QRadar Indicator Hunting Deprecated
Deprecated. Use the "QRadar Indicator Hunting V2" playbook instead.
IBM QRadar · 77 tasks · 13 inputs · 4 outputs
Details
| ID | QRadar Indicator Hunting |
|---|---|
| From Version | 5.0.0 |
| Tasks | 77 |
Inputs
MD5— MD5 hash file or an array of hashes to search.QradarMD5Field— MD5 field to search in QRadar. If none are specified, the search will use a payload contains filter.SHA1— SHA1 hash file or an array of hashes to search.QradarSHA1Field— SHA1 field to search in QRadar. If none are specified, the search will use a payload contains filter.SHA256— SHA256 hash file or an array of hashes to search.QradarSHA256Field— SHA256 field to search in QRadar. If none are specified, the search will use a payload contains filter.IPAddress— Source or destination IP to search. Can be a single address or an array of addresses.QradarIPfield— IP field to search in QRadar. If none are specified, the search will use sourceip or destinationip (combined).URLDomain— Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used.URLDomainField— URL/Domain field to search in QRadar. If none are specified, the search will use a payload contains filter.SelectFields— The fields to be used in the select. Use comma delimited field names as they appear in AQL. * is an acceptable value.TimeFrame— Time frame as used in AQL Examples can be LAST 7 DAYS START '2019-09-25 15:51' STOP '2019-09-25 17:51' For more examples review IBM's AQL documentation.InvestigationFields— The fields to be used for the hunting outputs. These fields are added to the selected field's input.
Outputs
QRadar.Search.Result— Qradar's search results.QRadar.DetectedIPs— IP addresses detected based on sourceip and destinationip fields in your search.QRadar.DetectedUsers— Users detected based on the username field in your search.QRadar.DetectedHosts— Hosts detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar.
Commands used
qradar-get-assets
Flowchart
id: QRadar Indicator Hunting version: -1 fromversion: 5.0.0 name: QRadar Indicator Hunting description: Deprecated. Use the "QRadar Indicator Hunting V2" playbook instead. starttaskid: '0' tasks: '0': id: '0' taskid: 7d17f748-2cfe-4bcb-85c8-4bafa54092c0 type: start task: id: 7d17f748-2cfe-4bcb-85c8-4bafa54092c0 version: -1 name: '' iscommand: false brand: '' description: '' nexttasks: '#none#': - '55' separatecontext: false view: |- { "position": { "x": 760, "y": -240 } } note: false timertriggers: [] ignoreworker: false '2': id: '2' taskid: 901ec201-fe71-4f21-8427-aaf146de7771 type: title task: id: 901ec201-fe71-4f21-8427-aaf146de7771 version: -1 name: Hash Search type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '8' separatecontext: false view: |- { "position": { "x": -670, "y": 210 } } note: false timertriggers: [] ignoreworker: false '3': id: '3' taskid: f6a24f1f-2288-420d-81f0-0fb757c103b6 type: playbook task: id: f6a24f1f-2288-420d-81f0-0fb757c103b6 version: -1 name: QRadarFullSearch description: '' playbookName: QRadarFullSearch type: playbook iscommand: false brand: '' nexttasks: '#none#': - '89' scriptarguments: headers: {} interval: simple: '1' query_expression: complex: root: . transformers: - operator: DT args: dt: value: simple: '.=function(val){var fields = Array.isArray(val.DomainURLFields) ? val.DomainURLFields : [val.DomainURLFields]; var domainurls = Array.isArray(val.DomainURL) ? val.DomainURL : [val.DomainURL]; return fields.map(field => domainurls.map(domainurl => "\"" + field + "\" ILIKE " + "''%" + domainurl + "%''").join('' OR ''))}(val)' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.SelectFields iscontext: true suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true range: {} timeout: simple: '600' separatecontext: true loop: iscommand: false exitCondition: '' wait: 1 view: |- { "position": { "x": 2540, "y": 1450 } } note: false timertriggers: [] ignoreworker: false '5': id: '5' taskid: 93c98c75-6611-4f02-8bc0-18d0b3cbb13f type: title task: id: 93c98c75-6611-4f02-8bc0-18d0b3cbb13f version: -1 name: IP Search type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '7' separatecontext: false view: |- { "position": { "x": 1380, "y": 200 } } note: false timertriggers: [] ignoreworker: false '6': id: '6' taskid: 14e174ac-c95e-4907-8f7f-2ed75fe40735 type: title task: id: 14e174ac-c95e-4907-8f7f-2ed75fe40735 version: -1 name: Domain/Url Search type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '9' separatecontext: false view: |- { "position": { "x": 2100, "y": 200 } } note: false timertriggers: [] ignoreworker: false '7': id: '7' taskid: 1a4a1f82-2d75-4552-8e5f-38d2668ed12e type: condition task: id: 1a4a1f82-2d75-4552-8e5f-38d2668ed12e version: -1 name: Is there an IP to search? description: Is there an IP on which to search? type: condition iscommand: false brand: '' nexttasks: '#default#': - '48' 'yes': - '49' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: simple: inputs.IPAddress iscontext: true view: |- { "position": { "x": 1380, "y": 320 } } note: false timertriggers: [] ignoreworker: false '8': id: '8' taskid: 11b6d002-63f5-4c7b-8888-a7f567a4c752 type: condition task: id: 11b6d002-63f5-4c7b-8888-a7f567a4c752 version: -1 name: Is there a hash to search? description: Is there a hash on which to search? type: condition iscommand: false brand: '' nexttasks: '#default#': - '25' 'yes': - '26' - '27' - '38' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: simple: inputs.MD5 iscontext: true - operator: isNotEmpty left: value: simple: inputs.SHA1 iscontext: true - operator: isNotEmpty left: value: simple: inputs.SHA256 iscontext: true view: |- { "position": { "x": -670, "y": 340 } } note: false timertriggers: [] ignoreworker: false '9': id: '9' taskid: 52b92040-9e3e-4241-80e2-ca7b4612135a type: condition task: id: 52b92040-9e3e-4241-80e2-ca7b4612135a version: -1 name: Is there a domain or url to search? description: Is there a domain or URL on which to search? type: condition iscommand: false brand: '' nexttasks: '#default#': - '10' 'yes': - '15' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: simple: inputs.URLDomain iscontext: true view: |- { "position": { "x": 2100, "y": 320 } } note: false timertriggers: [] ignoreworker: false '10': id: '10' taskid: a55559ca-b477-48ca-8725-c0bb5bfcae82 type: title task: id: a55559ca-b477-48ca-8725-c0bb5bfcae82 version: -1 name: Domain/Url hunting done type: title iscommand: false brand: '' description: '' separatecontext: false view: |- { "position": { "x": 2100, "y": 2540 } } note: false timertriggers: [] ignoreworker: false '11': id: '11' taskid: 9676bcae-277b-4020-8ac0-0a4a114c2e4a type: condition task: id: 9676bcae-277b-4020-8ac0-0a4a114c2e4a version: -1 name: Is there a custom domain or url field? description: Is there a custom domain or url field? type: condition iscommand: false brand: '' nexttasks: '#default#': - '56' 'yes': - '57' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: simple: inputs.URLDomainField iscontext: true view: |- { "position": { "x": 2810, "y": 910 } } note: false timertriggers: [] ignoreworker: false '15': id: '15' taskid: 3d2f242d-c10d-45fe-8248-10d9fa6b2872 type: regular task: id: 3d2f242d-c10d-45fe-8248-10d9fa6b2872 version: -1 name: Set DomainUrl to array description: Sets a value into the context with the given context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '11' scriptarguments: append: simple: 'true' key: simple: DomainURL value: complex: root: inputs.URLDomain transformers: - operator: split args: delimiter: value: simple: ',' separatecontext: false view: |- { "position": { "x": 2810, "y": 680 } } note: false timertriggers: [] ignoreworker: false '16': id: '16' taskid: 1c9bb9f3-1b75-45ba-8215-a76d4ba56ffb type: regular task: id: 1c9bb9f3-1b75-45ba-8215-a76d4ba56ffb version: -1 name: Set DomainUrlFields to Array description: Sets a value into the context with the given context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '3' scriptarguments: append: simple: 'true' key: simple: DomainURLFields value: complex: root: inputs.URLDomainField transformers: - operator: split args: delimiter: value: simple: ',' separatecontext: false view: |- { "position": { "x": 2540, "y": 1305 } } note: false timertriggers: [] ignoreworker: false '17': id: '17' taskid: 389e09e6-b264-4b52-8e94-51af0c84e657 type: playbook task: id: 389e09e6-b264-4b52-8e94-51af0c84e657 version: -1 name: QRadarFullSearch description: '' playbookName: QRadarFullSearch type: playbook iscommand: false brand: '' nexttasks: '#none#': - '89' scriptarguments: headers: {} interval: simple: '1' query_expression: complex: root: DomainURL transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) ILIKE '%$1%' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.SelectFields iscontext: true suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true range: {} timeout: simple: '600' separatecontext: true loop: iscommand: false exitCondition: '' wait: 1 view: |- { "position": { "x": 3110, "y": 1450 } } note: false timertriggers: [] ignoreworker: false '20': id: '20' taskid: 1a8c0e20-1f13-4d6a-869c-f60973a93ea6 type: regular task: id: 1a8c0e20-1f13-4d6a-869c-f60973a93ea6 version: -1 name: Set MD5 to array description: Sets a value into the context with the given context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '21' scriptarguments: append: simple: 'true' key: simple: File.MD5 value: complex: root: inputs.MD5 transformers: - operator: split args: delimiter: value: simple: ',' separatecontext: false view: |- { "position": { "x": -2660, "y": 960 } } note: false timertriggers: [] ignoreworker: false '21': id: '21' taskid: 8fb9b356-eee0-4aca-83df-edb4ca67fbea type: condition task: id: 8fb9b356-eee0-4aca-83df-edb4ca67fbea version: -1 name: Is there a custom MD5 field? description: Is there a custom MD5 field? type: condition iscommand: false brand: '' nexttasks: '#default#': - '64' 'yes': - '65' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: simple: inputs.QradarMD5Field iscontext: true view: |- { "position": { "x": -2660, "y": 1160 } } note: false timertriggers: [] ignoreworker: false '22': id: '22' taskid: b06815b7-9e80-46bd-800c-013ed9a59ceb type: condition task: id: b06815b7-9e80-46bd-800c-013ed9a59ceb version: -1 name: Is there an MD5 to search? description: Is there an MD5 on which to search? type: condition iscommand: false brand: '' nexttasks: '#default#': - '25' 'yes': - '20' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: simple: inputs.MD5 iscontext: true view: |- { "position": { "x": -1930, "y": 775 } } note: false timertriggers: [] ignoreworker: false '23': id: '23' taskid: ccb6c3a4-8c60-4c51-8a3d-331d022ef257 type: playbook task: id: ccb6c3a4-8c60-4c51-8a3d-331d022ef257 version: -1 name: QRadarFullSearch description: '' playbookName: QRadarFullSearch type: playbook iscommand: false brand: '' nexttasks: '#none#': - '93' scriptarguments: headers: {} interval: simple: '1' query_expression: complex: root: File accessor: MD5 transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) LIKE '$1' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.SelectFields iscontext: true suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true range: {} timeout: simple: '600' separatecontext: true loop: iscommand: false exitCondition: '' wait: 1 view: |- { "position": { "x": -2950, "y": 1640 } } note: false timertriggers: [] ignoreworker: false '25': id: '25' taskid: 9c085b17-06d1-49a0-8ec0-50f0ff3e72d4 type: title task: id: 9c085b17-06d1-49a0-8ec0-50f0ff3e72d4 version: -1 name: Hash hunting done type: title iscommand: false brand: '' description: '' separatecontext: false view: |- { "position": { "x": -670, "y": 2790 } } note: false timertriggers: [] ignoreworker: false '26': id: '26' taskid: 5ad35d56-bdbc-4fef-80c4-06f4298970e5 type: title task: id: 5ad35d56-bdbc-4fef-80c4-06f4298970e5 version: -1 name: MD5 Search type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '22' separatecontext: false view: |- { "position": { "x": -1930, "y": 640 } } note: false timertriggers: [] ignoreworker: false '27': id: '27' taskid: 0b02ee2b-17e1-4a2d-8054-72dd925f10c7 type: title task: id: 0b02ee2b-17e1-4a2d-8054-72dd925f10c7 version: -1 name: SHA1 Search type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '29' separatecontext: false view: |- { "position": { "x": -1520, "y": 640 } } note: false timertriggers: [] ignoreworker: false '29': id: '29' taskid: f853ef67-53ce-47ff-8797-1b1f10b81f9d type: condition task: id: f853ef67-53ce-47ff-8797-1b1f10b81f9d version: -1 name: Is there a SHA1 to search? description: Is there a SHA1 hash on which to search? type: condition iscommand: false brand: '' nexttasks: '#default#': - '25' 'yes': - '30' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: simple: inputs.SHA1 iscontext: true view: |- { "position": { "x": -1520, "y": 775 } } note: false timertriggers: [] ignoreworker: false '30': id: '30' taskid: 157199ac-8187-4e6e-8fd1-0a932d0cea3c type: regular task: id: 157199ac-8187-4e6e-8fd1-0a932d0cea3c version: -1 name: Set SHA1 to array description: Sets a value into the context with the given context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '31' scriptarguments: append: simple: 'true' key: simple: File.SHA1 value: complex: root: inputs.SHA1 transformers: - operator: split args: delimiter: value: simple: ',' separatecontext: false view: |- { "position": { "x": -1170, "y": 950 } } note: false timertriggers: [] ignoreworker: false '31': id: '31' taskid: d38b9fec-cea7-4afb-82d8-638e01ec0fc2 type: condition task: id: d38b9fec-cea7-4afb-82d8-638e01ec0fc2 version: -1 name: Was there a custom SHA1 field? description: Was there a custom SHA1 field? type: condition iscommand: false brand: '' nexttasks: '#default#': - '62' 'yes': - '63' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: complex: root: inputs.QradarSHA1Field iscontext: true view: |- { "position": { "x": -1170, "y": 1120 } } note: false timertriggers: [] ignoreworker: false '34': id: '34' taskid: 9799d2df-bf3e-4fcc-8fe2-f47cb71002e8 type: playbook task: id: 9799d2df-bf3e-4fcc-8fe2-f47cb71002e8 version: -1 name: QRadarFullSearch description: '' playbookName: QRadarFullSearch type: playbook iscommand: false brand: '' nexttasks: '#none#': - '91' scriptarguments: headers: {} interval: simple: '1' query_expression: complex: root: . transformers: - operator: DT args: dt: value: simple: '.=function(val){var fields = Array.isArray(val.SHA1Fields) ? val.SHA1Fields : [val.SHA1Fields]; var sha1s = Array.isArray(val.File.SHA1) ? val.File.SHA1 : [val.File.SHA1]; return fields.map(field => sha1s.map(sha1 => "\"" + field + "\" = " + "''" + sha1 + "''").join('' OR ''))}(val)' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.SelectFields iscontext: true suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true range: {} timeout: simple: '600' separatecontext: true loop: iscommand: false exitCondition: '' wait: 1 view: |- { "position": { "x": -890, "y": 1650 } } note: false timertriggers: [] ignoreworker: false '35': id: '35' taskid: 9a7b1c53-3694-4cac-877d-3c9848c95de3 type: playbook task: id: 9a7b1c53-3694-4cac-877d-3c9848c95de3 version: -1 name: QRadarFullSearch description: '' playbookName: QRadarFullSearch type: playbook iscommand: false brand: '' nexttasks: '#none#': - '91' scriptarguments: headers: {} interval: simple: '1' query_expression: complex: root: File accessor: SHA1 transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) LIKE '$1' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.SelectFields iscontext: true suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true range: {} timeout: simple: '600' separatecontext: true loop: iscommand: false exitCondition: '' wait: 1 view: |- { "position": { "x": -1290, "y": 1650 } } note: false timertriggers: [] ignoreworker: false '36': id: '36' taskid: 6d184cb6-0602-4d08-8e78-f906ae572995 type: regular task: id: 6d184cb6-0602-4d08-8e78-f906ae572995 version: -1 name: Set MD5Fields to Array description: Sets a value into the context with the given context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '37' scriptarguments: append: simple: 'true' key: simple: MD5Fields value: complex: root: inputs.QradarMD5Field transformers: - operator: split args: delimiter: value: simple: ',' separatecontext: false view: |- { "position": { "x": -2400, "y": 1505 } } note: false timertriggers: [] ignoreworker: false '37': id: '37' taskid: fb43e0cc-ace7-4f6e-8b75-fe60fa3641ec type: playbook task: id: fb43e0cc-ace7-4f6e-8b75-fe60fa3641ec version: -1 name: QRadarFullSearch description: '' playbookName: QRadarFullSearch type: playbook iscommand: false brand: '' nexttasks: '#none#': - '93' scriptarguments: headers: {} interval: simple: '1' query_expression: complex: root: . transformers: - operator: DT args: dt: value: simple: '.=function(val){var fields = Array.isArray(val.MD5Fields) ? val.MD5Fields : [val.MD5Fields]; var md5s = Array.isArray(val.File.MD5) ? val.File.MD5 : [val.File.MD5]; return fields.map(field => md5s.map(md5 => "\"" + field + "\" = " + "''" + md5 + "''").join('' OR ''))}(val)' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.SelectFields iscontext: true suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true range: {} timeout: simple: '600' separatecontext: true loop: iscommand: false exitCondition: '' wait: 1 view: |- { "position": { "x": -2400, "y": 1640 } } note: false timertriggers: [] ignoreworker: false '38': id: '38' taskid: 424dd29e-0aed-4cfd-8bff-68d2ea35b0b5 type: title task: id: 424dd29e-0aed-4cfd-8bff-68d2ea35b0b5 version: -1 name: SHA256 Search type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '39' separatecontext: false view: |- { "position": { "x": -270, "y": 560 } } note: false timertriggers: [] ignoreworker: false '39': id: '39' taskid: e5d99d6d-1f68-4ef0-8fc3-475a3ad32d2c type: condition task: id: e5d99d6d-1f68-4ef0-8fc3-475a3ad32d2c version: -1 name: Is there a SHA256 to search? description: Is there a SHA256 hash on which to search? type: condition iscommand: false brand: '' nexttasks: '#default#': - '25' 'yes': - '40' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: simple: inputs.SHA256 iscontext: true view: |- { "position": { "x": -270, "y": 660 } } note: false timertriggers: [] ignoreworker: false '40': id: '40' taskid: 7856b49f-6425-4145-8b67-21abf184b78d type: regular task: id: 7856b49f-6425-4145-8b67-21abf184b78d version: -1 name: Set SHA256 to array description: Sets a value into the context with the given context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '41' scriptarguments: append: simple: 'true' key: simple: File.SHA256 value: complex: root: inputs.SHA256 transformers: - operator: split args: delimiter: value: simple: ',' separatecontext: false view: |- { "position": { "x": -250, "y": 950 } } note: false timertriggers: [] ignoreworker: false '41': id: '41' taskid: 06296669-d347-4f91-8b9b-e15011755fd0 type: condition task: id: 06296669-d347-4f91-8b9b-e15011755fd0 version: -1 name: Is there a custom SHA256 field? description: Is there a custom SHA256 field? type: condition iscommand: false brand: '' nexttasks: '#default#': - '60' 'yes': - '61' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: complex: root: inputs.QradarSHA256Field iscontext: true view: |- { "position": { "x": -250, "y": 1120 } } note: false timertriggers: [] ignoreworker: false '44': id: '44' taskid: 95b47dbd-63ab-451c-8ac6-391bfe39a9e3 type: regular task: id: 95b47dbd-63ab-451c-8ac6-391bfe39a9e3 version: -1 name: Set SHA1Fields to Array description: Sets a value into the context with the given context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '34' scriptarguments: append: simple: 'true' key: simple: SHA1Fields value: complex: root: inputs.QradarSHA1Field transformers: - operator: split args: delimiter: value: simple: ',' separatecontext: false view: |- { "position": { "x": -890, "y": 1480 } } note: false timertriggers: [] ignoreworker: false '45': id: '45' taskid: 6ce5285e-0788-43d1-8f95-5692fdf1ab8d type: regular task: id: 6ce5285e-0788-43d1-8f95-5692fdf1ab8d version: -1 name: Set SHA256Fields to Array description: Sets a value into the context with the given context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '46' scriptarguments: append: simple: 'true' key: simple: SHA256Fields value: complex: root: inputs.QradarSHA256Field transformers: - operator: split args: delimiter: value: simple: ',' separatecontext: false view: |- { "position": { "x": -30, "y": 1480 } } note: false timertriggers: [] ignoreworker: false '46': id: '46' taskid: 31cdcbf0-27c0-4591-8b45-83b4979290eb type: playbook task: id: 31cdcbf0-27c0-4591-8b45-83b4979290eb version: -1 name: QRadarFullSearch description: '' playbookName: QRadarFullSearch type: playbook iscommand: false brand: '' nexttasks: '#none#': - '90' scriptarguments: headers: {} interval: simple: '1' query_expression: complex: root: . transformers: - operator: DT args: dt: value: simple: '.=function(val){var fields = Array.isArray(val.SHA256Fields) ? val.SHA256Fields : [val.SHA256Fields]; var sha256s = Array.isArray(val.File.SHA256) ? val.File.SHA256 : [val.File.SHA256]; return fields.map(field => sha256s.map(sha256 => "\"" + field + "\" = " + "''" + sha256 + "''").join('' OR ''))}(val)' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.SelectFields iscontext: true suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true range: {} timeout: simple: '600' separatecontext: true loop: iscommand: false exitCondition: '' wait: 1 view: |- { "position": { "x": -30, "y": 1650 } } note: false timertriggers: [] ignoreworker: false '47': id: '47' taskid: fd37d7ea-2a0c-43c3-8e11-0a694bab2c7d type: playbook task: id: fd37d7ea-2a0c-43c3-8e11-0a694bab2c7d version: -1 name: QRadarFullSearch description: '' playbookName: QRadarFullSearch type: playbook iscommand: false brand: '' nexttasks: '#none#': - '90' scriptarguments: headers: {} interval: simple: '1' query_expression: complex: root: File accessor: SHA256 transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) ILIKE '$1' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.SelectFields iscontext: true suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true range: {} timeout: simple: '600' separatecontext: true loop: iscommand: false exitCondition: '' wait: 1 view: |- { "position": { "x": -440, "y": 1650 } } note: false timertriggers: [] ignoreworker: false '48': id: '48' taskid: b9bb02ea-887d-4450-8927-158b66677b7c type: title task: id: b9bb02ea-887d-4450-8927-158b66677b7c version: -1 name: IP hunting done type: title iscommand: false brand: '' description: '' separatecontext: false view: |- { "position": { "x": 760, "y": 2550 } } note: false timertriggers: [] ignoreworker: false '49': id: '49' taskid: 226c6740-786a-4b0b-87cd-37fc80524652 type: regular task: id: 226c6740-786a-4b0b-87cd-37fc80524652 version: -1 name: Set IP to array description: Sets a value into the context with the given context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '50' scriptarguments: append: simple: 'true' key: simple: IP value: complex: root: inputs.IPAddress transformers: - operator: split args: delimiter: value: simple: ',' separatecontext: false view: |- { "position": { "x": 1380, "y": 680 } } note: false timertriggers: [] ignoreworker: false '50': id: '50' taskid: 59b4d1c9-0348-4d49-8ff3-7ad7ab6c0d68 type: condition task: id: 59b4d1c9-0348-4d49-8ff3-7ad7ab6c0d68 version: -1 name: Is there a custom IP field? description: Is there a custom IP field? type: condition iscommand: false brand: '' nexttasks: '#default#': - '59' 'yes': - '58' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: complex: root: inputs.QradarIPfield iscontext: true view: |- { "position": { "x": 1380, "y": 910 } } note: false timertriggers: [] ignoreworker: false '51': id: '51' taskid: 96663c69-8445-4188-8e3a-0327b63a2ed5 type: regular task: id: 96663c69-8445-4188-8e3a-0327b63a2ed5 version: -1 name: Set IPFields to Array description: Sets a value into the context with the given context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '52' scriptarguments: append: simple: 'true' key: simple: IPFields value: complex: root: inputs.QradarIPfield transformers: - operator: split args: delimiter: value: simple: ',' separatecontext: false view: |- { "position": { "x": 1590, "y": 1305 } } note: false timertriggers: [] ignoreworker: false '52': id: '52' taskid: c67276ae-cf37-4483-8705-6761606e7408 type: playbook task: id: c67276ae-cf37-4483-8705-6761606e7408 version: -1 name: QRadarFullSearch description: '' playbookName: QRadarFullSearch type: playbook iscommand: false brand: '' nexttasks: '#none#': - '88' scriptarguments: headers: {} interval: simple: '1' query_expression: complex: root: . transformers: - operator: DT args: dt: value: simple: '.=function(val){var fields = Array.isArray(val.IPFields) ? val.IPFields : [val.IPFields]; var ips = Array.isArray(val.IP) ? val.IP : [val.IP]; return fields.map(field => ips.map(ip => "\"" + field + "\" = " + "''" + ip + "''").join('' OR ''))}(val)' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.SelectFields iscontext: true suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true range: {} timeout: simple: '600' separatecontext: true loop: iscommand: false exitCondition: '' wait: 1 view: |- { "position": { "x": 1590, "y": 1450 } } note: false timertriggers: [] ignoreworker: false '53': id: '53' taskid: 16aa0f07-2129-4f94-81ef-9992ad665840 type: playbook task: id: 16aa0f07-2129-4f94-81ef-9992ad665840 version: -1 name: QRadarFullSearch description: '' playbookName: QRadarFullSearch type: playbook iscommand: false brand: '' nexttasks: '#none#': - '88' scriptarguments: headers: {} interval: simple: '1' query_expression: complex: root: IP transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) LIKE '$1' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.SelectFields iscontext: true suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true range: {} timeout: simple: '600' separatecontext: true loop: iscommand: false exitCondition: '' wait: 1 view: |- { "position": { "x": 1060, "y": 1450 } } note: false timertriggers: [] ignoreworker: false '55': id: '55' taskid: 3f966e73-39a9-4c84-86c8-8707997aacf0 type: condition task: id: 3f966e73-39a9-4c84-86c8-8707997aacf0 version: -1 name: Is Qradar enabled? description: Is Qradar enabled? type: condition iscommand: false brand: '' nexttasks: '#default#': - '48' 'yes': - '2' - '5' - '6' separatecontext: false conditions: - label: 'yes' condition: - - operator: isExists left: value: simple: modules.brand iscontext: true - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: QRadar - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active view: |- { "position": { "x": 760, "y": -90 } } note: false timertriggers: [] ignoreworker: false '56': id: '56' taskid: 96e506c1-3c8c-4f47-8bbc-98d2aa79d74b type: title task: id: 96e506c1-3c8c-4f47-8bbc-98d2aa79d74b version: -1 name: QRadar query without custom fields type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '17' separatecontext: false view: |- { "position": { "x": 3110, "y": 1200 } } note: false timertriggers: [] ignoreworker: false '57': id: '57' taskid: f1177866-0c97-4ee1-8a7e-20002a21a2c6 type: title task: id: f1177866-0c97-4ee1-8a7e-20002a21a2c6 version: -1 name: QRadar query with custom fields type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '16' separatecontext: false view: |- { "position": { "x": 2540, "y": 1200 } } note: false timertriggers: [] ignoreworker: false '58': id: '58' taskid: 92ab1a00-cada-4654-8bb4-0d6579a46b3f type: title task: id: 92ab1a00-cada-4654-8bb4-0d6579a46b3f version: -1 name: QRadar query with custom fields type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '51' separatecontext: false view: |- { "position": { "x": 1590, "y": 1200 } } note: false timertriggers: [] ignoreworker: false '59': id: '59' taskid: 7c4a3027-bee0-42ed-8b81-dab958dc227f type: title task: id: 7c4a3027-bee0-42ed-8b81-dab958dc227f version: -1 name: QRadar query without custom fields type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '53' separatecontext: false view: |- { "position": { "x": 1060, "y": 1200 } } note: false timertriggers: [] ignoreworker: false '60': id: '60' taskid: 6f50e9e3-6824-47f8-8fdb-29a86df3d377 type: title task: id: 6f50e9e3-6824-47f8-8fdb-29a86df3d377 version: -1 name: QRadar query without custom fields type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '47' separatecontext: false view: |- { "position": { "x": -440, "y": 1320 } } note: false timertriggers: [] ignoreworker: false '61': id: '61' taskid: 4960e972-f8f5-4258-8df4-3175d0ed3a1f type: title task: id: 4960e972-f8f5-4258-8df4-3175d0ed3a1f version: -1 name: QRadar query with custom fields type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '45' separatecontext: false view: |- { "position": { "x": -30, "y": 1320 } } note: false timertriggers: [] ignoreworker: false '62': id: '62' taskid: 1688d212-f5c1-4e5b-8991-c9fcbd005cd5 type: title task: id: 1688d212-f5c1-4e5b-8991-c9fcbd005cd5 version: -1 name: QRadar query without custom fields type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '35' separatecontext: false view: |- { "position": { "x": -1290, "y": 1320 } } note: false timertriggers: [] ignoreworker: false '63': id: '63' taskid: 788dd4b2-8aa9-4ff7-8c0a-92258c0e5e0e type: title task: id: 788dd4b2-8aa9-4ff7-8c0a-92258c0e5e0e version: -1 name: QRadar query with custom fields type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '44' separatecontext: false view: |- { "position": { "x": -890, "y": 1320 } } note: false timertriggers: [] ignoreworker: false '64': id: '64' taskid: 6ca5fe4b-693e-4cf6-8e8b-63fde60bc5ed type: title task: id: 6ca5fe4b-693e-4cf6-8e8b-63fde60bc5ed version: -1 name: QRadar query without custom fields type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '23' separatecontext: false view: |- { "position": { "x": -2950, "y": 1360 } } note: false timertriggers: [] ignoreworker: false '65': id: '65' taskid: e2b3740e-4fb3-4dce-8656-654574fc14a4 type: title task: id: e2b3740e-4fb3-4dce-8656-654574fc14a4 version: -1 name: QRadar query with custom fields type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '36' separatecontext: false view: |- { "position": { "x": -2400, "y": 1350 } } note: false timertriggers: [] ignoreworker: false '66': id: '66' taskid: 2ab45f59-c5eb-4c7d-8b4e-d644ee5f805d type: regular task: id: 2ab45f59-c5eb-4c7d-8b4e-d644ee5f805d version: -1 name: Set detected IP addresses description: Sets the IP addresses found in the DetectedIPs context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '67' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedIPs value: complex: root: ${QRadar accessor: Search.Result.events.sourceip} transformers: - operator: append args: item: value: simple: ${QRadar.Search.Result.events.destinationip} iscontext: true - operator: uniq separatecontext: false view: |- { "position": { "x": 1320, "y": 1880 } } note: false timertriggers: [] ignoreworker: false '67': id: '67' taskid: b6c28137-213b-4740-8ebf-b6ff6c7761a0 type: regular task: id: b6c28137-213b-4740-8ebf-b6ff6c7761a0 version: -1 name: Set detected usernames description: Sets the usernames found in the DetectedUsers context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '68' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedUsers value: complex: root: ${QRadar accessor: Search.Result.events.username} transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": 1320, "y": 2045 } } note: false timertriggers: [] ignoreworker: false '68': id: '68' taskid: a1b68eff-34d9-486a-85a1-1cf60722503a type: regular task: id: a1b68eff-34d9-486a-85a1-1cf60722503a version: -1 name: Get hostnames from assets description: List all assets found in the model script: '|||qradar-get-assets' type: regular iscommand: true brand: '' nexttasks: '#none#': - '70' scriptarguments: fields: {} filter: complex: root: ${QRadar accessor: DetectedIPs} transformers: - operator: concat args: prefix: value: simple: interfaces contains ip_addresses contains value= " suffix: value: simple: '"' - operator: join args: separator: value: simple: ' OR ' headers: {} range: {} separatecontext: false view: |- { "position": { "x": 1320, "y": 2200 } } note: false timertriggers: [] ignoreworker: false '70': id: '70' taskid: 63d16d8f-95cf-4668-8775-b97c98fd2613 type: regular task: id: 63d16d8f-95cf-4668-8775-b97c98fd2613 version: -1 name: Set detected hostnames from assets description: Sets the hostnames found in the DetectedHosts context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '48' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedHosts value: complex: root: ${QRadar accessor: Asset.Name.Value} transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": 1320, "y": 2355 } } note: false timertriggers: [] ignoreworker: false '71': id: '71' taskid: ea7b46f4-4c4d-458b-8801-9e9124d6ac01 type: regular task: id: ea7b46f4-4c4d-458b-8801-9e9124d6ac01 version: -1 name: Set detected IP addresses description: Sets the IP addresses found in the DetectedIPs context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '72' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedIPs value: complex: root: ${QRadar accessor: Search.Result.events.sourceip} transformers: - operator: append args: item: value: simple: ${QRadar.Search.Result.events.destinationip} iscontext: true - operator: uniq separatecontext: false view: |- { "position": { "x": 2810, "y": 1880 } } note: false timertriggers: [] ignoreworker: false '72': id: '72' taskid: 5b531c4f-9e6c-4072-8f7a-7ebc8328bc38 type: regular task: id: 5b531c4f-9e6c-4072-8f7a-7ebc8328bc38 version: -1 name: Set detected usernames description: Sets the usernames found in the DetectedUsers context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '73' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedUsers value: complex: root: ${QRadar accessor: Search.Result.events.username} transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": 2810, "y": 2045 } } note: false timertriggers: [] ignoreworker: false '73': id: '73' taskid: ce3528f2-d0e7-49c7-8cef-fff4f19be3e1 type: regular task: id: ce3528f2-d0e7-49c7-8cef-fff4f19be3e1 version: -1 name: Get hostnames from assets description: List all assets found in the model script: '|||qradar-get-assets' type: regular iscommand: true brand: '' nexttasks: '#none#': - '74' scriptarguments: fields: {} filter: complex: root: ${QRadar accessor: DetectedIPs} transformers: - operator: concat args: prefix: value: simple: interfaces contains ip_addresses contains value= " suffix: value: simple: '"' - operator: join args: separator: value: simple: ' OR ' headers: {} range: {} separatecontext: false view: |- { "position": { "x": 2810, "y": 2200 } } note: false timertriggers: [] ignoreworker: false '74': id: '74' taskid: 0c266af1-631e-4a36-8339-cc9e4ed5acbd type: regular task: id: 0c266af1-631e-4a36-8339-cc9e4ed5acbd version: -1 name: Set detected hostnames from assets description: Sets the hostnames found in the DetectedHosts context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '10' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedHosts value: complex: root: ${QRadar accessor: Asset.Name.Value} transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": 2810, "y": 2355 } } note: false timertriggers: [] ignoreworker: false '76': id: '76' taskid: a90db54b-31e7-4690-896d-d910cdbf12ed type: regular task: id: a90db54b-31e7-4690-896d-d910cdbf12ed version: -1 name: Set detected usernames description: Sets the usernames found in the DetectedUsers context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '77' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedUsers value: complex: root: ${QRadar accessor: Search.Result.events.username} transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": -200, "y": 2250 } } note: false timertriggers: [] ignoreworker: false '77': id: '77' taskid: 8e627ec7-629d-433c-8c73-6152d2e963e2 type: regular task: id: 8e627ec7-629d-433c-8c73-6152d2e963e2 version: -1 name: Get hostnames from assets description: List all assets found in the model script: '|||qradar-get-assets' type: regular iscommand: true brand: '' nexttasks: '#none#': - '78' scriptarguments: fields: {} filter: complex: root: ${QRadar accessor: DetectedIPs} transformers: - operator: concat args: prefix: value: simple: interfaces contains ip_addresses contains value= " suffix: value: simple: '"' - operator: join args: separator: value: simple: ' OR ' headers: {} range: {} separatecontext: false view: |- { "position": { "x": -200, "y": 2395 } } note: false timertriggers: [] ignoreworker: false '78': id: '78' taskid: 47354bc5-ee46-43ef-82b9-451510b27293 type: regular task: id: 47354bc5-ee46-43ef-82b9-451510b27293 version: -1 name: Set detected hostnames from assets description: Sets the hostnames found in the DetectedHosts context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '25' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedHosts value: complex: root: ${QRadar accessor: Asset.Name.Value} transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": -200, "y": 2550 } } note: false timertriggers: [] ignoreworker: false '79': id: '79' taskid: 427f7845-ff31-42f4-88a6-4b3da8ccafe2 type: regular task: id: 427f7845-ff31-42f4-88a6-4b3da8ccafe2 version: -1 name: Set detected IP addresses description: Sets the IP addresses found in the DetectedIPs context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '80' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedIPs value: complex: root: ${QRadar accessor: Search.Result.events.sourceip} transformers: - operator: append args: item: value: simple: ${QRadar.Search.Result.events.destinationip} iscontext: true - operator: uniq separatecontext: false view: |- { "position": { "x": -1100, "y": 2095 } } note: false timertriggers: [] ignoreworker: false '80': id: '80' taskid: 134a4982-0e96-4623-8b15-9435c8ad7eba type: regular task: id: 134a4982-0e96-4623-8b15-9435c8ad7eba version: -1 name: Set detected usernames description: Sets the usernames found in the DetectedUsers context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '81' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedUsers value: complex: root: ${QRadar accessor: Search.Result.events.username} transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": -1090, "y": 2250 } } note: false timertriggers: [] ignoreworker: false '81': id: '81' taskid: 745e34b3-01f1-4f8d-865e-7d65e3e401f3 type: regular task: id: 745e34b3-01f1-4f8d-865e-7d65e3e401f3 version: -1 name: Get hostnames from assets description: List all assets found in the model script: '|||qradar-get-assets' type: regular iscommand: true brand: '' nexttasks: '#none#': - '82' scriptarguments: fields: {} filter: complex: root: ${QRadar accessor: DetectedIPs} transformers: - operator: concat args: prefix: value: simple: interfaces contains ip_addresses contains value= " suffix: value: simple: '"' - operator: join args: separator: value: simple: ' OR ' headers: {} range: {} separatecontext: false view: |- { "position": { "x": -1090, "y": 2395 } } note: false timertriggers: [] ignoreworker: false '82': id: '82' taskid: 2eb43ac7-a464-41b1-8795-08370ed415b4 type: regular task: id: 2eb43ac7-a464-41b1-8795-08370ed415b4 version: -1 name: Set detected hostnames from assets description: Sets the hostnames found in the DetectedHosts context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '25' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedHosts value: complex: root: ${QRadar accessor: Asset.Name.Value} transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": -1090, "y": 2550 } } note: false timertriggers: [] ignoreworker: false '83': id: '83' taskid: acb8eb12-ff99-44a6-8765-c3b1d750f066 type: regular task: id: acb8eb12-ff99-44a6-8765-c3b1d750f066 version: -1 name: Set detected IP addresses description: Sets the IP addresses found in the DetectedIPs context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '84' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedIPs value: complex: root: ${QRadar accessor: Search.Result.events.sourceip} transformers: - operator: append args: item: value: simple: ${QRadar.Search.Result.events.destinationip} iscontext: true - operator: uniq separatecontext: false view: |- { "position": { "x": -2350, "y": 2065 } } note: false timertriggers: [] ignoreworker: false '84': id: '84' taskid: b1fe87e9-59cc-4804-84ef-fc039d3f012b type: regular task: id: b1fe87e9-59cc-4804-84ef-fc039d3f012b version: -1 name: Set detected usernames description: Sets the usernames found in the DetectedUsers context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '85' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedUsers value: complex: root: ${QRadar accessor: Search.Result.events.username} transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": -2350, "y": 2250 } } note: false timertriggers: [] ignoreworker: false '85': id: '85' taskid: ed8062ce-f144-47d1-8b74-7903a81ad089 type: regular task: id: ed8062ce-f144-47d1-8b74-7903a81ad089 version: -1 name: Get hostnames from assets description: List all assets found in the model script: '|||qradar-get-assets' type: regular iscommand: true brand: '' nexttasks: '#none#': - '86' scriptarguments: fields: {} filter: complex: root: ${QRadar accessor: DetectedIPs} transformers: - operator: concat args: prefix: value: simple: interfaces contains ip_addresses contains value= " suffix: value: simple: '"' - operator: join args: separator: value: simple: ' OR ' headers: {} range: {} separatecontext: false view: |- { "position": { "x": -2350, "y": 2395 } } note: false timertriggers: [] ignoreworker: false '86': id: '86' taskid: 453c6b03-6c0e-4a67-880d-89b7dd549969 type: regular task: id: 453c6b03-6c0e-4a67-880d-89b7dd549969 version: -1 name: Set detected hostnames from assets description: Sets the hostnames found in the DetectedHosts context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '25' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedHosts value: complex: root: ${QRadar accessor: Asset.Name.Value} transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": -2350, "y": 2550 } } note: false timertriggers: [] ignoreworker: false '87': id: '87' taskid: 33de96b1-93f5-4b0d-8fc4-445b724e0faf type: regular task: id: 33de96b1-93f5-4b0d-8fc4-445b724e0faf version: -1 name: Set detected IP addresses description: Sets the IP addresses found in the DetectedIPs context key. scriptName: Set type: regular iscommand: false brand: '' nexttasks: '#none#': - '76' scriptarguments: append: simple: 'true' key: simple: QRadar.DetectedIPs value: complex: root: ${QRadar accessor: Search.Result.events.sourceip} transformers: - operator: append args: item: value: simple: ${QRadar.Search.Result.events.destinationip} iscontext: true - operator: uniq separatecontext: false view: |- { "position": { "x": -200, "y": 2095 } } note: false timertriggers: [] ignoreworker: false '88': id: '88' taskid: 88a769f3-02af-420f-8ebe-7b0bf4cb7304 type: condition task: description: '' id: 88a769f3-02af-420f-8ebe-7b0bf4cb7304 version: -1 name: Is ip detected by QRadar? type: condition iscommand: false brand: '' nexttasks: '#default#': - '48' 'yes': - '66' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: simple: QRadar.Search.Result iscontext: true - operator: isNotEmpty left: value: simple: QRadar.Search.Result iscontext: true view: |- { "position": { "x": 1310, "y": 1640 } } note: false timertriggers: [] ignoreworker: false '89': id: '89' taskid: 527ecb0c-d661-4adc-8e96-2e4b78217022 type: condition task: description: '' id: 527ecb0c-d661-4adc-8e96-2e4b78217022 version: -1 name: Is domain or url detected by QRadar? type: condition iscommand: false brand: '' nexttasks: '#default#': - '10' 'yes': - '71' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: simple: QRadar.Search.Result iscontext: true - operator: isNotEmpty left: value: simple: QRadar.Search.Result iscontext: true view: |- { "position": { "x": 2810, "y": 1650 } } note: false timertriggers: [] ignoreworker: false '90': id: '90' taskid: 3280403b-1163-4d93-87f0-5f4b513bc573 type: condition task: description: '' id: 3280403b-1163-4d93-87f0-5f4b513bc573 version: -1 name: Is SHA256 file hash detected by QRadar? type: condition iscommand: false brand: '' nexttasks: '#default#': - '25' 'yes': - '87' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: simple: QRadar.Search.Result iscontext: true - operator: isNotEmpty left: value: simple: QRadar.Search.Result iscontext: true view: |- { "position": { "x": -200, "y": 1870 } } note: false timertriggers: [] ignoreworker: false '91': id: '91' taskid: 9723aa93-2d5e-4895-80ea-33ab02556dbf type: condition task: description: '' id: 9723aa93-2d5e-4895-80ea-33ab02556dbf version: -1 name: Is SHA1 file hash detected by QRadar? type: condition iscommand: false brand: '' nexttasks: '#default#': - '25' 'yes': - '79' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: simple: QRadar.Search.Result iscontext: true - operator: isNotEmpty left: value: simple: QRadar.Search.Result iscontext: true view: |- { "position": { "x": -1090, "y": 1870 } } note: false timertriggers: [] ignoreworker: false '93': id: '93' taskid: ac143d95-bceb-4594-8222-7d4d59b8a2ae type: condition task: description: '' id: ac143d95-bceb-4594-8222-7d4d59b8a2ae version: -1 name: Is Md5 file hash detected by QRadar? type: condition iscommand: false brand: '' nexttasks: '#default#': - '25' 'yes': - '83' separatecontext: false conditions: - label: 'yes' condition: - - operator: isNotEmpty left: value: simple: QRadar.Search.Result iscontext: true - operator: isNotEmpty left: value: simple: QRadar.Search.Result iscontext: true view: |- { "position": { "x": -3220, "y": 1880 } } note: false timertriggers: [] ignoreworker: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 3095, "width": 6710, "x": -3220, "y": -240 } } } inputs: - key: MD5 value: {} required: false description: MD5 hash file or an array of hashes to search. - key: QradarMD5Field value: {} required: false description: MD5 field to search in QRadar. If none are specified, the search will use a payload contains filter. - key: SHA1 value: {} required: false description: SHA1 hash file or an array of hashes to search. - key: QradarSHA1Field value: {} required: false description: SHA1 field to search in QRadar. If none are specified, the search will use a payload contains filter. - key: SHA256 value: {} required: false description: SHA256 hash file or an array of hashes to search. - key: QradarSHA256Field value: {} required: false description: SHA256 field to search in QRadar. If none are specified, the search will use a payload contains filter. - key: IPAddress value: {} required: false description: | Source or destination IP to search. Can be a single address or an array of addresses. - key: QradarIPfield value: simple: sourceip,destinationip required: false description: IP field to search in QRadar. If none are specified, the search will use sourceip or destinationip (combined). - key: URLDomain value: {} required: false description: | Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used. - key: URLDomainField value: {} required: false description: 'URL/Domain field to search in QRadar. If none are specified, the search will use a payload contains filter. ' - key: SelectFields value: simple: '*' required: true description: The fields to be used in the select. Use comma delimited field names as they appear in AQL. * is an acceptable value. - key: TimeFrame value: simple: LAST 7 DAYS required: false description: |- Time frame as used in AQL Examples can be LAST 7 DAYS START '2019-09-25 15:51' STOP '2019-09-25 17:51' For more examples review IBM's AQL documentation. - key: InvestigationFields value: simple: sourceip,destinationip,username required: true description: The fields to be used for the hunting outputs. These fields are added to the selected field's input. outputs: - contextPath: QRadar.Search.Result description: Qradar's search results. type: string - contextPath: QRadar.DetectedIPs description: IP addresses detected based on sourceip and destinationip fields in your search. type: string - contextPath: QRadar.DetectedUsers description: Users detected based on the username field in your search. type: string - contextPath: QRadar.DetectedHosts description: 'Hosts detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar.' type: string tests: - No test - Deprecated playbook deprecated: true supportedModules: - agentix - xsiam