Recorded Future - Threat Actor Search

Template playbook to initiate an Automated Threat Hunt based on the Threat Map in Recorded Future. The Playbook fetches links related to the Threat Actors part of the Threat Map from Recorded Future and launches a hunt in the SIEM for any detections within the environment.
Recorded Future Intelligence · 16 tasks · 1 input · 0 outputs
Details

ID	`Recorded Future - Threat Actor Search`
From Version	6.9.0
Tasks	16
README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

QRadar Indicator Hunting V2
Splunk Indicator Hunting
Integrations

RecordedFuture
Recorded Future v2
Scripts

This playbook does not use any scripts.
Commands

recordedfuture-detection-rules
recordedfuture-threat-links
recordedfuture-threat-map
extractIndicators
Playbook Inputs

Name	Description	Default Value	Required
threat_actor	The threat actor to enrich & hunt indicators for.		Optional
Playbook Outputs

There are no outputs for this playbook.
Inputs

threat_actor — The threat actor to enrich & hunt indicators for.
Commands used

extractIndicators recordedfuture-detection-rules recordedfuture-threat-links recordedfuture-threat-map
Flowchart

Source

playbook-Recorded_Future_Threat_Actor_Search.yml
Download History Raw
id: Recorded Future - Threat Actor Search
version: -1
description: Template playbook to initiate an Automated Threat Hunt based on the Threat Map in Recorded Future. The Playbook fetches links related to the Threat Actors part of the Threat Map from Recorded Future and launches a hunt in the SIEM for any detections within the environment.
name: Recorded Future - Threat Actor Search
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: cf5f9856-0a23-432a-8212-ba8094180132
    type: start
    task:
      id: cf5f9856-0a23-432a-8212-ba8094180132
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 807.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: e61b2aaa-4e80-4929-872c-465a8c274f27
    type: regular
    task:
      id: e61b2aaa-4e80-4929-872c-465a8c274f27
      version: -1
      name: Threat Actor Map Search
      description: Get threat actors map.
      script: '|||recordedfuture-threat-map'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      actor_name:
        complex:
          root: inputs.threat_actor
      include_links:
        simple: "false"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 807.5,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 73169a99-6161-460d-8565-9ea07375a5bd
    type: regular
    task:
      id: 73169a99-6161-460d-8565-9ea07375a5bd
      version: -1
      name: Threat Actor Links Search
      description: Search links
      script: Recorded Future v2|||recordedfuture-threat-links
      type: regular
      iscommand: true
      brand: Recorded Future v2
    nexttasks:
      '#none#':
      - "4"
      - "21"
    scriptarguments:
      entity_id:
        complex:
          root: RecordedFuture.ThreatMap
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 807.5,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: f0c59c28-9ca2-4c2b-89ff-40f3efcd9956
    type: condition
    task:
      id: f0c59c28-9ca2-4c2b-89ff-40f3efcd9956
      version: -1
      name: Detection Rules Returned?
      description: Was there a detection rule found?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: RecordedFuture.DetectionRules.id
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 260,
          "y": 1075
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: a6e735b4-474a-4206-8cbb-c729bff52021
    type: condition
    task:
      id: a6e735b4-474a-4206-8cbb-c729bff52021
      version: -1
      name: IoCs Returned?
      description: Were IoCs returned for the threat actor?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: RecordedFuture.Links.links
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 807.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: a7cf5f80-ac05-4cd9-881e-859bfb41fd76
    type: regular
    task:
      id: a7cf5f80-ac05-4cd9-881e-859bfb41fd76
      version: -1
      name: Download Detection Rules Manually
      description: Utilize the Recorded Future portal to download any detection rules found.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 260,
          "y": 1345
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 54acb585-d715-4d0b-88bf-1ea8848b3f88
    type: title
    task:
      id: 54acb585-d715-4d0b-88bf-1ea8848b3f88
      version: -1
      name: Done
      description: Post detection to collective insight
      type: title
      iscommand: false
      brand: Recorded Future v2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 807.5,
          "y": 1565
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 5723c0e2-d186-40e5-8bd5-d56479395f6e
    type: condition
    task:
      id: 5723c0e2-d186-40e5-8bd5-d56479395f6e
      version: -1
      name: Is SIEM enabled?
      description: Checks if there is an active instance of Splunk or QRadar enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      qradar:
      - "26"
      splunk:
      - "11"
    separatecontext: false
    conditions:
    - label: splunk
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Splunk
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          right:
            value: {}
    - label: qradar
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1262.5,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 25aa6fb9-6529-4575-8371-8c390455012e
    type: playbook
    task:
      id: 25aa6fb9-6529-4575-8371-8c390455012e
      version: -1
      name: Splunk Indicator Hunting
      description: This playbook queries Splunk for indicators such as file hashes, IP addresses, domains, or urls. It outputs detected users, ip addresses, and hostnames related to the indicators.
      playbookName: Splunk Indicator Hunting
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 872.5,
          "y": 1320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    scriptarguments:
      IPAddress:
        complex:
          root: ExtractedIndicators
          accessor: IP
      IndexName:
        simple: '*'
      MD5:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "32"
      SHA1:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "40"
      SHA256:
        complex:
          root: ExtractedIndicators
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "64"
          accessor: File
      SelectFields:
        simple: source,timestamp
      URLDomain:
        complex:
          root: ExtractedIndicators
          accessor: Domain
      earliest_time:
        simple: -1d
      event_limit:
        simple: "100"
  "15":
    id: "15"
    taskid: cbc77fcb-3070-46ee-8955-3d4d2fee8069
    type: regular
    task:
      id: cbc77fcb-3070-46ee-8955-3d4d2fee8069
      version: -1
      name: Detection Rules Search
      description: Search detection rules.
      script: Recorded Future v2|||recordedfuture-detection-rules
      type: regular
      iscommand: true
      brand: Recorded Future v2
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      entity_id:
        complex:
          root: RecordedFuture.Links.entity
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 260,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerror: true
  "20":
    id: "20"
    taskid: 38ddcab4-52a3-40c7-814d-d575a6a6058f
    type: title
    task:
      id: 38ddcab4-52a3-40c7-814d-d575a6a6058f
      version: -1
      name: Enrich Threat Actor
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 807.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: f6809841-9522-4670-88c7-288cd4195f59
    type: title
    task:
      id: f6809841-9522-4670-88c7-288cd4195f59
      version: -1
      name: Look For Detection Rules
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 260,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 74075289-0069-4213-8ebf-8a8582f5b050
    type: title
    task:
      id: 74075289-0069-4213-8ebf-8a8582f5b050
      version: -1
      name: Hunt Related IoCs
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1262.5,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 77f210d3-8f9e-46ab-899a-42f86aaaf632
    type: regular
    task:
      id: 77f210d3-8f9e-46ab-899a-42f86aaaf632
      version: -1
      name: Hunt Indicators Manually
      description: Review the indicators and initiate a manual investigation.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1660,
          "y": 1320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 7aabdcb7-1c4a-40c5-8edf-0fb230d0e86d
    type: regular
    task:
      id: 7aabdcb7-1c4a-40c5-8edf-0fb230d0e86d
      version: -1
      name: Extract Links
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      text:
        complex:
          root: RecordedFuture.Links
          accessor: links
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1262.5,
          "y": 735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 5e4a56e0-974d-4aa3-8f87-4f01107f13dd
    type: playbook
    task:
      id: 5e4a56e0-974d-4aa3-8f87-4f01107f13dd
      version: -1
      name: QRadar Indicator Hunting V2
      description: 'The Playbook queries QRadar SIEM for indicators such as file hashes, IP addresses, domains, or urls. '
      playbookName: QRadar Indicator Hunting V2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1262.5,
          "y": 1320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    scriptarguments:
      IPAddress:
        complex:
          root: ExtractedIndicators
          accessor: IP
      InvestigationIPFields:
        simple: sourceip,destinationip
      InvestigationUserFields:
        simple: username
      MD5:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "32"
      QradarIPfield:
        simple: sourceip,destinationip
      SHA1:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "40"
      SHA256:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "64"
      TimeFrame:
        simple: LAST 7 DAYS
      URLDomain:
        complex:
          root: ExtractedIndicators
          accessor: Domain
view: |-
  {
    "linkLabelsPosition": {
      "10_11_splunk": 0.63,
      "10_26_qradar": 0.64,
      "3_6_yes": 0.6,
      "4_25_yes": 0.9
    },
    "paper": {
      "dimensions": {
        "height": 1580,
        "width": 1780,
        "x": 260,
        "y": 50
      }
    }
  }
inputs:
- key: threat_actor
  value: {}
  required: false
  description: The threat actor to enrich & hunt indicators for.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.9.0
contentitemexportablefields:
  contentitemfields: {}