Rapid7 InsightIDR - File Indicators Hunting

This playbook queries Rapid7 InsightIDR SIEM for file indicators, including MD5 hashes, SHA256 hashes, SHA1 hashes, file names, file types, and file paths. Note that multiple search values should be separated by commas only (without spaces or any special characters).

Rapid7 InsightIDR · 34 tasks · 18 inputs · 1 output

Details

ID	`Rapid7 InsightIDR - File Indicators Hunting`
From Version	6.5.0
Tasks	34

README

This playbook queries Rapid7 InsightIDR SIEM for file indicators, including MD5 hashes, SHA256 hashes, SHA1 hashes, file names, file types, and file paths.

Note that multiple search values should be separated by commas only (without spaces or any special characters).

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Rapid7 InsightIDR

Scripts

IsIntegrationAvailable
LoadJSON
SetAndHandleEmpty

Commands

rapid7-insight-idr-query-log-set

Playbook Inputs

Name	Description	Required
FileType	A single or multiple file types to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).	Optional
InsightIDRFileTypeField	The name of the fields, in Rapid7 InsightIDR, in which to find the file types.	Optional
FileName	A single or multiple file names to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).	Optional
InsightIDRFileNameField	The name of the fields, in Rapid7 InsightIDR, in which to find the file names.	Optional
MD5	A single or multiple MD5 file hashes to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).	Optional
InsightIDRMD5Field	The name of the fields, in Rapid7 InsightIDR, in which to find the MD5 hashes.	Optional
SHA256	A single or multiple SHA256 file hashes to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).	Optional
InsightIDRSHA256Field	The name of the fields, in Rapid7 InsightIDR, in which to find the SHA256 hashes.	Optional
SHA1	A single or multiple SHA1 file hashes to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).	Optional
InsightIDRSHA1Field	The name of the fields, in Rapid7 InsightIDR, in which to find the SHA1 hashes.	Optional
FilePath	A single or multiple file paths to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).	Optional
InsightIDRFilePathField	The name of the fields, in Rapid7 InsightIDR, in which to find the file paths.	Optional
LogSetId	An identifier for a Rapid7 InsightIDR log set to query.	Required
time_range	Specify the timeframe in which the Rapid7 InsightIDR logs will be searched. Most start with ‘last’ (e.g., last 2 months, last 10 minutes). The ‘start_time’ and ‘end_time’ inputs should not be used if the time_range input is specified. Supported time units (case insensitive): min(s) or minute(s) hr(s) or hour(s) day(s) week(s) month(s) year(s)	Optional
logs_per_page	Specify the maximum number of log entries to return per page, up to 500 (the maximum allowed). By default, 50 is set.	Optional
sequence_number	The earliest sequence number of a log entry to start searching. If this query parameter is included, the query results will additionally include all log entries received in the ‘start_time’ millisecond which have sequence numbers larger than the one specified. Sequence numbers are identifiers used to distinguish between log entries received in the same millisecond. If a log entry was split up into several log entries during ingestion, then those chunks are ordered by sequence number.	Optional
start_time	Specify the query start time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds. For example, if you wish to begin searching 1 week ago, the UNIX timestamp value is 604800.	Optional
end_time	Specify the query end time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds. For example, to end searching a day ago, the UNIX timestamp value would be 86400.	Optional

Playbook Outputs

Path	Description	Type
Rapid7InsightIDR.HuntingResults	Events log objects containing relevant fields.	string

Playbook Image

Rapid7 InsightIDR - File Indicators Hunting

Inputs

FileType — A single or multiple file types to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
InsightIDRFileTypeField — The name of the fields, in Rapid7 InsightIDR, in which to find the file types.
FileName — A single or multiple file names to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
InsightIDRFileNameField — The name of the fields, in Rapid7 InsightIDR, in which to find the file names.
MD5 — A single or multiple MD5 file hashes to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
InsightIDRMD5Field — The name of the fields, in Rapid7 InsightIDR, in which to find the MD5 hashes.
SHA256 — A single or multiple SHA256 file hashes to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
InsightIDRSHA256Field — The name of the fields, in Rapid7 InsightIDR, in which to find the SHA256 hashes.
SHA1 — A single or multiple SHA1 file hashes to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
InsightIDRSHA1Field — The name of the fields, in Rapid7 InsightIDR, in which to find the SHA1 hashes.
FilePath — A single or multiple file paths to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
InsightIDRFilePathField — The name of the fields, in Rapid7 InsightIDR, in which to find the file paths.
LogSetId — An identifier for a Rapid7 InsightIDR log set to query.
time_range — Specify the timeframe in which the Rapid7 InsightIDR logs will be searched. Most start with 'last' (e.g., last 2 months, last 10 minutes). The 'start_time' and 'end_time' inputs should not be used if the time_range input is specified. Supported time units (case insensitive): min(s) or minute(s) hr(s) or hour(s) day(s) week(s) month(s) year(s)
logs_per_page — Specify the maximum number of log entries to return per page, up to 500 (the maximum allowed). By default, 50 is set.
sequence_number — The earliest sequence number of a log entry to start searching. If this query parameter is included, the query results will additionally include all log entries received in the 'start_time' millisecond which have sequence numbers larger than the one specified. Sequence numbers are identifiers used to distinguish between log entries received in the same millisecond. If a log entry was split up into several log entries during ingestion, then those chunks are ordered by sequence number.
start_time — Specify the query start time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds. For example, if you wish to begin searching 1 week ago, the UNIX timestamp value is 604800.
end_time — Specify the query end time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds. For example, to end searching a day ago, the UNIX timestamp value would be 86400.

Outputs

Rapid7InsightIDR.HuntingResults — Events log objects containing relevant fields.

Commands used

rapid7-insight-idr-query-log-set

Flowchart

Source

playbook-Rapid7_InsightIDR_-_File_Indicators_Hunting.yml

Download History Raw

id: Rapid7 InsightIDR - File Indicators Hunting
version: -1
name: Rapid7 InsightIDR - File Indicators Hunting
description: |-
  This playbook queries Rapid7 InsightIDR SIEM for file indicators, including MD5 hashes, SHA256 hashes, SHA1 hashes, file names, file types, and file paths.

  Note that multiple search values should be separated by commas only (without spaces or any special characters).
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a52d8420-7a8c-4987-866d-15dd05511bae
    type: start
    task:
      id: a52d8420-7a8c-4987-866d-15dd05511bae
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "56"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4860,
          "y": -1170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 78f8e5c7-6fc4-4f94-839c-d32b7a4c7e12
    type: title
    task:
      id: 78f8e5c7-6fc4-4f94-839c-d32b7a4c7e12
      version: -1
      name: File Type Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "138"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2960,
          "y": -870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 17350a20-1b2a-4a63-897b-ba6ceec0a3ed
    type: title
    task:
      id: 17350a20-1b2a-4a63-897b-ba6ceec0a3ed
      version: -1
      name: File Name Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "137"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2540,
          "y": -870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: ec8e5a6e-ede9-4c5c-8666-4a971e12e025
    type: title
    task:
      id: ec8e5a6e-ede9-4c5c-8666-4a971e12e025
      version: -1
      name: MD5 Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "142"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4630,
          "y": -870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: e2471789-ff8c-4729-8e11-4500f5f0f3b7
    type: regular
    task:
      id: e2471789-ff8c-4729-8e11-4500f5f0f3b7
      version: -1
      name: Rapid7 InsightIDR query - file name
      description: Queries within a log set for certain values.
      script: Rapid7 InsightIDR|||rapid7-insight-idr-query-log-set
      type: regular
      iscommand: true
      brand: Rapid7 InsightIDR
    nexttasks:
      '#none#':
      - "121"
    scriptarguments:
      end_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: end_time
      log_set_id:
        complex:
          root: inputs.LogSetId
      logs_per_page:
        complex:
          root: inputs.logs_per_page
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
          - - operator: lessThanOrEqual
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
              right:
                value:
                  simple: "500"
      query:
        simple: where(${inputs.InsightIDRFileNameField} CONTAINS-ANY [${FileNameParsed}])
      sequence_number:
        complex:
          root: inputs.sequence_number
      start_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: start_time
      time_range:
        complex:
          root: inputs.time_range
          filters:
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2540,
          "y": -370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 2c86b368-e7ae-4a07-8dc0-45a948dd8dff
    type: regular
    task:
      id: 2c86b368-e7ae-4a07-8dc0-45a948dd8dff
      version: -1
      name: Rapid7 InsightIDR query - file type
      description: Queries within a log set for certain values.
      script: Rapid7 InsightIDR|||rapid7-insight-idr-query-log-set
      type: regular
      iscommand: true
      brand: Rapid7 InsightIDR
    nexttasks:
      '#none#':
      - "122"
    scriptarguments:
      end_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: end_time
      log_set_id:
        complex:
          root: inputs.LogSetId
      logs_per_page:
        complex:
          root: inputs.logs_per_page
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
          - - operator: lessThanOrEqual
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
              right:
                value:
                  simple: "500"
      query:
        simple: where(${inputs.InsightIDRFileTypeField} CONTAINS-ANY [${FileTypeParsed}])
      sequence_number:
        complex:
          root: inputs.sequence_number
      start_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: start_time
      time_range:
        complex:
          root: inputs.time_range
          filters:
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2960,
          "y": -360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 10c1beb1-9d60-4c44-8d1c-e352e14e0078
    type: regular
    task:
      id: 10c1beb1-9d60-4c44-8d1c-e352e14e0078
      version: -1
      name: Rapid7 InsightIDR query - MD5
      description: Queries within a log set for certain values.
      script: Rapid7 InsightIDR|||rapid7-insight-idr-query-log-set
      type: regular
      iscommand: true
      brand: Rapid7 InsightIDR
    nexttasks:
      '#none#':
      - "126"
    scriptarguments:
      end_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: end_time
      log_set_id:
        complex:
          root: inputs.LogSetId
      logs_per_page:
        complex:
          root: inputs.logs_per_page
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
          - - operator: lessThanOrEqual
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
              right:
                value:
                  simple: "500"
      query:
        simple: where(${inputs.InsightIDRMD5Field} CONTAINS-ANY [${MD5Parsed}])
      sequence_number:
        complex:
          root: inputs.sequence_number
      start_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: start_time
      time_range:
        complex:
          root: inputs.time_range
          filters:
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4630,
          "y": -370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: fb5cd1e8-9f1f-4324-8ad1-20611359bdea
    type: condition
    task:
      id: fb5cd1e8-9f1f-4324-8ad1-20611359bdea
      version: -1
      name: Is Rapid7 InsightIDR enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "175"
      "yes":
      - "69"
      - "74"
      - "13"
      - "77"
      - "8"
      - "11"
    scriptarguments:
      brandname:
        simple: Rapid7 InsightIDR
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4860,
          "y": -1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "69":
    id: "69"
    taskid: 4584614c-ba99-40d8-8079-32fa03c6018d
    type: title
    task:
      id: 4584614c-ba99-40d8-8079-32fa03c6018d
      version: -1
      name: SHA256 Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "140"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3790,
          "y": -870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "70":
    id: "70"
    taskid: 745d7d10-e6f8-4552-842f-cf61848aaac1
    type: regular
    task:
      id: 745d7d10-e6f8-4552-842f-cf61848aaac1
      version: -1
      name: Rapid7 InsightIDR query - SHA256
      description: Queries within a log set for certain values.
      script: Rapid7 InsightIDR|||rapid7-insight-idr-query-log-set
      type: regular
      iscommand: true
      brand: Rapid7 InsightIDR
    nexttasks:
      '#none#':
      - "124"
    scriptarguments:
      end_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: end_time
      log_set_id:
        complex:
          root: inputs.LogSetId
      logs_per_page:
        complex:
          root: inputs.logs_per_page
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
          - - operator: lessThanOrEqual
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
              right:
                value:
                  simple: "500"
      query:
        simple: where(${inputs.InsightIDRSHA256Field} CONTAINS-ANY [${SHA256Parsed}])
      sequence_number:
        complex:
          root: inputs.sequence_number
      start_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: start_time
      time_range:
        complex:
          root: inputs.time_range
          filters:
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3790,
          "y": -370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "73":
    id: "73"
    taskid: 863111f4-d353-49a1-8410-49849f638ff2
    type: regular
    task:
      id: 863111f4-d353-49a1-8410-49849f638ff2
      version: -1
      name: Rapid7 InsightIDR query - SHA1
      description: Queries within a log set for certain values.
      script: Rapid7 InsightIDR|||rapid7-insight-idr-query-log-set
      type: regular
      iscommand: true
      brand: Rapid7 InsightIDR
    nexttasks:
      '#none#':
      - "125"
    scriptarguments:
      end_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: end_time
      log_set_id:
        complex:
          root: inputs.LogSetId
      logs_per_page:
        complex:
          root: inputs.logs_per_page
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
          - - operator: lessThanOrEqual
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
              right:
                value:
                  simple: "500"
      query:
        simple: where(${inputs.InsightIDRSHA1Field} CONTAINS-ANY [${SHA1Parsed}])
      sequence_number:
        complex:
          root: inputs.sequence_number
      start_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: start_time
      time_range:
        complex:
          root: inputs.time_range
          filters:
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4200,
          "y": -370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "74":
    id: "74"
    taskid: 44d97b92-4fe5-4f94-8fde-5ca7d7e47df4
    type: title
    task:
      id: 44d97b92-4fe5-4f94-8fde-5ca7d7e47df4
      version: -1
      name: SHA1 Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "141"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4200,
          "y": -870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "76":
    id: "76"
    taskid: cb51b3d4-9383-49fc-899e-7bb313e1c1b1
    type: regular
    task:
      id: cb51b3d4-9383-49fc-899e-7bb313e1c1b1
      version: -1
      name: Rapid7 InsightIDR query - file path
      description: Queries within a log set for certain values.
      script: Rapid7 InsightIDR|||rapid7-insight-idr-query-log-set
      type: regular
      iscommand: true
      brand: Rapid7 InsightIDR
    nexttasks:
      '#none#':
      - "123"
    scriptarguments:
      end_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: end_time
      log_set_id:
        complex:
          root: inputs.LogSetId
      logs_per_page:
        complex:
          root: inputs.logs_per_page
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
          - - operator: lessThanOrEqual
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
              right:
                value:
                  simple: "500"
      query:
        simple: where(${inputs.InsightIDRFilePathField} CONTAINS-ANY [${FilePathParsed}])
      sequence_number:
        complex:
          root: inputs.sequence_number
      start_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: start_time
      time_range:
        complex:
          root: inputs.time_range
          filters:
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3370,
          "y": -370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "77":
    id: "77"
    taskid: e402b951-3b9a-430a-80d0-335b73a1ec39
    type: title
    task:
      id: e402b951-3b9a-430a-80d0-335b73a1ec39
      version: -1
      name: File Path Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "139"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3370,
          "y": -870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "121":
    id: "121"
    taskid: c3ff1d3f-6f45-4ec5-8e9e-75cce24a341b
    type: title
    task:
      id: c3ff1d3f-6f45-4ec5-8e9e-75cce24a341b
      version: -1
      name: File Name Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "176"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2540,
          "y": -205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "122":
    id: "122"
    taskid: 778b9cd3-7d6b-4ee4-83b6-c2d6dadfa264
    type: title
    task:
      id: 778b9cd3-7d6b-4ee4-83b6-c2d6dadfa264
      version: -1
      name: File Type Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "176"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2960,
          "y": -205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "123":
    id: "123"
    taskid: 7a23b7a5-9427-47af-8880-4e0ffc935503
    type: title
    task:
      id: 7a23b7a5-9427-47af-8880-4e0ffc935503
      version: -1
      name: File Path Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "176"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3370,
          "y": -205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "124":
    id: "124"
    taskid: de5d1e4d-bcb4-4f85-8be8-6c6dac3ecfa9
    type: title
    task:
      id: de5d1e4d-bcb4-4f85-8be8-6c6dac3ecfa9
      version: -1
      name: SHA256 Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "176"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3790,
          "y": -205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "125":
    id: "125"
    taskid: 00d908e0-ab8c-405d-8621-c55852dac07b
    type: title
    task:
      id: 00d908e0-ab8c-405d-8621-c55852dac07b
      version: -1
      name: SHA1 Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "176"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4200,
          "y": -205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "126":
    id: "126"
    taskid: 8a93b48b-dcfb-4a34-8072-5bf59232e897
    type: title
    task:
      id: 8a93b48b-dcfb-4a34-8072-5bf59232e897
      version: -1
      name: MD5 Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "176"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4630,
          "y": -205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "137":
    id: "137"
    taskid: 176f4dd2-e927-42be-8eb6-859774ed6d65
    type: condition
    task:
      id: 176f4dd2-e927-42be-8eb6-859774ed6d65
      version: -1
      name: Any file name to hunt for?
      description: |
        Checks whether any file names are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "175"
      "yes":
      - "163"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileName
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2540,
          "y": -740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "138":
    id: "138"
    taskid: 6a35fd76-57db-4913-866e-fde04d94981e
    type: condition
    task:
      id: 6a35fd76-57db-4913-866e-fde04d94981e
      version: -1
      name: Any file type to hunt for?
      description: |
        Checks whether any file types are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "175"
      "yes":
      - "164"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileType
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2960,
          "y": -740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "139":
    id: "139"
    taskid: 7eda9b97-06c3-41f5-89c1-d15e29a824d4
    type: condition
    task:
      id: 7eda9b97-06c3-41f5-89c1-d15e29a824d4
      version: -1
      name: Any file path to hunt for?
      description: |
        Checks whether any file paths are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "175"
      "yes":
      - "165"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FilePath
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3370,
          "y": -740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "140":
    id: "140"
    taskid: 61c8d7fa-52ba-4eaf-8349-25dbd76c86f3
    type: condition
    task:
      id: 61c8d7fa-52ba-4eaf-8349-25dbd76c86f3
      version: -1
      name: Any SHA256 to hunt for?
      description: |
        Checks whether any SHA256 hashes are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "175"
      "yes":
      - "166"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3790,
          "y": -740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "141":
    id: "141"
    taskid: 6ef9ec3d-5668-4410-8ad4-3428516e3de5
    type: condition
    task:
      id: 6ef9ec3d-5668-4410-8ad4-3428516e3de5
      version: -1
      name: Any SHA1 to hunt for?
      description: |
        Checks whether any SHA1 hashes are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "175"
      "yes":
      - "167"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA1
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4200,
          "y": -740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "142":
    id: "142"
    taskid: e84d41e2-5aca-404f-87bc-80d2b1bb0616
    type: condition
    task:
      id: e84d41e2-5aca-404f-87bc-80d2b1bb0616
      version: -1
      name: Any MD5 to hunt for?
      description: |
        Checks whether any MD5 hashes are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "175"
      "yes":
      - "168"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.MD5
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4630,
          "y": -740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "163":
    id: "163"
    taskid: 2e55fc2f-cc17-4563-8fe8-b9167f91c898
    type: regular
    task:
      id: 2e55fc2f-cc17-4563-8fe8-b9167f91c898
      version: -1
      name: Set file name search argument
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      key:
        simple: FileNameParsed
      value:
        complex:
          root: inputs.FileName
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.FileName
                iscontext: true
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2540,
          "y": -530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "164":
    id: "164"
    taskid: 8844d0a8-d4a3-4f0d-81a6-e7185935143a
    type: regular
    task:
      id: 8844d0a8-d4a3-4f0d-81a6-e7185935143a
      version: -1
      name: Set file type search argument
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      key:
        simple: FileTypeParsed
      value:
        complex:
          root: inputs.FileType
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.FileType
                iscontext: true
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2960,
          "y": -520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "165":
    id: "165"
    taskid: f44bf473-5f4c-4420-8bc2-1d181e77bd90
    type: regular
    task:
      id: f44bf473-5f4c-4420-8bc2-1d181e77bd90
      version: -1
      name: Set file path search argument
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "76"
    scriptarguments:
      key:
        simple: FilePathParsed
      value:
        complex:
          root: inputs.FilePath
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.FilePath
                iscontext: true
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3370,
          "y": -530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "166":
    id: "166"
    taskid: 00bd98bf-128c-45e9-8d71-7708d2a3d177
    type: regular
    task:
      id: 00bd98bf-128c-45e9-8d71-7708d2a3d177
      version: -1
      name: Set SHA256 search argument
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "70"
    scriptarguments:
      key:
        simple: SHA256Parsed
      value:
        complex:
          root: inputs.SHA256
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.SHA256
                iscontext: true
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3790,
          "y": -530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "167":
    id: "167"
    taskid: 54511478-cf76-4c13-883d-11a3f5f9cd31
    type: regular
    task:
      id: 54511478-cf76-4c13-883d-11a3f5f9cd31
      version: -1
      name: Set SHA1 search argument
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "73"
    scriptarguments:
      key:
        simple: SHA1Parsed
      value:
        complex:
          root: inputs.SHA1
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.SHA1
                iscontext: true
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4200,
          "y": -530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "168":
    id: "168"
    taskid: 3bce8727-58b1-406c-8742-d264d3e82af5
    type: regular
    task:
      id: 3bce8727-58b1-406c-8742-d264d3e82af5
      version: -1
      name: Set MD5 search argument
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      key:
        simple: MD5Parsed
      value:
        complex:
          root: inputs.MD5
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.MD5
                iscontext: true
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4630,
          "y": -530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "175":
    id: "175"
    taskid: 426e4bed-833f-49fb-8f12-08453c5fc526
    type: title
    task:
      id: 426e4bed-833f-49fb-8f12-08453c5fc526
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4860,
          "y": 110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "176":
    id: "176"
    taskid: b3efcda8-a91c-4467-8c2c-61cf7fcfb33d
    type: regular
    task:
      id: b3efcda8-a91c-4467-8c2c-61cf7fcfb33d
      version: -1
      name: Save Queries Results
      description: Loads a json from string input, and returns a json object result
      scriptName: LoadJSON
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "175"
    scriptarguments:
      extend-context:
        simple: Rapid7InsightIDR.HuntingResults=
      ignore-outputs:
        simple: "true"
      input:
        complex:
          root: Rapid7InsightIDR.Event
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: Rapid7InsightIDR.Event
                iscontext: true
          accessor: message
          transformers:
          - operator: replace
            args:
              limit: {}
              replaceWith: {}
              toReplace:
                value:
                  simple: \
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3570,
          "y": -60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "137_175_#default#": 0.1,
      "138_175_#default#": 0.1,
      "139_175_#default#": 0.1,
      "140_175_#default#": 0.1,
      "141_175_#default#": 0.16,
      "142_168_yes": 0.43,
      "142_175_#default#": 0.18,
      "56_11_yes": 0.9,
      "56_13_yes": 0.39,
      "56_175_#default#": 0.13,
      "56_74_yes": 0.65,
      "56_77_yes": 0.83,
      "56_8_yes": 0.87
    },
    "paper": {
      "dimensions": {
        "height": 1345,
        "width": 2700,
        "x": -4860,
        "y": -1170
      }
    }
  }
inputs:
- key: FileType
  value: {}
  required: false
  description: |-
    A single or multiple file types to search for within Rapid7 InsightIDR logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: InsightIDRFileTypeField
  value: {}
  required: false
  description: The name of the fields, in Rapid7 InsightIDR, in which to find the file types.
  playbookInputQuery:
- key: FileName
  value: {}
  required: false
  description: |-
    A single or multiple file names to search for within Rapid7 InsightIDR logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: InsightIDRFileNameField
  value: {}
  required: false
  description: The name of the fields, in Rapid7 InsightIDR, in which to find the file names.
  playbookInputQuery:
- key: MD5
  value: {}
  required: false
  description: |-
    A single or multiple MD5 file hashes to search for within Rapid7 InsightIDR logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: InsightIDRMD5Field
  value: {}
  required: false
  description: The name of the fields, in Rapid7 InsightIDR, in which to find the MD5 hashes.
  playbookInputQuery:
- key: SHA256
  value: {}
  required: false
  description: |-
    A single or multiple SHA256 file hashes to search for within Rapid7 InsightIDR logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: InsightIDRSHA256Field
  value: {}
  required: false
  description: The name of the fields, in Rapid7 InsightIDR, in which to find the SHA256 hashes.
  playbookInputQuery:
- key: SHA1
  value: {}
  required: false
  description: |-
    A single or multiple SHA1 file hashes to search for within Rapid7 InsightIDR logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: InsightIDRSHA1Field
  value: {}
  required: false
  description: The name of the fields, in Rapid7 InsightIDR, in which to find the SHA1 hashes.
  playbookInputQuery:
- key: FilePath
  value: {}
  required: false
  description: |-
    A single or multiple file paths to search for within Rapid7 InsightIDR logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: InsightIDRFilePathField
  value: {}
  required: false
  description: The name of the fields, in Rapid7 InsightIDR, in which to find the file paths.
  playbookInputQuery:
- key: LogSetId
  value: {}
  required: true
  description: An identifier for a Rapid7 InsightIDR log set to query.
  playbookInputQuery:
- key: time_range
  value: {}
  required: false
  description: |-
    Specify the timeframe in which the Rapid7 InsightIDR logs will be searched. Most start with 'last' (e.g., last 2 months, last 10 minutes).
    The 'start_time' and 'end_time' inputs should not be used if the time_range input is specified.

    Supported time units (case insensitive):
    min(s) or minute(s)
    hr(s) or hour(s)
    day(s)
    week(s)
    month(s)
    year(s)
  playbookInputQuery:
- key: logs_per_page
  value: {}
  required: false
  description: Specify the maximum number of log entries to return per page, up to 500 (the maximum allowed). By default, 50 is set.
  playbookInputQuery:
- key: sequence_number
  value: {}
  required: false
  description: |-
    The earliest sequence number of a log entry to start searching.

    If this query parameter is included, the query results will additionally include all log entries received in the 'start_time' millisecond which have sequence numbers larger than the one specified.

    Sequence numbers are identifiers used to distinguish between log entries received in the same millisecond. If a log entry was split up into several log entries during ingestion, then those chunks are ordered by sequence number.
  playbookInputQuery:
- key: start_time
  value: {}
  required: false
  description: |-
    Specify the query start time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds.

    For example, if you wish to begin searching 1 week ago, the UNIX timestamp value is 604800.
  playbookInputQuery:
- key: end_time
  value: {}
  required: false
  description: |-
    Specify the query end time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds.

    For example, to end searching a day ago, the UNIX timestamp value would be 86400.
  playbookInputQuery:
outputs:
- contextPath: Rapid7InsightIDR.HuntingResults
  description: Events log objects containing relevant fields.
  type: string
tests:
- No tests (auto formatted)
fromversion: 6.5.0