Rapid7 InsightIDR - HTTP Requests Indicators Hunting

This playbook queries Rapid7 InsightIDR SIEM for indicators associated with HTTP requests, including HTTP request methods, user agents, URIs, and Ja3. Note that multiple search values should be separated by commas only (without spaces or any special characters).

Rapid7 InsightIDR · 24 tasks · 14 inputs · 1 output

Details

IDRapid7 InsightIDR - HTTP Requests Indicators Hunting
From Version6.5.0
Tasks24

README

This playbook queries Rapid7 InsightIDR SIEM for indicators associated with HTTP requests, including HTTP request methods, user agents, URIs, and Ja3.

Note that multiple search values should be separated by commas only (without spaces or any special characters).

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • Rapid7 InsightIDR

Scripts

  • SetAndHandleEmpty
  • LoadJSON
  • IsIntegrationAvailable

Commands

  • rapid7-insight-idr-query-log-set

Playbook Inputs

Name Description Default Value Required
UserAgent A single or multiple user agents to search for within Rapid7 InsightIDR logs.

Separate multiple search values by commas only (without spaces or any special characters).		   Optional
InsightIDRUserAgentField The name of the fields, in Rapid7 InsightIDR, in which to find the user agents.   Optional
URI A single or multiple URIs to search for within Rapid7 InsightIDR logs.

Separate multiple search values by commas only (without spaces or any special characters).		   Optional
InsightIDRURIField The name of the fields, in Rapid7 InsightIDR, in which to find the URIs.   Optional
HTTPRequestMethods A single or multiple HTTP requests methods to search for within Rapid7 InsightIDR logs.

Separate multiple search values by commas only (without spaces or any special characters).		   Optional
InsightIDRHttpMethodsField The name of the fields, in Rapid7 InsightIDR, in which to find the HTTP request methods.   Optional
Ja3 A single or multiple Ja3s to search for within Rapid7 InsightIDR logs.

Separate multiple search values by commas only (without spaces or any special characters).

JA3 is a method for creating SSL/TLS client fingerprints that should be easy to produce on any platform and can be easily shared for threat intelligence.		   Optional
InsightIDRJa3Field The name of the fields, in Rapid7 InsightIDR, in which to find the Ja3s.   Optional
LogSetId An identifier for a Rapid7 InsightIDR log set to query.   Required
time_range Specify the timeframe in which the Rapid7 InsightIDR logs will be searched. Most start with ‘last’ (e.g., last 2 months, last 10 minutes).
The ‘start_time’ and ‘end_time’ inputs should not be used if the time_range input is specified.

Supported time units (case insensitive):
min(s) or minute(s)
hr(s) or hour(s)
day(s)
week(s)
month(s)
year(s)		   Optional
logs_per_page Specify the maximum number of log entries to return per page, up to 500 (the maximum allowed). By default, 50 is set.   Optional
sequence_number The earliest sequence number of a log entry to start searching.

If this query parameter is included, the query results will additionally include all log entries received in the ‘start_time’ millisecond which have sequence numbers larger than the one specified.

Sequence numbers are identifiers used to distinguish between log entries received in the same millisecond. If a log entry was split up into several log entries during ingestion, then those chunks are ordered by sequence number.		   Optional
start_time Specify the query start time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds.

For example, if you wish to begin searching 1 week ago, the UNIX timestamp value is 604800.		   Optional
end_time Specify the query end time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds.

For example, to end searching a day ago, the UNIX timestamp value would be 86400.		   Optional

Playbook Outputs

Path Description Type
Rapid7InsightIDR.HuntingResults Events log objects containing relevant fields. string

Playbook Image

Rapid7 InsightIDR - HTTP Requests Indicators Hunting

Inputs

  • UserAgent — A single or multiple user agents to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
  • InsightIDRUserAgentField — The name of the fields, in Rapid7 InsightIDR, in which to find the user agents.
  • URI — A single or multiple URIs to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
  • InsightIDRURIField — The name of the fields, in Rapid7 InsightIDR, in which to find the URIs.
  • HTTPRequestMethods — A single or multiple HTTP requests methods to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters).
  • InsightIDRHttpMethodsField — The name of the fields, in Rapid7 InsightIDR, in which to find the HTTP request methods.
  • Ja3 — A single or multiple Ja3s to search for within Rapid7 InsightIDR logs. Separate multiple search values by commas only (without spaces or any special characters). JA3 is a method for creating SSL/TLS client fingerprints that should be easy to produce on any platform and can be easily shared for threat intelligence.
  • InsightIDRJa3Field — The name of the fields, in Rapid7 InsightIDR, in which to find the Ja3s.
  • LogSetId — An identifier for a Rapid7 InsightIDR log set to query.
  • time_range — Specify the timeframe in which the Rapid7 InsightIDR logs will be searched. Most start with 'last' (e.g., last 2 months, last 10 minutes). The 'start_time' and 'end_time' inputs should not be used if the time_range input is specified. Supported time units (case insensitive): min(s) or minute(s) hr(s) or hour(s) day(s) week(s) month(s) year(s)
  • logs_per_page — Specify the maximum number of log entries to return per page, up to 500 (the maximum allowed). By default, 50 is set.
  • sequence_number — The earliest sequence number of a log entry to start searching. If this query parameter is included, the query results will additionally include all log entries received in the 'start_time' millisecond which have sequence numbers larger than the one specified. Sequence numbers are identifiers used to distinguish between log entries received in the same millisecond. If a log entry was split up into several log entries during ingestion, then those chunks are ordered by sequence number.
  • start_time — Specify the query start time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds. For example, if you wish to begin searching 1 week ago, the UNIX timestamp value is 604800.
  • end_time — Specify the query end time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds. For example, to end searching a day ago, the UNIX timestamp value would be 86400.

Outputs

  • Rapid7InsightIDR.HuntingResults — Events log objects containing relevant fields.

Commands used

rapid7-insight-idr-query-log-set

Flowchart

yes yes yes yes yes yes yes yes Start Start User Agent Indicators User Agent Indicators URI Indicators URI Indicators Rapid7 InsightIDR query - user agent - rapid7-insight-idr-query-log-set Rapid7 InsightIDR query -... rapid7-insight-idr-query-log-set Rapid7 InsightIDR query - URI - rapid7-insight-idr-query-log-set Rapid7 InsightIDR query -... rapid7-insight-idr-query-log-set HTTP Request Methods Indicators HTTP Request Methods Indi... Rapid7 InsightIDR query - HTTP request methods - rapid7-insight-idr-query-log-set Rapid7 InsightIDR query -... rapid7-insight-idr-query-log-set Is Rapid7 InsightIDR enabled? - IsIntegrationAvailable Is Rapid7 InsightIDR enab... IsIntegrationAvailable Rapid7 InsightIDR query - Ja3 - rapid7-insight-idr-query-log-set Rapid7 InsightIDR query -... rapid7-insight-idr-query-log-set Ja3 Indicators Ja3 Indicators HTTP Request Methods Hunting Done HTTP Request Methods Hunt... URI Hunting Done URI Hunting Done User Agent Hunting Done User Agent Hunting Done Ja3 Hunting Done Ja3 Hunting Done Any HTTP request method to hunt for? Any HTTP request method t... Any URI to hunt for? Any URI to hunt for? Any user agent to hunt for? Any user agent to hunt for? Any Ja3 to hunt for? Any Ja3 to hunt for? Set HTTP request methods search argument - SetAndHandleEmpty Set HTTP request methods ... SetAndHandleEmpty Set URI search argument - SetAndHandleEmpty Set URI search argument SetAndHandleEmpty Set user agent search argument - SetAndHandleEmpty Set user agent search arg... SetAndHandleEmpty Set Ja3 search argument - SetAndHandleEmpty Set Ja3 search argument SetAndHandleEmpty Done Done Save Queries Results - LoadJSON Save Queries Results LoadJSON

Source

playbook-Rapid7_InsightIDR_-_HTTP_Requests_Indicators_Hunting.yml
Download History Raw 
id: Rapid7 InsightIDR - HTTP Requests Indicators Hunting
version: -1
name: Rapid7 InsightIDR - HTTP Requests Indicators Hunting
description: "This playbook queries Rapid7 InsightIDR SIEM for indicators associated with HTTP requests, including HTTP request methods, user agents, URIs, and Ja3.\n\nNote that multiple search values should be separated by commas only (without spaces or any special characters). "
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a52d8420-7a8c-4987-866d-15dd05511bae
    type: start
    task:
      id: a52d8420-7a8c-4987-866d-15dd05511bae
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "56"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -5100,
          "y": -2200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: ea98807d-90dc-4bbd-898f-240df1c82a28
    type: title
    task:
      id: ea98807d-90dc-4bbd-898f-240df1c82a28
      version: -1
      name: User Agent Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "145"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4270,
          "y": -1900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 07f156af-128d-4689-8b10-fe0d5b4dd9df
    type: title
    task:
      id: 07f156af-128d-4689-8b10-fe0d5b4dd9df
      version: -1
      name: URI Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "144"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3670,
          "y": -1900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: ee7f5c64-eaac-43e7-8949-5b5e070fa940
    type: regular
    task:
      id: ee7f5c64-eaac-43e7-8949-5b5e070fa940
      version: -1
      name: Rapid7 InsightIDR query - user agent
      description: Queries within a log set for certain values.
      script: Rapid7 InsightIDR|||rapid7-insight-idr-query-log-set
      type: regular
      iscommand: true
      brand: Rapid7 InsightIDR
    nexttasks:
      '#none#':
      - "129"
    scriptarguments:
      end_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: end_time
      log_set_id:
        complex:
          root: inputs.LogSetId
      logs_per_page:
        complex:
          root: inputs.logs_per_page
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
          - - operator: lessThanOrEqual
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
              right:
                value:
                  simple: "500"
      query:
        simple: where(${inputs.InsightIDRUserAgentField} CONTAINS-ANY [${UserAgentParsed}])
      sequence_number:
        complex:
          root: inputs.sequence_number
      start_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: start_time
      time_range:
        complex:
          root: inputs.time_range
          filters:
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4050,
          "y": -1440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 86eafadd-61e4-49b3-81e0-216dbb02e330
    type: regular
    task:
      id: 86eafadd-61e4-49b3-81e0-216dbb02e330
      version: -1
      name: Rapid7 InsightIDR query - URI
      description: Queries within a log set for certain values.
      script: Rapid7 InsightIDR|||rapid7-insight-idr-query-log-set
      type: regular
      iscommand: true
      brand: Rapid7 InsightIDR
    nexttasks:
      '#none#':
      - "128"
    scriptarguments:
      end_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: end_time
      log_set_id:
        complex:
          root: inputs.LogSetId
      logs_per_page:
        complex:
          root: inputs.logs_per_page
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
          - - operator: lessThanOrEqual
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
              right:
                value:
                  simple: "500"
      query:
        simple: where(${inputs.InsightIDRURIField} CONTAINS-ANY [${URIParsed}])
      sequence_number:
        complex:
          root: inputs.sequence_number
      start_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: start_time
      time_range:
        complex:
          root: inputs.time_range
          filters:
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3450,
          "y": -1440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "53":
    id: "53"
    taskid: c58a191f-280a-42df-85a6-1b710c9918d7
    type: title
    task:
      id: c58a191f-280a-42df-85a6-1b710c9918d7
      version: -1
      name: HTTP Request Methods Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "143"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3070,
          "y": -1900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: 24ee4171-02df-49b3-80ea-f80f56dcac15
    type: regular
    task:
      id: 24ee4171-02df-49b3-80ea-f80f56dcac15
      version: -1
      name: Rapid7 InsightIDR query - HTTP request methods
      description: Queries within a log set for certain values.
      script: Rapid7 InsightIDR|||rapid7-insight-idr-query-log-set
      type: regular
      iscommand: true
      brand: Rapid7 InsightIDR
    nexttasks:
      '#none#':
      - "127"
    scriptarguments:
      end_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: end_time
      log_set_id:
        complex:
          root: inputs.LogSetId
      logs_per_page:
        complex:
          root: inputs.logs_per_page
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
          - - operator: lessThanOrEqual
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
              right:
                value:
                  simple: "500"
      query:
        simple: where(${inputs.InsightIDRHttpMethodsField} CONTAINS-ANY [${RequestMethodsParsed}])
      sequence_number:
        complex:
          root: inputs.sequence_number
      start_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: start_time
      time_range:
        complex:
          root: inputs.time_range
          filters:
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2850,
          "y": -1440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: fb5cd1e8-9f1f-4324-8ad1-20611359bdea
    type: condition
    task:
      id: fb5cd1e8-9f1f-4324-8ad1-20611359bdea
      version: -1
      name: Is Rapid7 InsightIDR enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "175"
      "yes":
      - "80"
      - "9"
      - "12"
      - "53"
    scriptarguments:
      brandname:
        simple: Rapid7 InsightIDR
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -5100,
          "y": -2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "78":
    id: "78"
    taskid: 2a0e9ba3-33eb-433c-8033-cbe0d8f63e15
    type: regular
    task:
      id: 2a0e9ba3-33eb-433c-8033-cbe0d8f63e15
      version: -1
      name: Rapid7 InsightIDR query - Ja3
      description: Queries within a log set for certain values.
      script: Rapid7 InsightIDR|||rapid7-insight-idr-query-log-set
      type: regular
      iscommand: true
      brand: Rapid7 InsightIDR
    nexttasks:
      '#none#':
      - "130"
    scriptarguments:
      end_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: end_time
      log_set_id:
        complex:
          root: inputs.LogSetId
      logs_per_page:
        complex:
          root: inputs.logs_per_page
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
          - - operator: lessThanOrEqual
              left:
                value:
                  simple: inputs.logs_per_page
                iscontext: true
              right:
                value:
                  simple: "500"
      query:
        simple: where(${inputs.InsightIDRJa3Field} CONTAINS-ANY [${Ja3Parsed}])
      sequence_number:
        complex:
          root: inputs.sequence_number
      start_time:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
          accessor: start_time
      time_range:
        complex:
          root: inputs.time_range
          filters:
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.end_time
                iscontext: true
          - - operator: isEmpty
              left:
                value:
                  simple: inputs.start_time
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.time_range
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4650,
          "y": -1440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "80":
    id: "80"
    taskid: d709d956-f49f-42bf-8963-4c374aae68a0
    type: title
    task:
      id: d709d956-f49f-42bf-8963-4c374aae68a0
      version: -1
      name: Ja3 Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "146"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4870,
          "y": -1900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "127":
    id: "127"
    taskid: 0799c24f-93d0-4459-8e64-4991212d5298
    type: title
    task:
      id: 0799c24f-93d0-4459-8e64-4991212d5298
      version: -1
      name: HTTP Request Methods Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "176"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3070,
          "y": -1270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "128":
    id: "128"
    taskid: b6872b91-3667-4f06-8318-4e70588fbb5d
    type: title
    task:
      id: b6872b91-3667-4f06-8318-4e70588fbb5d
      version: -1
      name: URI Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "176"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3670,
          "y": -1270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "129":
    id: "129"
    taskid: 1990dcc9-6418-45bc-831e-d1c0e98087a7
    type: title
    task:
      id: 1990dcc9-6418-45bc-831e-d1c0e98087a7
      version: -1
      name: User Agent Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "176"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4270,
          "y": -1270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "130":
    id: "130"
    taskid: 586f4260-0a33-4224-89a1-30ef7be36d22
    type: title
    task:
      id: 586f4260-0a33-4224-89a1-30ef7be36d22
      version: -1
      name: Ja3 Hunting Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "176"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4870,
          "y": -1270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "143":
    id: "143"
    taskid: 6e2e02d1-447f-407e-8cc3-e5490b9cd411
    type: condition
    task:
      id: 6e2e02d1-447f-407e-8cc3-e5490b9cd411
      version: -1
      name: Any HTTP request method to hunt for?
      description: |
        Checks whether any HTTP request methods are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "127"
      "yes":
      - "159"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.HTTPRequestMethods
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3070,
          "y": -1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "144":
    id: "144"
    taskid: c5f4e0e3-22a0-41b5-800e-3da93b921ef8
    type: condition
    task:
      id: c5f4e0e3-22a0-41b5-800e-3da93b921ef8
      version: -1
      name: Any URI to hunt for?
      description: |
        Checks whether any URIs are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "128"
      "yes":
      - "160"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.URI
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3670,
          "y": -1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "145":
    id: "145"
    taskid: 5ca9eee1-6f4a-4f2f-8060-7dcb259f470f
    type: condition
    task:
      id: 5ca9eee1-6f4a-4f2f-8060-7dcb259f470f
      version: -1
      name: Any user agent to hunt for?
      description: |
        Checks whether any user agents are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "129"
      "yes":
      - "161"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.UserAgent
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4270,
          "y": -1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "146":
    id: "146"
    taskid: 79966b80-a5f1-4b1c-84d1-ef36b31d515f
    type: condition
    task:
      id: 79966b80-a5f1-4b1c-84d1-ef36b31d515f
      version: -1
      name: Any Ja3 to hunt for?
      description: |
        Checks whether any Ja3 are available for threat hunting.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "130"
      "yes":
      - "162"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Ja3
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4870,
          "y": -1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "159":
    id: "159"
    taskid: 04ba5b26-c170-4e88-8ac9-b1266487c2d8
    type: regular
    task:
      id: 04ba5b26-c170-4e88-8ac9-b1266487c2d8
      version: -1
      name: Set HTTP request methods search argument
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "54"
    scriptarguments:
      key:
        simple: RequestMethodsParsed
      value:
        complex:
          root: inputs.HTTPRequestMethods
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.HTTPRequestMethods
                iscontext: true
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2850,
          "y": -1600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "160":
    id: "160"
    taskid: 90a21575-3ea5-455b-8fa2-214c7a613be1
    type: regular
    task:
      id: 90a21575-3ea5-455b-8fa2-214c7a613be1
      version: -1
      name: Set URI search argument
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      key:
        simple: URIParsed
      value:
        complex:
          root: inputs.URI
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.URI
                iscontext: true
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3450,
          "y": -1600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "161":
    id: "161"
    taskid: 71455651-783f-4f1a-86bf-66962a3c15a6
    type: regular
    task:
      id: 71455651-783f-4f1a-86bf-66962a3c15a6
      version: -1
      name: Set user agent search argument
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      key:
        simple: UserAgentParsed
      value:
        complex:
          root: inputs.UserAgent
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.UserAgent
                iscontext: true
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4050,
          "y": -1600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "162":
    id: "162"
    taskid: ec524b2c-f19d-4a70-8c95-8a3a3ef6f74e
    type: regular
    task:
      id: ec524b2c-f19d-4a70-8c95-8a3a3ef6f74e
      version: -1
      name: Set Ja3 search argument
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "78"
    scriptarguments:
      key:
        simple: Ja3Parsed
      value:
        complex:
          root: inputs.Ja3
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.Ja3
                iscontext: true
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4650,
          "y": -1600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "175":
    id: "175"
    taskid: 426e4bed-833f-49fb-8f12-08453c5fc526
    type: title
    task:
      id: 426e4bed-833f-49fb-8f12-08453c5fc526
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -5100,
          "y": -950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "176":
    id: "176"
    taskid: f462c522-d159-4e39-8314-cc44c0d90b41
    type: regular
    task:
      id: f462c522-d159-4e39-8314-cc44c0d90b41
      version: -1
      name: Save Queries Results
      description: Loads a json from string input, and returns a json object result
      scriptName: LoadJSON
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "175"
    scriptarguments:
      extend-context:
        simple: Rapid7InsightIDR.HuntingResults=
      ignore-outputs:
        simple: "true"
      input:
        complex:
          root: Rapid7InsightIDR.Event
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: Rapid7InsightIDR.Event
                iscontext: true
          accessor: message
          transformers:
          - operator: replace
            args:
              limit: {}
              replaceWith: {}
              toReplace:
                value:
                  simple: \
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3950,
          "y": -1120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "56_12_yes": 0.78,
      "56_175_#default#": 0.79,
      "56_53_yes": 0.85,
      "56_80_yes": 0.4,
      "56_9_yes": 0.65
    },
    "paper": {
      "dimensions": {
        "height": 1315,
        "width": 2630,
        "x": -5100,
        "y": -2200
      }
    }
  }
inputs:
- key: UserAgent
  value: {}
  required: false
  description: |-
    A single or multiple user agents to search for within Rapid7 InsightIDR logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: InsightIDRUserAgentField
  value: {}
  required: false
  description: The name of the fields, in Rapid7 InsightIDR, in which to find the user agents.
  playbookInputQuery:
- key: URI
  value: {}
  required: false
  description: |-
    A single or multiple URIs to search for within Rapid7 InsightIDR logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: InsightIDRURIField
  value: {}
  required: false
  description: The name of the fields, in Rapid7 InsightIDR, in which to find the URIs.
  playbookInputQuery:
- key: HTTPRequestMethods
  value: {}
  required: false
  description: |-
    A single or multiple HTTP requests methods to search for within Rapid7 InsightIDR logs.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: InsightIDRHttpMethodsField
  value: {}
  required: false
  description: The name of the fields, in Rapid7 InsightIDR, in which to find the HTTP request methods.
  playbookInputQuery:
- key: Ja3
  value: {}
  required: false
  description: |-
    A single or multiple Ja3s to search for within Rapid7 InsightIDR logs.

    Separate multiple search values by commas only (without spaces or any special characters).

    JA3 is a method for creating SSL/TLS client fingerprints that should be easy to produce on any platform and can be easily shared for threat intelligence.
  playbookInputQuery:
- key: InsightIDRJa3Field
  value: {}
  required: false
  description: The name of the fields, in Rapid7 InsightIDR, in which to find the Ja3s.
  playbookInputQuery:
- key: LogSetId
  value: {}
  required: true
  description: An identifier for a Rapid7 InsightIDR log set to query.
  playbookInputQuery:
- key: time_range
  value: {}
  required: false
  description: |-
    Specify the timeframe in which the Rapid7 InsightIDR logs will be searched. Most start with 'last' (e.g., last 2 months, last 10 minutes).
    The 'start_time' and 'end_time' inputs should not be used if the time_range input is specified.

    Supported time units (case insensitive):
    min(s) or minute(s)
    hr(s) or hour(s)
    day(s)
    week(s)
    month(s)
    year(s)
  playbookInputQuery:
- key: logs_per_page
  value: {}
  required: false
  description: Specify the maximum number of log entries to return per page, up to 500 (the maximum allowed). By default, 50 is set.
  playbookInputQuery:
- key: sequence_number
  value: {}
  required: false
  description: |-
    The earliest sequence number of a log entry to start searching.

    If this query parameter is included, the query results will additionally include all log entries received in the 'start_time' millisecond which have sequence numbers larger than the one specified.

    Sequence numbers are identifiers used to distinguish between log entries received in the same millisecond. If a log entry was split up into several log entries during ingestion, then those chunks are ordered by sequence number.
  playbookInputQuery:
- key: start_time
  value: {}
  required: false
  description: |-
    Specify the query start time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds.

    For example, if you wish to begin searching 1 week ago, the UNIX timestamp value is 604800.
  playbookInputQuery:
- key: end_time
  value: {}
  required: false
  description: |-
    Specify the query end time at which the Rapid7 InsightIDR logs will be searched, as a UNIX timestamp in milliseconds.

    For example, to end searching a day ago, the UNIX timestamp value would be 86400.
  playbookInputQuery:
outputs:
- contextPath: Rapid7InsightIDR.HuntingResults
  description: Events log objects containing relevant fields.
  type: string
tests:
- No tests (auto formatted)
fromversion: 6.5.0