Search and Compare Process Executions - Generic
This playbook is a generic playbook that receives a process name and a command-line argument. It searches for the given process executions and compares the command-line argument from the results to the command-line argument received from the playbook input. The playbook supports searching process executions using the following integrations: - Cortex XDR XQL Engine - Cortex XDR IR(Search executions inside XDR alerts) - Microsoft Defender For Endpoint Note: Under the "Processes" input, the playbook should receive an array that contains the following keys: - value: *process name* - commands: *command-line arguments*
Common Playbooks · 5 tasks · 4 inputs · 2 outputs
Inputs
Processes— Process name to search and command-line argument to compare. This input should receive an array that contains the following keys: - value: *process name* - commands: *command-line arguments*HuntingTimeFrame— Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.StringSimilarityThreshold— StringSimilarity automation threshold. A number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.SearchXDRAlerts— Set to "True" if you want to hunt for processes that are part of XDR alerts
Outputs
StringSimilarity— StringSimilarity automation results.Findings— Suspicious process executions found.