Search Endpoints By Hash - Carbon Black Response V2

Hunt for malicious indicators using Carbon Black

Carbon Black Enterprise Response · 7 tasks · 1 input · 2 outputs

Details

IDSearch Endpoints By Hash - Carbon Black Response V2
From Version5.0.0
Tasks7

README

Hunt for malicious indicators using Carbon Black

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • integration-Carbon_Black_Enterprise_Response

Scripts

This playbook does not use any scripts.

Commands

  • cb-get-processes

Playbook Inputs

Name Description Default Value Required
Hash MD5 Hash File.MD5 Optional

Playbook Outputs

Path Description Type
Endpoint.Hostname The device hostname string
Endpoint The endpoint unknown

Inputs

  • Hash — MD5 Hash

Outputs

  • Endpoint.Hostname — The device hostname
  • Endpoint — The endpoint

Commands used

cb-get-processes

Flowchart

yes yes Start Start Hunt MD5 Hash - cb-get-processes Hunt MD5 Hash cb-get-processes Is Carbon Black enabled? Is Carbon Black enabled? Done Done Is there an MD5 hash to hunt? Is there an MD5 hash to h... Hunt MD5 Hunt MD5 No Integration \ No Hash No Integration \ No Hash

Source

playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_V2.yml
Download History Raw 
id: Search Endpoints By Hash - Carbon Black Response V2
version: -1
name: Search Endpoints By Hash - Carbon Black Response V2
description: Hunt for malicious indicators using Carbon Black
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: edc8b672-13e8-48fa-87c9-594118876ac4
    type: start
    task:
      id: edc8b672-13e8-48fa-87c9-594118876ac4
      version: -1
      name: ""
      description: Playbook start point
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 71c8642a-2af7-4af6-8015-5a2f89fd40d2
    type: regular
    task:
      id: 71c8642a-2af7-4af6-8015-5a2f89fd40d2
      version: -1
      name: Hunt MD5 Hash
      description: Query processes based on given parameters
      script: '|||cb-get-processes'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      facet: {}
      group: {}
      hostname: {}
      md5:
        complex:
          root: inputs
          accessor: Hash
      name: {}
      parent-process-name: {}
      process-path: {}
      query: {}
      rows: {}
      sort: {}
      start: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: a43ea7bf-d5e3-4c0b-8da7-5ce65cc1aae3
    type: condition
    task:
      id: a43ea7bf-d5e3-4c0b-8da7-5ce65cc1aae3
      version: -1
      name: Is Carbon Black enabled?
      description: Is Carbon Black enabled?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "5"
    scriptarguments:
      value:
        simple: ${modules(val.brand == 'carbonblack' && val.state == 'active')}
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: carbonblack-v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 108ba97d-b9da-4162-808d-025b5f6b7986
    type: title
    task:
      id: 108ba97d-b9da-4162-808d-025b5f6b7986
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 00c09fd8-6352-4b6c-8e7a-5a2459544fc7
    type: condition
    task:
      id: 00c09fd8-6352-4b6c-8e7a-5a2459544fc7
      version: -1
      name: Is there an MD5 hash to hunt?
      description: Checks if there is an MD5 hash to hunt.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Hash
            iscontext: true
    view: |-
      {
        "position": {
          "x": 290,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: 4fd8eec7-f7ec-4f53-8473-932db46cc0ec
    type: title
    task:
      id: 4fd8eec7-f7ec-4f53-8473-932db46cc0ec
      version: -1
      name: Hunt MD5
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 863da4aa-ab0b-416b-8072-1f36602773aa
    type: title
    task:
      id: 863da4aa-ab0b-416b-8072-1f36602773aa
      version: -1
      name: No Integration \ No Hash
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "2_5_yes": 0.41,
      "2_7_#default#": 0.42,
      "5_6_yes": 0.47,
      "5_7_#default#": 0.41
    },
    "paper": {
      "dimensions": {
        "height": 880,
        "width": 830,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: Hash
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: MD5 Hash
outputs:
- contextPath: Endpoint.Hostname
  description: The device hostname
  type: string
- contextPath: Endpoint
  description: The endpoint
  type: unknown
fromversion: 5.0.0
tests:
- No tests