Sentinel One - Query Endpoints

Runs Query on Endpoints for SHA1 values

SentinelOne · 7 tasks · 3 inputs · 0 outputs

Details

IDSentinel One - Query Endpoints
From Version6.8.0
Tasks7

README

Runs Query on Endpoints for SHA1 values.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

  • SentinelOne-V2
  • SentinelOneEventCollector

Scripts

This playbook does not use any scripts.

Commands

  • sentinelone-create-query
  • sentinelone-get-events

Playbook Inputs

Name Description Default Value Required
sha1 Comma seperated strings of SHA1 hashes.   Optional
interval Frequency that the polling command will run (minutes). 1 Optional
timeout Amount of time to poll before declaring a timeout and resuming the playbook (in minutes). 10 Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Sentinel One - Query Endpoints

Inputs

  • sha1 — Comma seperated strings of SHA1 hashes.
  • interval — Frequency that the polling command will run (minutes).
  • timeout — Amount of time to poll before declaring a timeout and resuming the playbook (in minutes).

Commands used

sentinelone-create-query sentinelone-get-events

Flowchart

yes yes Create SentinelOne Query Create SentinelOne Query Check If Indicator Exist Check If Indicator Exist Create SentinelOne Query - sentinelone-create-query Create SentinelOne Query sentinelone-create-query Done Done Check If QueryID Exist Check If QueryID Exist Get Query Result - sentinelone-get-events Get Query Result sentinelone-get-events GenericPolling - GenericPolling GenericPolling GenericPolling

Source

playbook-Sentinel_One_-_Query_Endpoints.yml
Download History Raw 
id: Sentinel One - Query Endpoints
version: -1
name: Sentinel One - Query Endpoints
description: Runs Query on Endpoints for SHA1 values
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f1b9f6bb-0592-481e-8f2a-26e6bc79ed30
    type: start
    task:
      id: f1b9f6bb-0592-481e-8f2a-26e6bc79ed30
      description: Create SentinelOne Query
      version: -1
      name: Create SentinelOne Query
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: b6254884-d1df-483d-81b3-369578da5c1a
    type: condition
    task:
      id: b6254884-d1df-483d-81b3-369578da5c1a
      description: Check If Indicator Exist
      version: -1
      name: Check If Indicator Exist
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.sha1
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 20b59069-7aeb-4c98-88d1-c2ea99a584d9
    type: regular
    task:
      id: 20b59069-7aeb-4c98-88d1-c2ea99a584d9
      version: -1
      name: Create SentinelOne Query
      description: Runs a Deep Visibility query and returns the queryId. You can use the queryId for all other commands, such as the sentinelone-get-events command.
      script: '|||sentinelone-create-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      from_date:
        complex:
          root: incident
          accessor: created
          transformers:
          - operator: ModifyDateTime
            args:
              variation:
                value:
                  simple: 7 days
          - operator: FormattedDateToEpoch
            args:
              formatter: {}
          - operator: TimeStampToDate
      query:
        simple: TgtFileSha1 in (${inputs.sha1})
      to_date:
        complex:
          root: ${incident
          accessor: created}
          transformers:
          - operator: FormattedDateToEpoch
            args:
              formatter: {}
          - operator: TimeStampToDate
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 700,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 839d1a7c-b6a5-4ae4-84f1-ea40e529db4a
    type: title
    task:
      id: 839d1a7c-b6a5-4ae4-84f1-ea40e529db4a
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: Done
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: f6229f00-2a3c-493c-8503-d145622d0f18
    type: condition
    task:
      id: f6229f00-2a3c-493c-8503-d145622d0f18
      description: Check If QueryID Exist
      version: -1
      name: Check If QueryID Exist
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: SentinelOne.Query.QueryID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 700,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 3ddb3e09-0a61-4a66-8786-8ea5c133c257
    type: regular
    task:
      id: 3ddb3e09-0a61-4a66-8786-8ea5c133c257
      version: -1
      name: Get Query Result
      description: Returns all Deep Visibility events that match the query.
      script: '|||sentinelone-get-events'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      query_id:
        simple: ${SentinelOne.Query.QueryID}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 700,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 298c31ab-785d-4a8f-83bc-035fc9424809
    type: playbook
    task:
      id: 298c31ab-785d-4a8f-83bc-035fc9424809
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      Ids:
        simple: ${SentinelOne.Query.QueryID}
      Interval:
        simple: ${inputs.interval}
      PollingCommandArgName:
        simple: query_id
      PollingCommandName:
        simple: sentinelone-get-dv-query-status
      Timeout:
        simple: ${inputs.timeout}
      dt:
        simple: SentinelOne.Query.Status(val.responseState!=='FINISHED').QueryID
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 700,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1165,
        "width": 630,
        "x": 450,
        "y": 50
      }
    }
  }
inputs:
- key: sha1
  value: {}
  required: false
  description: Comma seperated strings of SHA1 hashes.
  playbookInputQuery:
- key: interval
  value:
    simple: "1"
  required: false
  description: Frequency that the polling command will run (minutes).
  playbookInputQuery:
- key: timeout
  value:
    simple: "10"
  required: false
  description: Amount of time to poll before declaring a timeout and resuming the playbook (in minutes).
  playbookInputQuery:
outputs: []
tests:
- SentinelOne V2.1 - Test
- SentinelOne V2.0 - Test
fromversion: 6.8.0