SpecterOpsBHE Deprecated

Deprecated. Use the SpecterOpsBloodHoundEnterprise playbook instead. Automated playbook that enriches BloodHound Enterprise attack path incidents with object information and validates attack path existence between security principals.

SpecterOpsBHE (Deprecated) · 5 tasks · 0 inputs · 0 outputs

Details

IDSpecterOpsBHE
From Version6.10.0
Tasks5

README

Automated playbook that enriches BloodHound Enterprise attack path incidents with object information and validates attack path existence between security principals.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • SpecterOpsBHE

Scripts

This playbook does not use any scripts.

Commands

  • bhe-asset-info-get
  • bhe-object-id-get
  • bhe-path-exist
  • closeInvestigation

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

SpecterOpsBHE

Commands used

bhe-asset-info-get bhe-object-id-get bhe-path-exist closeInvestigation

Flowchart

Start Start bhe-object-id-get - bhe-object-id-get bhe-object-id-get bhe-object-id-get closeInvestigation - closeInvestigation closeInvestigation closeInvestigation bhe-asset-info-get - bhe-asset-info-get bhe-asset-info-get bhe-asset-info-get bhe-path-exist - bhe-path-exist bhe-path-exist bhe-path-exist

Source

playbook-SpecterOpsBHE.yml
Download History Raw 
id: SpecterOpsBHE
version: -1
name: SpecterOpsBHE
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 91f1d417-45ec-4aea-82ed-242c08b46898
    type: start
    task:
      id: 91f1d417-45ec-4aea-82ed-242c08b46898
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: a6bf4571-f72b-4659-b0cd-d76fee80d05d
    type: regular
    task:
      id: a6bf4571-f72b-4659-b0cd-d76fee80d05d
      version: -1
      name: bhe-object-id-get
      description: Fetches the object ID using the object name.
      script: SpecterOpsBHE|||bhe-object-id-get
      type: regular
      iscommand: true
      brand: SpecterOpsBHE
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      object_names:
        simple: ${incident.labels.ObjectNames}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: bf6b7e83-2520-4759-86b3-87d622800fa2
    type: regular
    task:
      id: bf6b7e83-2520-4759-86b3-87d622800fa2
      version: -1
      name: closeInvestigation
      description: Closes the current incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 4e231c98-8283-41a3-b785-c889ac1f6c65
    type: regular
    task:
      id: 4e231c98-8283-41a3-b785-c889ac1f6c65
      version: -1
      name: bhe-asset-info-get
      description: Fetches asset information using the object ID.
      script: SpecterOpsBHE|||bhe-asset-info-get
      type: regular
      iscommand: true
      brand: SpecterOpsBHE
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      object_ids:
        simple: ${incident.labels.ObjectIds}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: fb78ab7f-fa7f-4856-a06e-a7e4e43a9e74
    type: regular
    task:
      id: fb78ab7f-fa7f-4856-a06e-a7e4e43a9e74
      version: -1
      name: bhe-path-exist
      description: Checks if a path exists between the two nodes.
      script: SpecterOpsBHE|||bhe-path-exist
      type: regular
      iscommand: true
      brand: SpecterOpsBHE
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      from_principal:
        simple: ${incident.labels.NonTierZeroPrincipalObjectId}
      to_principal:
        simple: ${incident.labels.ImpactedPrincipalObjectId}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 850,
        "width": 380,
        "x": 450,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0
deprecated: true
description: Deprecated. Use the SpecterOpsBloodHoundEnterprise playbook instead. Automated playbook that enriches BloodHound Enterprise attack path incidents with object information and validates attack path existence between security principals.