaceMatch args: regex: value: simple: ILIKE replaceWith: value: simple: '" ILIKE ''%' - operator: concat args: prefix: value: simple: ' from events where "' suffix: {} - operator: concat args: prefix: value: simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) ' suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: 'select ' suffix: {} - operator: concat args: prefix: {} suffix: value: simple: '%'' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3000, "y": 1175 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "176": id: "176" taskid: 82ef281a-644a-4657-8453-50ca8ce25bdd type: title task: id: 82ef281a-644a-4657-8453-50ca8ce25bdd version: -1 name: Indicator Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" - "5" - "6" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1875, "y": 210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "178": id: "178" taskid: 116782ab-603b-493c-8079-e003e251ab6c type: condition task: id: 116782ab-603b-493c-8079-e003e251ab6c version: -1 name: Has query results? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "120" "yes": - "182" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: QRadar.SearchEvents accessor: Events iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 1875, "y": 1770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "181": id: "181" taskid: b4328ddc-50db-4488-8444-48fcac80a903 type: regular task: id: b4328ddc-50db-4488-8444-48fcac80a903 version: -1 name: QRadar Full Search on MD5 description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: inputs.QradarMD5Field transformers: - operator: ProductJoin args: join: value: simple: "=" list2: value: simple: inputs.MD5 iscontext: true - operator: join args: separator: value: simple: ''' OR "' - operator: replaceMatch args: regex: value: simple: "=" replaceWith: value: simple: '" = ''' - operator: concat args: prefix: value: simple: ' from events where "' suffix: {} - operator: concat args: prefix: value: simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) ' suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ''' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1160, "y": 1465 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "182": id: "182" taskid: 5414f421-9773-4d5b-83da-d723d429bfdb type: regular task: id: 5414f421-9773-4d5b-83da-d723d429bfdb version: -1 name: Set detected source and destination IP addresses description: Sets a value into the context with the given context key scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "161" scriptarguments: append: simple: "true" key: simple: QRadar.DetectedIPs value: complex: root: ${ accessor: =[]} transformers: - operator: GetValuesOfMultipleFields args: key: value: simple: QRadar.SearchEvents.Events iscontext: true list: value: simple: inputs.InvestigationIPFields iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2305, "y": 1950 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false system: true view: |- { "linkLabelsPosition": { "11_56_#default#": 0.61, "124_165_#default#": 0.65, "22_166_#default#": 0.1, "29_166_#default#": 0.12, "39_166_#default#": 0.19, "55_176_yes": 0.44, "8_166_#default#": 0.1, "8_26_yes": 0.73, "9_166_#default#": 0.25 }, "paper": { "dimensions": { "height": 3645, "width": 4970, "x": -1590, "y": -125 } } } inputs: - key: MD5 value: {} required: false description: MD5 hash file or an array of hashes to search. playbookInputQuery: - key: QradarMD5Field value: {} required: false description: MD5 field to search in QRadar. If none are specified, the search will use a payload contains filter. playbookInputQuery: - key: SHA1 value: {} required: false description: SHA1 hash file or an array of hashes to search. playbookInputQuery: - key: QradarSHA1Field value: {} required: false description: SHA1 field to search in QRadar. If none are specified, the search will use a payload contains filter. playbookInputQuery: - key: SHA256 value: {} required: false description: SHA256 hash file or an array of hashes to search. playbookInputQuery: - key: QradarSHA256Field value: {} required: false description: SHA256 field to search in QRadar. If none are specified, the search will use a payload contains filter. playbookInputQuery: - key: IPAddress value: {} required: false description: | Source or destination IP to search. Can be a single address or an array of addresses. playbookInputQuery: - key: QradarIPfield value: simple: sourceip,destinationip required: false description: IP field to search in QRadar. If none are specified, the search will use sourceip or destinationip (combined). playbookInputQuery: - key: URLDomain value: {} required: false description: | Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used. playbookInputQuery: - key: QradarURLDomainField value: {} required: false description: 'URL/Domain field to search in QRadar. If none are specified, the search will use a payload contains filter. ' playbookInputQuery: - key: TimeFrame value: simple: LAST 7 DAYS required: false description: |- Time frame as used in AQL Examples can be LAST 7 DAYS START '2019-09-25 15:51' STOP '2019-09-25 17:51' For more examples review IBM's AQL documentation. playbookInputQuery: - key: InternalRange value: complex: root: lists accessor: PrivateIPs transformers: - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2}) unpack_matches: {} - operator: join args: separator: value: simple: ',' required: false description: 'A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).' playbookInputQuery: - key: InvestigationIPFields value: simple: sourceip,destinationip required: true description: The values of these QRadar fields will be used for the playbook IP addresses outputs. playbookInputQuery: - key: InvestigationUserFields value: simple: username required: true description: The values of these QRadar fields will be used for the playbook user name outputs. playbookInputQuery: outputs: - contextPath: QRadar.DetectedUsers description: Users detected based on the username field in your search. type: string - contextPath: QRadar.DetectedInternalIPs description: Internal IP addresses detected based on fields and inputs in your search. type: string - contextPath: QRadar.DetectedExternalIPs description: External IP addresses detected based on fields and inputs in your search. type: string - contextPath: QRadar.DetectedInternalHosts description: Internal host names detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar. type: string - contextPath: QRadar.DetectedExternalHosts description: External host names detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar. type: string tests: - test_Qradar_v2 - QRadar_v3-test - QRadar Indicator Hunting Test fromversion: 5.0.0 supportedModules: - agentix - xsiam - edr - cloud - cloud_runtime_security