QRadar Indicator Hunting Deprecated

Deprecated. Use the "QRadar Indicator Hunting V2" playbook instead.
IBM QRadar · 77 tasks · 13 inputs · 4 outputs
Details

ID	`QRadar Indicator Hunting`
From Version	5.0.0
Tasks	77
Inputs

MD5 — MD5 hash file or an array of hashes to search.
QradarMD5Field — MD5 field to search in QRadar. If none are specified, the search will use a payload contains filter.
SHA1 — SHA1 hash file or an array of hashes to search.
QradarSHA1Field — SHA1 field to search in QRadar. If none are specified, the search will use a payload contains filter.
SHA256 — SHA256 hash file or an array of hashes to search.
QradarSHA256Field — SHA256 field to search in QRadar. If none are specified, the search will use a payload contains filter.
IPAddress — Source or destination IP to search. Can be a single address or an array of addresses.
QradarIPfield — IP field to search in QRadar. If none are specified, the search will use sourceip or destinationip (combined).
URLDomain — Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used.
URLDomainField — URL/Domain field to search in QRadar. If none are specified, the search will use a payload contains filter.
SelectFields — The fields to be used in the select. Use comma delimited field names as they appear in AQL. * is an acceptable value.
TimeFrame — Time frame as used in AQL Examples can be LAST 7 DAYS START '2019-09-25 15:51' STOP '2019-09-25 17:51' For more examples review IBM's AQL documentation.
InvestigationFields — The fields to be used for the hunting outputs. These fields are added to the selected field's input.
Outputs

QRadar.Search.Result — Qradar's search results.
QRadar.DetectedIPs — IP addresses detected based on sourceip and destinationip fields in your search.
QRadar.DetectedUsers — Users detected based on the username field in your search.
QRadar.DetectedHosts — Hosts detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar.
Commands used

qradar-get-assets
Flowchart

Source

playbook-QRadar_Indicator_Hunting.yml playbook-QRadar_Indicator_Hunting_V2.yml playbook-QRadar_Indicator_Hunting_V2_README.md
Download History Raw
id: QRadar Indicator Hunting V2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: QRadar Indicator Hunting V2
description: 'The Playbook queries QRadar SIEM for indicators such as file hashes, IP addresses, domains, or urls. '
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a2b99d88-69c8-4a87-8d60-74d21ca2db74
    type: start
    task:
      id: a2b99d88-69c8-4a87-8d60-74d21ca2db74
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "55"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1875,
          "y": -125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 30250b5a-c4ae-4477-8d7d-aa586c6a5c2f
    type: title
    task:
      id: 30250b5a-c4ae-4477-8d7d-aa586c6a5c2f
      version: -1
      name: Hash Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 842.5,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: b4ad1b02-a07b-4f3b-8949-2389d2c0c08e
    type: title
    task:
      id: b4ad1b02-a07b-4f3b-8949-2389d2c0c08e
      version: -1
      name: IP Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1875,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: b2482cd1-e6f4-45ab-84c4-0faf3d9e96ae
    type: title
    task:
      id: b2482cd1-e6f4-45ab-84c4-0faf3d9e96ae
      version: -1
      name: Domain/Url Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2775,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: b3700546-6a71-4c26-89dc-6ac3ffe0439a
    type: condition
    task:
      id: b3700546-6a71-4c26-89dc-6ac3ffe0439a
      version: -1
      name: Is there an IP to search?
      description: Is there an IP on which to search?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "166"
      "yes":
      - "50"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.IPAddress
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1875,
          "y": 490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 4ca411b2-9118-4c88-80ba-fd45cf7dc4d4
    type: condition
    task:
      id: 4ca411b2-9118-4c88-80ba-fd45cf7dc4d4
      version: -1
      name: Is there a hash to search?
      description: Is there a hash on which to search?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "166"
      "yes":
      - "26"
      - "27"
      - "38"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.MD5
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA1
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 842.5,
          "y": 475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 8a910c41-e636-4df8-873d-55961fd9f5ff
    type: condition
    task:
      id: 8a910c41-e636-4df8-873d-55961fd9f5ff
      version: -1
      name: Is there a domain or url to search?
      description: Is there a domain or URL on which to search?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "166"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.URLDomain
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2775,
          "y": 475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 2afade2a-c653-4db2-8fc2-7dc20abba4f6
    type: condition
    task:
      id: 2afade2a-c653-4db2-8fc2-7dc20abba4f6
      version: -1
      name: Is there a custom domain or url field?
      description: Is there a custom domain or url field?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "56"
      "yes":
      - "57"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.QradarURLDomainField
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2775,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 9dbc1709-6693-4705-8a81-90432e69bbc5
    type: condition
    task:
      id: 9dbc1709-6693-4705-8a81-90432e69bbc5
      version: -1
      name: Is there a custom MD5 field?
      description: Is there a custom MD5 field?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "64"
      "yes":
      - "65"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.QradarMD5Field
            iscontext: true
    view: |-
      {
        "position": {
          "x": -1385,
          "y": 950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 9719193a-aa81-4017-8fe3-9b9c54f7c510
    type: condition
    task:
      id: 9719193a-aa81-4017-8fe3-9b9c54f7c510
      version: -1
      name: Is there an MD5 to search?
      description: Is there an MD5 on which to search?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "166"
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": -1385,
          "y": 775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 37b3d830-4401-42fa-8c4a-ec9952bf39fd
    type: title
    task:
      id: 37b3d830-4401-42fa-8c4a-ec9952bf39fd
      version: -1
      name: MD5 Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1385,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 2f6a1090-e0b8-4485-8185-83165e489c33
    type: title
    task:
      id: 2f6a1090-e0b8-4485-8185-83165e489c33
      version: -1
      name: SHA1 Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "29"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -505,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: eab04f66-1e17-4945-8f72-a5cdda1bc308
    type: condition
    task:
      id: eab04f66-1e17-4945-8f72-a5cdda1bc308
      version: -1
      name: Is there a SHA1 to search?
      description: Is there a SHA1 hash on which to search?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "166"
      "yes":
      - "31"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA1
            iscontext: true
    view: |-
      {
        "position": {
          "x": -515,
          "y": 775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: d6eb18bc-0884-47a5-829b-d1ae0060d3bc
    type: condition
    task:
      id: d6eb18bc-0884-47a5-829b-d1ae0060d3bc
      version: -1
      name: Was there a custom SHA1 field?
      description: Was there a custom SHA1 field?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "62"
      "yes":
      - "63"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.QradarSHA1Field
            iscontext: true
    view: |-
      {
        "position": {
          "x": -505,
          "y": 940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 7a308843-7a82-4f8a-8273-bc8c81ac4d39
    type: title
    task:
      id: 7a308843-7a82-4f8a-8273-bc8c81ac4d39
      version: -1
      name: SHA256 Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 372.5,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: d4834696-2334-462e-8fbb-d978b9079097
    type: condition
    task:
      id: d4834696-2334-462e-8fbb-d978b9079097
      version: -1
      name: Is there a SHA256 to search?
      description: Is there a SHA256 hash on which to search?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "166"
      "yes":
      - "41"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 372.5,
          "y": 775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 9202b39d-89cd-4fde-83a5-4912e2a7913b
    type: condition
    task:
      id: 9202b39d-89cd-4fde-83a5-4912e2a7913b
      version: -1
      name: Is there a custom SHA256 field?
      description: Is there a custom SHA256 field?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "60"
      "yes":
      - "61"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.QradarSHA256Field
            iscontext: true
    view: |-
      {
        "position": {
          "x": 372.5,
          "y": 950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: e9557ca0-59b9-4011-85df-20107a011f2c
    type: condition
    task:
      id: e9557ca0-59b9-4011-85df-20107a011f2c
      version: -1
      name: Is there a custom IP field?
      description: Is there a custom IP field?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "59"
      "yes":
      - "58"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.QradarIPfield
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1575,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "55":
    id: "55"
    taskid: a9fa4f2d-8daf-456c-8d88-7c1c7eb830b4
    type: condition
    task:
      id: a9fa4f2d-8daf-456c-8d88-7c1c7eb830b4
      version: -1
      name: Is Qradar enabled?
      description: Is Qradar enabled?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "165"
      "yes":
      - "176"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar,QRadar_v2,QRadar v3
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1350,
          "y": 30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: caed8241-b8b1-4f34-8f29-2177fdb3e10f
    type: title
    task:
      id: caed8241-b8b1-4f34-8f29-2177fdb3e10f
      version: -1
      name: QRadar query without custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "102"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2570,
          "y": 845
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "57":
    id: "57"
    taskid: 148ec15e-e700-43d9-80a1-6867e0e697c4
    type: title
    task:
      id: 148ec15e-e700-43d9-80a1-6867e0e697c4
      version: -1
      name: QRadar query with custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "175"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3000,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "58":
    id: "58"
    taskid: b376ca7c-0ef3-4ce6-8188-27c49b3d14f3
    type: title
    task:
      id: b376ca7c-0ef3-4ce6-8188-27c49b3d14f3
      version: -1
      name: QRadar query with custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "172"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2100,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "59":
    id: "59"
    taskid: 352bb2ce-fe56-4415-805b-d15436205a16
    type: title
    task:
      id: 352bb2ce-fe56-4415-805b-d15436205a16
      version: -1
      name: QRadar query without custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "101"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "60":
    id: "60"
    taskid: 7c514669-525a-41e6-89b3-4b03683cd2cd
    type: title
    task:
      id: 7c514669-525a-41e6-89b3-4b03683cd2cd
      version: -1
      name: QRadar query without custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "100"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "61":
    id: "61"
    taskid: 3fb63155-a852-454d-8c8a-7e77db25eb7f
    type: title
    task:
      id: 3fb63155-a852-454d-8c8a-7e77db25eb7f
      version: -1
      name: QRadar query with custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "169"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 600,
          "y": 1125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "62":
    id: "62"
    taskid: 3aae3e82-5aad-4f67-83df-46ed41175b6d
    type: title
    task:
      id: 3aae3e82-5aad-4f67-83df-46ed41175b6d
      version: -1
      name: QRadar query without custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "99"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -710,
          "y": 1125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "63":
    id: "63"
    taskid: 289810bf-110b-4c31-8ebc-907f334ad50a
    type: title
    task:
      id: 289810bf-110b-4c31-8ebc-907f334ad50a
      version: -1
      name: QRadar query with custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "170"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -280,
          "y": 1125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "64":
    id: "64"
    taskid: ce8af6fc-bdde-4ba4-8df1-81430d419c3b
    type: title
    task:
      id: ce8af6fc-bdde-4ba4-8df1-81430d419c3b
      version: -1
      name: QRadar query without custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "98"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1590,
          "y": 1125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "65":
    id: "65"
    taskid: dc5b8a0d-79f6-4865-8e9c-3a2638bbd6c7
    type: title
    task:
      id: dc5b8a0d-79f6-4865-8e9c-3a2638bbd6c7
      version: -1
      name: QRadar query with custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "181"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1160,
          "y": 1125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "98":
    id: "98"
    taskid: dff6c803-c9df-4549-89ce-8713862e29fe
    type: regular
    task:
      id: dff6c803-c9df-4549-89ce-8713862e29fe
      version: -1
      name: Set MD5 to an array
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "173"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FileMD5
      value:
        complex:
          root: inputs.MD5
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1590,
          "y": 1290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "99":
    id: "99"
    taskid: e5f785bb-75ea-4ff2-87e2-7ed44fdcf134
    type: regular
    task:
      id: e5f785bb-75ea-4ff2-87e2-7ed44fdcf134
      version: -1
      name: Set SHA1 to an array
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "171"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FileSHA1
      value:
        complex:
          root: inputs.SHA1
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -710,
          "y": 1290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "100":
    id: "100"
    taskid: 6cc731ba-436e-4959-887e-973dffd05aa4
    type: regular
    task:
      id: 6cc731ba-436e-4959-887e-973dffd05aa4
      version: -1
      name: Set SHA256 to an array
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "168"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FileSHA256
      value:
        complex:
          root: inputs.SHA256
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "101":
    id: "101"
    taskid: 9699d2e9-2d1f-48ba-85fc-144e59bcf3a1
    type: regular
    task:
      id: 9699d2e9-2d1f-48ba-85fc-144e59bcf3a1
      version: -1
      name: Set IP to an array
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "167"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: IPAddress
      value:
        complex:
          root: inputs.IPAddress
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 1000
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "102":
    id: "102"
    taskid: 2e9bf4dc-56ce-4125-86b0-66f99fdf4651
    type: regular
    task:
      id: 2e9bf4dc-56ce-4125-86b0-66f99fdf4651
      version: -1
      name: Set Domain or URL to the array
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "174"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: DomainURL
      value:
        complex:
          root: inputs.URLDomain
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2570,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "120":
    id: "120"
    taskid: f1aaa2dc-6ab1-408e-8851-d73171be6244
    type: title
    task:
      id: f1aaa2dc-6ab1-408e-8851-d73171be6244
      version: -1
      name: Sort internal and external IP addresses
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "124"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1875,
          "y": 2640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "123":
    id: "123"
    taskid: 777b2d48-c9f0-433d-8de3-7b015ba4c472
    type: regular
    task:
      id: 777b2d48-c9f0-433d-8de3-7b015ba4c472
      version: -1
      name: Set detected IP addresses as external
      description: Checks if the specified value exists in context. If the value exists, it will be set in context, otherwise no value will be set it context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "165"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: QRadar.DetectedExternalIPs
      value:
        complex:
          root: IP
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: IP.InRange
                iscontext: true
              right:
                value:
                  simple: "no"
          accessor: Address
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2080,
          "y": 3280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "124":
    id: "124"
    taskid: 62deb054-e2c8-4fc9-88c5-ecc24d8fd88f
    type: condition
    task:
      id: 62deb054-e2c8-4fc9-88c5-ecc24d8fd88f
      version: -1
      name: Are there detected IP addresses?
      description: Are there detected IP addresses?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "165"
      "yes":
      - "142"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: QRadar.DetectedIPs
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1875,
          "y": 2775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "142":
    id: "142"
    taskid: 1b6be11a-d587-4ef8-8784-8541d2761d85
    type: regular
    task:
      id: 1b6be11a-d587-4ef8-8784-8541d2761d85
      version: -1
      name: Determine whether the IP address is internal or external
      description: Returns yes if the IP is in one of the ranges provided, returns no otherwise.
      scriptName: IsIPInRanges
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "143"
    scriptarguments:
      ip:
        simple: ${QRadar.DetectedIPs}
      ipRanges:
        simple: ${inputs.InternalRange}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2080,
          "y": 2950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "143":
    id: "143"
    taskid: 61ca426a-bbab-45f5-8594-a0cadbd399b7
    type: regular
    task:
      id: 61ca426a-bbab-45f5-8594-a0cadbd399b7
      version: -1
      name: Set detected IP addresses as internal
      description: Checks if the specified value exists in context. If the value exists, it will be set in context, otherwise no value will be set it context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "123"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: QRadar.DetectedInternalIPs
      value:
        complex:
          root: IP
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: IP.InRange
                iscontext: true
              right:
                value:
                  simple: "yes"
          accessor: Address
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2080,
          "y": 3115
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "161":
    id: "161"
    taskid: f7b5c63c-7cbb-4907-8317-2dd39f6ed397
    type: regular
    task:
      id: f7b5c63c-7cbb-4907-8317-2dd39f6ed397
      version: -1
      name: Set detected usernames
      description: Sets a value into the context with the given context key
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "162"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: QRadar.DetectedUsers
      value:
        complex:
          root: ${
          accessor: =[]}
          transformers:
          - operator: GetValuesOfMultipleFields
            args:
              key:
                value:
                  simple: QRadar.SearchEvents.Events
                iscontext: true
              list:
                value:
                  simple: inputs.InvestigationUserFields
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2305,
          "y": 2110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "162":
    id: "162"
    taskid: 1a600002-c821-46b1-82ac-d8b5ece75e26
    type: regular
    task:
      id: 1a600002-c821-46b1-82ac-d8b5ece75e26
      version: -1
      name: Get hostnames from assets
      description: Retrieves assets list.
      script: '|||qradar-assets-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "163"
    scriptarguments:
      filter:
        complex:
          root: QRadar
          accessor: DetectedIPs
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: interfaces contains ip_addresses contains value= "
              suffix:
                value:
                  simple: '"'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
    separatecontext: false
    continueonerror: true
    view: |-
      {
        "position": {
          "x": 2305,
          "y": 2290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "163":
    id: "163"
    taskid: 7b5105b2-a7fe-4909-8226-8afb3bbcdee4
    type: regular
    task:
      id: 7b5105b2-a7fe-4909-8226-8afb3bbcdee4
      version: -1
      name: Set detected hostnames from assets
      description: Sets a value into the context with the given context key
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "120"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: QRadar.DetectedInternalHosts
      value:
        complex:
          root: QRadar.Asset.Name
          accessor: Value
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2305,
          "y": 2460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "165":
    id: "165"
    taskid: b35aeb4f-d9f1-41f6-850a-a4b482a2bb8c
    type: title
    task:
      id: b35aeb4f-d9f1-41f6-850a-a4b482a2bb8c
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1875,
          "y": 3455
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "166":
    id: "166"
    taskid: 5590f9d8-8ff3-4775-8bd0-16d911adb755
    type: title
    task:
      id: 5590f9d8-8ff3-4775-8bd0-16d911adb755
      version: -1
      name: Set detecetd Values
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "178"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1875,
          "y": 1640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "167":
    id: "167"
    taskid: 483eaadc-4742-47fa-8f9e-f39f02c8eefd
    type: regular
    task:
      id: 483eaadc-4742-47fa-8f9e-f39f02c8eefd
      version: -1
      name: |
        QRadar Full Search on IP
      description: Polling command to search for events of a specific offense.
      script: '|||qradar-search-retrieve-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "166"
    scriptarguments:
      interval_in_seconds:
        simple: "1"
      polling:
        simple: "true"
      query_expression:
        complex:
          root: IPAddress
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: UTF8(payload) ILIKE  '%$1%'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationIPFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationUserFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: DATEFORMAT(devicetime,'dd-MM-yyyy hh:mm'),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid),
              suffix: {}
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 1175
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "168":
    id: "168"
    taskid: 97d66679-4345-44cc-8e45-7682f562c85b
    type: regular
    task:
      id: 97d66679-4345-44cc-8e45-7682f562c85b
      version: -1
      name: QRadar Full Search on SHA256
      description: Polling command to search for events of a specific offense.
      script: '|||qradar-search-retrieve-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "166"
    scriptarguments:
      interval_in_seconds:
        simple: "1"
      polling:
        simple: "true"
      query_expression:
        complex:
          root: FileSHA256
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: UTF8(payload) ILIKE  '%$1%'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationIPFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationUserFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: DATEFORMAT(devicetime,'dd-MM-yyyy hh:mm'),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid),
              suffix: {}
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1445
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "169":
    id: "169"
    taskid: c6fc16a8-fb56-46d7-8053-384a433b5771
    type: regular
    task:
      id: c6fc16a8-fb56-46d7-8053-384a433b5771
      version: -1
      name: QRadar Full Search on SHA256
      description: Polling command to search for events of a specific offense.
      script: '|||qradar-search-retrieve-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "166"
    scriptarguments:
      interval_in_seconds:
        simple: "1"
      polling:
        simple: "true"
      query_expression:
        complex:
          root: inputs.QradarSHA256Field
          transformers:
          - operator: ProductJoin
            args:
              join:
                value:
                  simple: "="
              list2:
                value:
                  simple: inputs.SHA256
                iscontext: true
          - operator: join
            args:
              separator:
                value:
                  simple: ''' OR "'
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: "="
              replaceWith:
                value:
                  simple: '" = '''
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where "'
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationUserFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationIPFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ''' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 600,
          "y": 1445
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "170":
    id: "170"
    taskid: 6621a3dc-3b43-471a-8294-1e1fb8238276
    type: regular
    task:
      id: 6621a3dc-3b43-471a-8294-1e1fb8238276
      version: -1
      name: QRadar Full Search on SHA1
      description: Polling command to search for events of a specific offense.
      script: '|||qradar-search-retrieve-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "166"
    scriptarguments:
      interval_in_seconds:
        simple: "1"
      polling:
        simple: "true"
      query_expression:
        complex:
          root: inputs.QradarSHA1Field
          transformers:
          - operator: ProductJoin
            args:
              join:
                value:
                  simple: "="
              list2:
                value:
                  simple: inputs.SHA1
                iscontext: true
          - operator: join
            args:
              separator:
                value:
                  simple: ''' OR "'
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: "="
              replaceWith:
                value:
                  simple: '" = '''
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where "'
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationUserFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationIPFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ''' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -280,
          "y": 1465
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "171":
    id: "171"
    taskid: b9df3e96-97ba-453d-8070-dfb8338c6ee9
    type: regular
    task:
      id: b9df3e96-97ba-453d-8070-dfb8338c6ee9
      version: -1
      name: QRadar Full Search on SHA1
      description: Polling command to search for events of a specific offense.
      script: '|||qradar-search-retrieve-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "166"
    scriptarguments:
      interval_in_seconds:
        simple: "1"
      polling:
        simple: "true"
      query_expression:
        complex:
          root: FileSHA1
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: UTF8(payload) ILIKE  '%$1%'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationIPFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationUserFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: DATEFORMAT(devicetime,'dd-MM-yyyy hh:mm'),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid),
              suffix: {}
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -710,
          "y": 1465
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "172":
    id: "172"
    taskid: 1260ad7c-2e3f-4cb1-8137-cfd4d023d16d
    type: regular
    task:
      id: 1260ad7c-2e3f-4cb1-8137-cfd4d023d16d
      version: -1
      name: QRadar Full Search on IP
      description: Polling command to search for events of a specific offense.
      script: '|||qradar-search-retrieve-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "166"
    scriptarguments:
      interval_in_seconds:
        simple: "1"
      polling:
        simple: "true"
      query_expression:
        complex:
          root: inputs.QradarIPfield
          transformers:
          - operator: ProductJoin
            args:
              join:
                value:
                  simple: "="
              list2:
                value:
                  simple: inputs.IPAddress
                iscontext: true
          - operator: join
            args:
              separator:
                value:
                  simple: ''' OR "'
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: "="
              replaceWith:
                value:
                  simple: '" = '''
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where "'
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationUserFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationIPFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ''' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2100,
          "y": 1175
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "173":
    id: "173"
    taskid: e4a747c0-ca2e-4a51-859d-e33a002a979b
    type: regular
    task:
      id: e4a747c0-ca2e-4a51-859d-e33a002a979b
      version: -1
      name: Qradar Full Search on MD5
      description: Polling command to search for events of a specific offense.
      script: '|||qradar-search-retrieve-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "166"
    scriptarguments:
      interval_in_seconds:
        simple: "1"
      polling:
        simple: "true"
      query_expression:
        complex:
          root: FileMD5
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: UTF8(payload) ILIKE  '%$1%'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationIPFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationUserFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: DATEFORMAT(devicetime,'dd-MM-yyyy hh:mm'),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid),
              suffix: {}
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1590,
          "y": 1465
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "174":
    id: "174"
    taskid: a468e334-bc35-4395-88d0-55cec984dc60
    type: regular
    task:
      id: a468e334-bc35-4395-88d0-55cec984dc60
      version: -1
      name: QRadar Full Search on Domain/URL
      description: Polling command to search for events of a specific offense.
      script: '|||qradar-search-retrieve-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "166"
    scriptarguments:
      interval_in_seconds:
        simple: "1"
      polling:
        simple: "true"
      query_expression:
        complex:
          root: DomainURL
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: UTF8(payload) ILIKE  '%$1%'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationIPFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationUserFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) '
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2570,
          "y": 1165
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "175":
    id: "175"
    taskid: d2f85e1c-d849-42a9-8783-e3afbea7c91b
    type: regular
    task:
      id: d2f85e1c-d849-42a9-8783-e3afbea7c91b
      version: -1
      name: QRadar Full Search on Domain/URL
      description: Polling command to search for events of a specific offense.
      script: '|||qradar-search-retrieve-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "166"
    scriptarguments:
      interval_in_seconds:
        simple: "1"
      polling:
        simple: "true"
      query_expression:
        complex:
          root: inputs.QradarURLDomainField
          transformers:
          - operator: ProductJoin
            args:
              join:
                value:
                  simple: ILIKE
              list2:
                value:
                  simple: inputs.URLDomain
                iscontext: true
          - operator: join
            args:
              separator:
                value:
                  simple: '%'' OR "'
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: ILIKE
              replaceWith:
                value:
                  simple: '" ILIKE ''%'
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where "'
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationIPFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationUserFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix: {}
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: '%'' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3000,
          "y": 1175
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "176":
    id: "176"
    taskid: 82ef281a-644a-4657-8453-50ca8ce25bdd
    type: title
    task:
      id: 82ef281a-644a-4657-8453-50ca8ce25bdd
      version: -1
      name: Indicator Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
      - "5"
      - "6"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1875,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "178":
    id: "178"
    taskid: 116782ab-603b-493c-8079-e003e251ab6c
    type: condition
    task:
      id: 116782ab-603b-493c-8079-e003e251ab6c
      version: -1
      name: Has query results?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "120"
      "yes":
      - "182"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: QRadar.SearchEvents
                accessor: Events
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1875,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "181":
    id: "181"
    taskid: b4328ddc-50db-4488-8444-48fcac80a903
    type: regular
    task:
      id: b4328ddc-50db-4488-8444-48fcac80a903
      version: -1
      name: QRadar Full Search on MD5
      description: Polling command to search for events of a specific offense.
      script: '|||qradar-search-retrieve-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "166"
    scriptarguments:
      interval_in_seconds:
        simple: "1"
      polling:
        simple: "true"
      query_expression:
        complex:
          root: inputs.QradarMD5Field
          transformers:
          - operator: ProductJoin
            args:
              join:
                value:
                  simple: "="
              list2:
                value:
                  simple: inputs.MD5
                iscontext: true
          - operator: join
            args:
              separator:
                value:
                  simple: ''' OR "'
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: "="
              replaceWith:
                value:
                  simple: '" = '''
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where "'
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationUserFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationIPFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ''' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1160,
          "y": 1465
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "182":
    id: "182"
    taskid: 5414f421-9773-4d5b-83da-d723d429bfdb
    type: regular
    task:
      id: 5414f421-9773-4d5b-83da-d723d429bfdb
      version: -1
      name: Set detected source and destination IP addresses
      description: Sets a value into the context with the given context key
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "161"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: QRadar.DetectedIPs
      value:
        complex:
          root: ${
          accessor: =[]}
          transformers:
          - operator: GetValuesOfMultipleFields
            args:
              key:
                value:
                  simple: QRadar.SearchEvents.Events
                iscontext: true
              list:
                value:
                  simple: inputs.InvestigationIPFields
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2305,
          "y": 1950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "11_56_#default#": 0.61,
      "124_165_#default#": 0.65,
      "22_166_#default#": 0.1,
      "29_166_#default#": 0.12,
      "39_166_#default#": 0.19,
      "55_176_yes": 0.44,
      "8_166_#default#": 0.1,
      "8_26_yes": 0.73,
      "9_166_#default#": 0.25
    },
    "paper": {
      "dimensions": {
        "height": 3645,
        "width": 4970,
        "x": -1590,
        "y": -125
      }
    }
  }
inputs:
- key: MD5
  value: {}
  required: false
  description: MD5 hash file or an array of hashes to search.
  playbookInputQuery:
- key: QradarMD5Field
  value: {}
  required: false
  description: MD5 field to search in QRadar. If none are specified, the search will use a payload contains filter.
  playbookInputQuery:
- key: SHA1
  value: {}
  required: false
  description: SHA1 hash file or an array of hashes to search.
  playbookInputQuery:
- key: QradarSHA1Field
  value: {}
  required: false
  description: SHA1 field to search in QRadar. If none are specified, the search will use a payload contains filter.
  playbookInputQuery:
- key: SHA256
  value: {}
  required: false
  description: SHA256 hash file or an array of hashes to search.
  playbookInputQuery:
- key: QradarSHA256Field
  value: {}
  required: false
  description: SHA256 field to search in QRadar. If none are specified, the search will use a payload contains filter.
  playbookInputQuery:
- key: IPAddress
  value: {}
  required: false
  description: |
    Source or destination IP to search. Can be a single address or an array of addresses.
  playbookInputQuery:
- key: QradarIPfield
  value:
    simple: sourceip,destinationip
  required: false
  description: IP field to search in QRadar. If none are specified, the search will use sourceip or destinationip (combined).
  playbookInputQuery:
- key: URLDomain
  value: {}
  required: false
  description: |
    Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used.
  playbookInputQuery:
- key: QradarURLDomainField
  value: {}
  required: false
  description: 'URL/Domain field to search in QRadar. If none are specified, the search will use a payload contains filter. '
  playbookInputQuery:
- key: TimeFrame
  value:
    simple: LAST 7 DAYS
  required: false
  description: |-
    Time frame as used in AQL
    Examples can be
    LAST 7 DAYS
    START '2019-09-25 15:51' STOP '2019-09-25 17:51'
    For more examples review IBM's AQL documentation.
  playbookInputQuery:
- key: InternalRange
  value:
    complex:
      root: lists
      accessor: PrivateIPs
      transformers:
      - operator: RegexExtractAll
        args:
          error_if_no_match: {}
          ignore_case: {}
          multi_line: {}
          period_matches_newline: {}
          regex:
            value:
              simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2})
          unpack_matches: {}
      - operator: join
        args:
          separator:
            value:
              simple: ','
  required: false
  description: 'A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).'
  playbookInputQuery:
- key: InvestigationIPFields
  value:
    simple: sourceip,destinationip
  required: true
  description: The values of these QRadar fields will be used for the playbook IP addresses outputs.
  playbookInputQuery:
- key: InvestigationUserFields
  value:
    simple: username
  required: true
  description: The values of these QRadar fields will be used for the playbook user name outputs.
  playbookInputQuery:
outputs:
- contextPath: QRadar.DetectedUsers
  description: Users detected based on the username field in your search.
  type: string
- contextPath: QRadar.DetectedInternalIPs
  description: Internal IP addresses detected based on fields and inputs in your search.
  type: string
- contextPath: QRadar.DetectedExternalIPs
  description: External IP addresses detected based on fields and inputs in your search.
  type: string
- contextPath: QRadar.DetectedInternalHosts
  description: Internal host names detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar.
  type: string
- contextPath: QRadar.DetectedExternalHosts
  description: External host names detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar.
  type: string
tests:
- test_Qradar_v2
- QRadar_v3-test
- QRadar Indicator Hunting Test
fromversion: 5.0.0
supportedModules:
- agentix
- xsiam
- edr
- cloud
- cloud_runtime_security