SpecterOpsBloodHoundEnterprise

Automated playbook that enriches BloodHound Enterprise attack path incidents with object information and validates attack path existence between security principals.

SpecterOps BloodHound Enterprise · 6 tasks · 0 inputs · 0 outputs

Details

IDSpecterOpsBloodHoundEnterprise
From Version8.9.0
Tasks6

README

Automated playbook that enriches BloodHound Enterprise attack path incidents with object information and validates attack path existence between security principals.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • SpecterOps BloodHound Enterprise

Scripts

This playbook does not use any scripts.

Commands

  • bloodhound-asset-info-get
  • bloodhound-object-id-get
  • bloodhound-path-exist
  • closeInvestigation

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

SpecterOps BloodHound Enterprise

Commands used

bloodhound-asset-info-get bloodhound-object-id-get bloodhound-path-exist closeInvestigation

Flowchart

Start Start bloodhound-object-id-get - bloodhound-object-id-get bloodhound-object-id-get bloodhound-object-id-get closeInvestigation - closeInvestigation closeInvestigation closeInvestigation bloodhound-asset-info-get - bloodhound-asset-info-get bloodhound-asset-info-get bloodhound-asset-info-get bloodhound-path-exist - bloodhound-path-exist bloodhound-path-exist bloodhound-path-exist Done Done

Source

playbook-SpecterOpsBloodHoundEnterprise.yml
Download History Raw 
id: SpecterOpsBloodHoundEnterprise
version: -1
name: SpecterOpsBloodHoundEnterprise
description: Automated playbook that enriches BloodHound Enterprise attack path incidents with object information and validates attack path existence between security principals.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 38708774-9cc2-4cbf-861e-4aa058c56765
    type: start
    task:
      id: 38708774-9cc2-4cbf-861e-4aa058c56765
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: Start of playbook.
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 6c4829bf-cfbd-4f6d-8879-582b79699d5c
    type: regular
    task:
      id: 6c4829bf-cfbd-4f6d-8879-582b79699d5c
      version: -1
      name: bloodhound-object-id-get
      description: Fetches the object ID using the object name.
      script: '|||bloodhound-object-id-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      object_names:
        simple: ${incident.labels.ObjectNames}
      using:
        simple: ${incident.sourceInstance}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 9e967ffb-1733-4441-8c5b-9d9be442cc0e
    type: regular
    task:
      id: 9e967ffb-1733-4441-8c5b-9d9be442cc0e
      version: -1
      name: closeInvestigation
      description: Closes the current incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: dc534344-2e3b-4db4-8fd8-9f68577604c4
    type: regular
    task:
      id: dc534344-2e3b-4db4-8fd8-9f68577604c4
      version: -1
      name: bloodhound-asset-info-get
      description: Fetches asset information using the object ID.
      script: '|||bloodhound-asset-info-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      object_ids:
        simple: ${incident.labels.ObjectIds}
      using:
        simple: ${incident.sourceInstance}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 96e05e9c-58d7-4c49-8dd5-7b53b92c07cf
    type: regular
    task:
      id: 96e05e9c-58d7-4c49-8dd5-7b53b92c07cf
      version: -1
      name: bloodhound-path-exist
      description: Checks if a path exists between the two nodes.
      script: '|||bloodhound-path-exist'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      from_principal:
        simple: ${incident.labels.NonTierZeroPrincipalObjectId}
      to_principal:
        simple: ${incident.labels.ImpactedPrincipalObjectId}
      using:
        simple: ${incident.sourceInstance}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: f8bb8b4e-2c2a-445a-bc6b-e0db93ffab8b
    type: title
    task:
      id: f8bb8b4e-2c2a-445a-bc6b-e0db93ffab8b
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: End of playbook.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1020,
        "width": 380,
        "x": 450,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 8.9.0