Search Endpoints By Hash - Cybereason

Hunt for endpoint activity involving hash, using Cybereason.

Cybereason · 9 tasks · 2 inputs · 1 output

Details

IDSearch Endpoints By Hash - Cybereason
From Version5.0.0
Tasks9

README

Hunt for endpoint activity involving hash, using Cybereason.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • Cybereason

Scripts

This playbook does not use any scripts.

Commands

  • cybereason-query-file

Playbook Inputs

Name Description Default Value Source Required
MD5Hash MD5 Hash MD5 File Optional
SHA1Hash SHA1 Hash SHA1 File Optional

Playbook Outputs

Path Description Type
Endpoint.Hostname Device hostname string
Endpoint The endpoint unknown

Playbook Image

Search Endpoints By Hash - Cybereason

Inputs

  • MD5Hash — MD5 Hash
  • SHA1Hash — SHA1 Hash

Outputs

  • Cybereason.File.Hostname — Device hostname

Commands used

cybereason-query-file

Flowchart

true true true Start Start Are there MD5s to hunt? Are there MD5s to hunt? Are there SHA1s to hunt? Are there SHA1s to hunt? Hunt for devices running MD5 - cybereason-query-file Hunt for devices running MD5 cybereason-query-file Done Done Is Cybereason integration enabled? Is Cybereason integration... Hunt for indicators Hunt for indicators No Integration \ No Hash No Integration \ No Hash Hunt for devices running SHA1 - cybereason-query-file Hunt for devices running ... cybereason-query-file

Source

playbook-Search_Endpoints_By_Hash_-_Cybereason.yml
Download History Raw 
id: Search Endpoints By Hash - Cybereason
version: -1
name: Search Endpoints By Hash - Cybereason
fromversion: 5.0.0
description: Hunt for endpoint activity involving hash, using Cybereason.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 64d3d099-e3f0-45ae-8898-c4530cf996b9
    type: start
    task:
      id: 64d3d099-e3f0-45ae-8898-c4530cf996b9
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '16'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 190,\n    \"y\": -30\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '2':
    id: '2'
    taskid: e26bb151-69eb-4238-80a4-70ded4bc4eb2
    type: condition
    task:
      id: e26bb151-69eb-4238-80a4-70ded4bc4eb2
      version: -1
      name: Are there MD5s to hunt?
      description: Are there MD5s to hunt?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '19'
      yes:
      - '6'
    scriptarguments:
      value:
        complex:
          root: File
          accessor: MD5
    continueonerror: true
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.MD5Hash
            iscontext: true
    view: "{\n  \"position\": {\n    \"x\": -20,\n    \"y\": 500\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '3':
    id: '3'
    taskid: 07721157-8d24-4612-8d7d-118bcf7d450e
    type: condition
    task:
      id: 07721157-8d24-4612-8d7d-118bcf7d450e
      version: -1
      name: Are there SHA1s to hunt?
      description: Are there SHA1s to hunt?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '19'
      yes:
      - '20'
    scriptarguments:
      value:
        complex:
          root: File
          accessor: SHA1
    continueonerror: true
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA1Hash
            iscontext: true
    view: "{\n  \"position\": {\n    \"x\": 400,\n    \"y\": 500\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '6':
    id: '6'
    taskid: b597f784-7966-4eb9-889a-4176205b9b1a
    type: regular
    task:
      id: b597f784-7966-4eb9-889a-4176205b9b1a
      version: -1
      name: Hunt for devices running MD5
      description: Checks if the hash exists on the organization endpoints.
      script: '|||cybereason-query-file'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '15'
    scriptarguments:
      file_hash:
        complex:
          root: inputs.MD5Hash
    reputationcalc: 1
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": -20,\n    \"y\": 725\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '15':
    id: '15'
    taskid: 0be18d12-04e5-4109-89ff-b8f917d9bc38
    type: title
    task:
      id: 0be18d12-04e5-4109-89ff-b8f917d9bc38
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 190,\n    \"y\": 900\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '16':
    id: '16'
    taskid: 1a524ead-5f7f-4705-8412-d95441000400
    type: condition
    task:
      id: 1a524ead-5f7f-4705-8412-d95441000400
      version: -1
      name: Is Cybereason integration enabled?
      description: Is Cybereason integration enabled?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '19'
      yes:
      - '17'
    scriptarguments:
      value:
        complex:
          root: modules
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: modules.brand
                iscontext: true
              right:
                value:
                  simple: FalconHost
          - - operator: isEqualString
              left:
                value:
                  simple: modules.state
                iscontext: true
              right:
                value:
                  simple: active
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cybereason
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: "{\n  \"position\": {\n    \"x\": 190,\n    \"y\": 125\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '17':
    id: '17'
    taskid: 78d65ffe-90ed-4323-83dd-76ac86842582
    type: title
    task:
      id: 78d65ffe-90ed-4323-83dd-76ac86842582
      version: -1
      name: Hunt for indicators
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '3'
      - '2'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 190,\n    \"y\": 350\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '19':
    id: '19'
    taskid: e430b92c-792d-491e-8752-a409d3c26172
    type: title
    task:
      id: e430b92c-792d-491e-8752-a409d3c26172
      version: -1
      name: No Integration \ No Hash
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '15'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": -500,\n    \"y\": 740\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '20':
    id: '20'
    taskid: ead67021-31b1-468d-8bf2-930a38e067f2
    type: regular
    task:
      id: ead67021-31b1-468d-8bf2-930a38e067f2
      version: -1
      name: Hunt for devices running SHA1
      description: Checks if the hash exists on the organization endpoints.
      script: '|||cybereason-query-file'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '15'
    scriptarguments:
      file_hash:
        complex:
          root: inputs.SHA1Hash
    reputationcalc: 1
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 400,\n    \"y\": 725\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
view: "{\n  \"linkLabelsPosition\": {\n    \"16_19_#default#\": 0.1,\n    \"2_19_#default#\"\
  : 0.14,\n    \"2_6_yes\": 0.54,\n    \"3_19_#default#\": 0.1,\n    \"3_20_yes\"\
  : 0.7\n  },\n  \"paper\": {\n    \"dimensions\": {\n      \"height\": 995,\n   \
  \   \"width\": 1280,\n      \"x\": -500,\n      \"y\": -30\n    }\n  }\n}"
inputs:
- key: MD5Hash
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: MD5 Hash
- key: SHA1Hash
  value:
    complex:
      root: File
      accessor: SHA1
  required: false
  description: SHA1 Hash
outputs:
- contextPath: Cybereason.File.Hostname
  description: Device hostname
  type: string
tests:
- No test