QRadar Indicator Hunting Deprecated

Deprecated. Use the "QRadar Indicator Hunting V2" playbook instead.

IBM QRadar · 77 tasks · 13 inputs · 4 outputs

Details

IDQRadar Indicator Hunting
From Version5.0.0
Tasks77

Inputs

  • MD5 — MD5 hash file or an array of hashes to search.
  • QradarMD5Field — MD5 field to search in QRadar. If none are specified, the search will use a payload contains filter.
  • SHA1 — SHA1 hash file or an array of hashes to search.
  • QradarSHA1Field — SHA1 field to search in QRadar. If none are specified, the search will use a payload contains filter.
  • SHA256 — SHA256 hash file or an array of hashes to search.
  • QradarSHA256Field — SHA256 field to search in QRadar. If none are specified, the search will use a payload contains filter.
  • IPAddress — Source or destination IP to search. Can be a single address or an array of addresses.
  • QradarIPfield — IP field to search in QRadar. If none are specified, the search will use sourceip or destinationip (combined).
  • URLDomain — Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used.
  • URLDomainField — URL/Domain field to search in QRadar. If none are specified, the search will use a payload contains filter.
  • SelectFields — The fields to be used in the select. Use comma delimited field names as they appear in AQL. * is an acceptable value.
  • TimeFrame — Time frame as used in AQL Examples can be LAST 7 DAYS START '2019-09-25 15:51' STOP '2019-09-25 17:51' For more examples review IBM's AQL documentation.
  • InvestigationFields — The fields to be used for the hunting outputs. These fields are added to the selected field's input.

Outputs

  • QRadar.Search.Result — Qradar's search results.
  • QRadar.DetectedIPs — IP addresses detected based on sourceip and destinationip fields in your search.
  • QRadar.DetectedUsers — Users detected based on the username field in your search.
  • QRadar.DetectedHosts — Hosts detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar.

Commands used

qradar-get-assets

Flowchart

yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes Start Start Hash Search Hash Search QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch IP Search IP Search Domain/Url Search Domain/Url Search Is there an IP to search? Is there an IP to search? Is there a hash to search? Is there a hash to search? Is there a domain or url to search? Is there a domain or url ... Domain/Url hunting done Domain/Url hunting done Is there a custom domain or url field? Is there a custom domain ... Set DomainUrl to array - Set Set DomainUrl to array Set Set DomainUrlFields to Array - Set Set DomainUrlFields to Array Set QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch Set MD5 to array - Set Set MD5 to array Set Is there a custom MD5 field? Is there a custom MD5 field? Is there an MD5 to search? Is there an MD5 to search? QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch Hash hunting done Hash hunting done MD5 Search MD5 Search SHA1 Search SHA1 Search Is there a SHA1 to search? Is there a SHA1 to search? Set SHA1 to array - Set Set SHA1 to array Set Was there a custom SHA1 field? Was there a custom SHA1 f... QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch Set MD5Fields to Array - Set Set MD5Fields to Array Set QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch SHA256 Search SHA256 Search Is there a SHA256 to search? Is there a SHA256 to search? Set SHA256 to array - Set Set SHA256 to array Set Is there a custom SHA256 field? Is there a custom SHA256 ... Set SHA1Fields to Array - Set Set SHA1Fields to Array Set Set SHA256Fields to Array - Set Set SHA256Fields to Array Set QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch IP hunting done IP hunting done Set IP to array - Set Set IP to array Set Is there a custom IP field? Is there a custom IP field? Set IPFields to Array - Set Set IPFields to Array Set QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch Is Qradar enabled? Is Qradar enabled? QRadar query without custom fields QRadar query without cust... QRadar query with custom fields QRadar query with custom ... QRadar query with custom fields QRadar query with custom ... QRadar query without custom fields QRadar query without cust... QRadar query without custom fields QRadar query without cust... QRadar query with custom fields QRadar query with custom ... QRadar query without custom fields QRadar query without cust... QRadar query with custom fields QRadar query with custom ... QRadar query without custom fields QRadar query without cust... QRadar query with custom fields QRadar query with custom ... Set detected IP addresses - Set Set detected IP addresses Set Set detected usernames - Set Set detected usernames Set Get hostnames from assets - qradar-get-assets Get hostnames from assets qradar-get-assets Set detected hostnames from assets - Set Set detected hostnames fr... Set Set detected IP addresses - Set Set detected IP addresses Set Set detected usernames - Set Set detected usernames Set Get hostnames from assets - qradar-get-assets Get hostnames from assets qradar-get-assets Set detected hostnames from assets - Set Set detected hostnames fr... Set Set detected usernames - Set Set detected usernames Set Get hostnames from assets - qradar-get-assets Get hostnames from assets qradar-get-assets Set detected hostnames from assets - Set Set detected hostnames fr... Set Set detected IP addresses - Set Set detected IP addresses Set Set detected usernames - Set Set detected usernames Set Get hostnames from assets - qradar-get-assets Get hostnames from assets qradar-get-assets Set detected hostnames from assets - Set Set detected hostnames fr... Set Set detected IP addresses - Set Set detected IP addresses Set Set detected usernames - Set Set detected usernames Set Get hostnames from assets - qradar-get-assets Get hostnames from assets qradar-get-assets Set detected hostnames from assets - Set Set detected hostnames fr... Set Set detected IP addresses - Set Set detected IP addresses Set Is ip detected by QRadar? Is ip detected by QRadar? Is domain or url detected by QRadar? Is domain or url detected... Is SHA256 file hash detected by QRadar? Is SHA256 file hash detec... Is SHA1 file hash detected by QRadar? Is SHA1 file hash detecte... Is Md5 file hash detected by QRadar? Is Md5 file hash detected...

Source

playbook-QRadar_Indicator_Hunting.yml playbook-QRadar_Indicator_Hunting_V2.yml playbook-QRadar_Indicator_Hunting_V2_README.md
Download History Raw 
The Playbook queries QRadar SIEM for indicators such as file hashes, IP addresses, domains, or urls. 

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

This playbook does not use any sub-playbooks.

### Integrations

* QRadar_v3

### Scripts

* IsIPInRanges
* Set
* SetAndHandleEmpty

### Commands

* qradar-assets-list
* qradar-search-retrieve-events

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| MD5 | MD5 hash file or an array of hashes to search. |  | Optional |
| QradarMD5Field | MD5 field to search in QRadar. If none are specified, the search will use a payload contains filter. |  | Optional |
| SHA1 | SHA1 hash file or an array of hashes to search. |  | Optional |
| QradarSHA1Field | SHA1 field to search in QRadar. If none are specified, the search will use a payload contains filter. |  | Optional |
| SHA256 | SHA256 hash file or an array of hashes to search. |  | Optional |
| QradarSHA256Field | SHA256 field to search in QRadar. If none are specified, the search will use a payload contains filter. |  | Optional |
| IPAddress | Source or destination IP to search. Can be a single address or an array of addresses.<br/> |  | Optional |
| QradarIPfield | IP field to search in QRadar. If none are specified, the search will use sourceip or destinationip \(combined\). | sourceip,destinationip | Optional |
| URLDomain | Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used.<br/> |  | Optional |
| QradarURLDomainField | URL/Domain field to search in QRadar. If none are specified, the search will use a payload contains filter.  |  | Optional |
| TimeFrame | Time frame as used in AQL<br/>Examples can be<br/>LAST 7 DAYS<br/>START '2019-09-25 15:51' STOP '2019-09-25 17:51'<br/>For more examples review IBM's AQL documentation. | LAST 7 DAYS | Optional |
| InternalRange | A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" \(without quotes\). | lists.PrivateIPs | Optional |
| InvestigationIPFields | The values of these QRadar fields will be used for the playbook IP addresses outputs. | sourceip,destinationip | Required |
| InvestigationUserFields | The values of these QRadar fields will be used for the playbook user name outputs. | username | Required |

## Playbook Outputs

---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| QRadar.DetectedUsers | Users detected based on the username field in your search. | string |
| QRadar.DetectedInternalIPs | Internal IP addresses detected based on fields and inputs in your search. | string |
| QRadar.DetectedExternalIPs | External IP addresses detected based on fields and inputs in your search. | string |
| QRadar.DetectedInternalHosts | Internal host names detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar. | string |
| QRadar.DetectedExternalHosts | External host names detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar. | string |

## Playbook Image

---

![QRadar Indicator Hunting V2](../doc_files/QRadar_Indicator_Hunting_V2.png)