Splunk Indicator Hunting

This playbook queries Splunk for indicators such as file hashes, IP addresses, domains, or urls. It outputs detected users, ip addresses, and hostnames related to the indicators.

Splunk · 77 tasks · 21 inputs · 5 outputs

Details

IDSplunk Indicator Hunting
From Version5.0.0
Tasks77

README

Queries Splunk for indicators such as file hashes, IP addresses, domains, or urls. It outputs detected users, IP addresses, and hostnames related to the indicators.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • commentsToContext
  • IsIPInRanges
  • SetAndHandleEmpty
  • IsInternalHostName
  • Set

Commands

  • splunk-search

Playbook Inputs

Name Description Default Value Required
MD5 The MD5 hash or an array of hashes for which to search. - Optional
SplunkMD5Field The name of the fields, in Splunk, in which to find the MD5 hash. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter. - Optional
SHA1 The SHA1 hash or an array of hashes on which to search. - Optional
SplunkSHA1Field The name of the fields, in Splunk, in which to find the SHA1 field. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter. - Optional
SHA256 The SHA256 hash or an array of hashes on which to search. - Optional
SplunkSHA256Field The name of the fields, in Splunk, in which to find the SHA256. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter. - Optional
IPAddress The source or destination IP address on which to search. Can be a single address or an array of addresses. - Optional
SplunkIPField The name of the fields, in Splunk, in which to find the IP addresses. You can enter multiple field names using a comma-separated format. For example, sourceip,destinationip. - Optional
URLDomain The domain or URL can be single or an array of domain/urls to search. By default the LIKE clause is used. - Optional
SplunkURLDomainField The name of the fields, in Splunk, in which to find the URL/Domain. If no field is specified, the search uses quick filter. Only one field can be used in this parameter. - Optional
earliest_time The earliest time to search. For example, -7d, -24h. More examples can be found here. For more examples click here. It is recommended to set a limit for the time frame. -1d Optional
latest_time The latest time to search. For example, -6d, -23h. For more examples see here. For even more examples click here It is recommended to set a limit for the time frame. - Optional
event_limit Limits the number of events returned by query. This argument is not mandatory for the command, but is mandatory for the playbook. 100 Required
IPFieldsToReturn The value of the IP address fields to return from Splunk when the specified indicator is found. These values are used as inputs in the setting, IP addresses section. For example, src,src_ip,dst,dst_ip. - Optional
UserFieldsToReturn The value of the username fields to return from Splunk when the specified indicator is found. These values are used as inputs in the setting, user names section. For example, username,src_username,dst_username. - Optional
HostFieldsToReturn The value of the hostname fields to return from Splunk when the specified indicator is found. These values are used as inputs in the setting, host names section. For example, hostname,src_hostname, dst_hostname. - Optional
InternalIPRange A list of internal IP address ranges to check IP addresses against. The list should be provided in CIDR format, separated by commas. An example of a list of ranges could be: 172.16.0.0/12,10.0.0.0/8,192.168.0.0/16. If a list of IP address ranges is not provided, the list provided in the IsIPInRanges script. The known IPv4 private address ranges is used by default. - Optional
IndexName A single Splunk index to use in the search. * Required
SelectFields Use this field to include additional enrichment data for the Splunk query. If you have defined one or more investigation fields, the SelectField should not include those fields. If there are no other investigation fields defined, the SelectField must contain some value. Enter a comma-separated list of field names as they appear in Splunk. * is a valid value, but not recommended since it creates large output. source,timestamp Required
InternalDomainName The organizations internal domain name. This is provided for the script IsInternalHostName that checks if the detected host names are internal or external if the hosts contain the internal domains suffix. For example, demisto.com. If there is more than one domain, use the “ ” character to separate values such as (demisto.com|test.com) Optional
InternalHostRegex This is provided for the script IsInternalHostName that checks if the detected host names are internal or external. if the hosts match the organizations naming convention. For example the host testpc1 will have the following regex w{6}d{1}. - Optional

Playbook Outputs

Path Description Type
Splunk.DetectedUsers The users detected based on the username field in your search. string
Splunk.DetectedInternalIPs THe internal IP addresses detected by your search. string
Splunk.DetectedExternalIPs The external IP addresses detected by your search. string
Splunk.DetectedInternalHosts The internal host names detected based on the fields in your search. string
Splunk.DetectedExternalHosts The external host names detected based on the fields in your search. string

Playbook Image

Splunk_Indicator_Hunting

Inputs

  • MD5 — MD5 hash file or an array of hashes for which to search.
  • SplunkMD5Field — The name of the fields, in Splunk, in which to find the MD5 hash. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter.
  • SHA1 — SHA1 hash file or an array of hashes on which to search.
  • SplunkSHA1Field — The name of the fields, in Splunk, in which to find the SHA1 field. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter.
  • SHA256 — SHA256 hash file or an array of hashes on which to search.
  • SplunkSHA256Field — The name of the fields, in Splunk, in which to find the SHA256. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter.
  • IPAddress — Source or destination IP on which to search. Can be a single address or an array of addresses.
  • SplunkIPField — The name of the fields, in Splunk, in which to find the IP addresses. You can enter multiple field names using a comma-separated format. For example, sourceip,destinationip.
  • URLDomain — Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used.
  • SplunkURLDomainField — The name of the fields, in Splunk, in which to find the URL/Domain. If no field is specified, the search uses quick filter. Only one field can be used in this parameter.
  • earliest_time — Earliest time to search. Examples: -7d -24h More examples https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/Specifytimemodifiersinyoursearch For more examples view https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/SearchTimeModifiers It is recommended to set a limit for the time frame.
  • latest_time — Latest time to search. Examples: -6d -23h More examples https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/Specifytimemodifiersinyoursearch For more examples view https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/SearchTimeModifiers It is recommended to set a limit for the time frame.
  • event_limit — Limit the number of events returned by query. This argument is not mandatory for the command, but is mandatory for the playbook.
  • IPFieldsToReturn — The value of the IP fields to return from Splunk when the specified indicator is found. These values are used as inputs in the Setting IP addresses section. For example, src,src_ip,dst,dst_ip.
  • UserFieldsToReturn — The value of the username fields to return from Splunk when the specified indicator is found. These values are used as inputs in the Setting user names section. For example, username,src_username,dst_username.
  • HostFieldsToReturn — The value of the hostname fields to return from Splunk when the specified indicator is found. These values are used as inputs in the Setting host names section. For example, hostname,src_hostname, dst_hostname.
  • InternalIPRange — A list of internal IP ranges to check IP addresses against. The list should be provided in CIDR format, separated by commas. An example of a list of ranges could be: 172.16.0.0/12,10.0.0.0/8,192.168.0.0/16. If a list of IP ranges is not provided, the list provided in the IsIPInRanges script (the known IPv4 private address ranges) is used by default.
  • IndexName — A single Spunk index to use in the search.
  • SelectFields — Use this field to include additional enrichment data for the Splunk query. If you have defined one or more investigation fields, the SelectField should not include those fields. If there are no other investigation fields defined, the SelectField must contain some value. Enter a comma-separated list of field names as they appear in Splunk. * is valid value, but not recommended since it creates large output.
  • InternalDomainName — The organizations internal domain name. This is provided for the script IsInternalHostName that checks if the detected host names are internal or external if the hosts contain the internal domains suffix. For example demisto.com. If there is more than one domain, use the | character to separate values such as (demisto.com|test.com)
  • InternalHostRegex — This is provided for the script IsInternalHostName that checks if the detected host names are internal or external. if the hosts match the organizations naming convention. For example the host testpc1 will have the following regex \w{6}\d{1}

Outputs

  • Splunk.DetectedUsers — Users detected based on the username field in your search.
  • Splunk.DetectedInternalIPs — Internal IP addresses detected by your search.
  • Splunk.DetectedExternalIPs — External IP addresses detected by your search.
  • Splunk.DetectedInternalHosts — Internal host names detected based on the fields in your search.
  • Splunk.DetectedExternalHosts — External host names detected based on the fields in your search.

Commands used

splunk-search

Flowchart

yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes Start Start Hash Search Hash Search IP Search IP Search Domain/Url Search Domain/Url Search Is there an IP to search? Is there an IP to search? Is there a hash to search? Is there a hash to search? Is there a Domain/Url to search? Is there a Domain/Url to ... Was there a custom domain/url field? Was there a custom domain... Set MD5 to an array - Set Set MD5 to an array Set Was there a custom MD5 field? Was there a custom MD5 fi... Is there an MD5 to search? Is there an MD5 to search? MD5 Search MD5 Search SHA1 Search SHA1 Search Is there a SHA1 hash to search Is there a SHA1 hash to s... Was there a custom SHA1 field? Was there a custom SHA1 f... SHA256 Search SHA256 Search Is there a SHA256 hash to search Is there a SHA256 hash to... Was there a custom SHA256 field? Was there a custom SHA256... Done Searching Done Searching Was there a custom IP field? Was there a custom IP field? Is Splunk enabled? Is Splunk enabled? Splunk search with custom fields - splunk-search Splunk search with custom... splunk-search Splunk search with custom fields - splunk-search Splunk search with custom... splunk-search Splunk search without custom fields - splunk-search Splunk search without cus... splunk-search Splunk search without custom fields - splunk-search Splunk search without cus... splunk-search Splunk search without custom fields - splunk-search Splunk search without cus... splunk-search Splunk search without custom fields - splunk-search Splunk search without cus... splunk-search Splunk search with custom fields - splunk-search Splunk search with custom... splunk-search Splunk search with custom fields - splunk-search Splunk search with custom... splunk-search Splunk search without custom fields - splunk-search Splunk search without cus... splunk-search Splunk query with custom fields Splunk query with custom ... Splunk-free text query Splunk-free text query Splunk query with custom fields Splunk query with custom ... Splunk-free text query Splunk-free text query Splunk query with custom fields Splunk query with custom ... Splunk-free text query Splunk-free text query Splunk query with custom fields Splunk query with custom ... Splunk-free text query Splunk-free text query Splunk-free text query Splunk-free text query Splunk-query with custom fields Splunk-query with custom ... Have results been detected? Have results been detected? Set detected IP addresses - SetAndHandleEmpty Set detected IP addresses SetAndHandleEmpty Set detected user names - SetAndHandleEmpty Set detected user names SetAndHandleEmpty Set detected host names - SetAndHandleEmpty Set detected host names SetAndHandleEmpty Set a SHA1 hash to array - Set Set a SHA1 hash to array Set Set a SHA256 hash to array - Set Set a SHA256 hash to array Set Set an IP address to array - Set Set an IP address to array Set Set DomainUrl to array - Set Set DomainUrl to array Set Sort internal and external IP addresses Sort internal and externa... Are there detected IP addresses? Are there detected IP add... Determine whether the IP address is internal or external - IsIPInRanges Determine whether the IP ... IsIPInRanges Set detected IP addresses as internal - SetAndHandleEmpty Set detected IP addresses... SetAndHandleEmpty Set detected IP addresses as external - SetAndHandleEmpty Set detected IP addresses... SetAndHandleEmpty Done sorting IP addresses Done sorting IP addresses Splunk search with custom fields - splunk-search Splunk search with custom... splunk-search Setting results to outputs Setting results to outputs Are there investigation fields for IP's? Are there investigation f... Are there investigation fields for host names? Are there investigation f... Are there investigation fields for user names? Are there investigation f... Done Done Manually list detected IP addresses Manually list detected IP... Set manual IP addresses - commentsToContext Set manual IP addresses commentsToContext Manually list detected user names Manually list detected us... Set manual user names - commentsToContext Set manual user names commentsToContext Manually list detected host names Manually list detected ho... Set manual host names - commentsToContext Set manual host names commentsToContext Setting user names Setting user names Setting host names Setting host names Setting IP addresses Setting IP addresses Sort internal and external host names Sort internal and externa... Are there detected host names? Are there detected host n... Determine whether the host names are internal or external - IsInternalHostName Determine whether the hos... IsInternalHostName Done sorting host names Done sorting host names Set detected host names as internal - SetAndHandleEmpty Set detected host names a... SetAndHandleEmpty Set detected host names as external - SetAndHandleEmpty Set detected host names a... SetAndHandleEmpty Has the domain name been provided? Has the domain name been ... Set detected host names as internal - SetAndHandleEmpty Set detected host names a... SetAndHandleEmpty

Source

playbook-Splunk_Indicator_Hunting.yml
Download History Raw 
id: Splunk Indicator Hunting
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Splunk Indicator Hunting
description: This playbook queries Splunk for indicators such as file hashes, IP addresses, domains, or urls. It outputs detected users, ip addresses, and hostnames related to the indicators.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 4dbd8b35-00b4-42eb-8b71-43c7b3ca437d
    type: start
    task:
      id: 4dbd8b35-00b4-42eb-8b71-43c7b3ca437d
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "54"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 780,
          "y": -280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "2":
    id: "2"
    taskid: 9dd2e0ca-2b1f-4f73-8bfb-019540e5b2f9
    type: title
    task:
      id: 9dd2e0ca-2b1f-4f73-8bfb-019540e5b2f9
      version: -1
      name: Hash Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -690,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "5":
    id: "5"
    taskid: cece138b-9b8e-4227-8f30-df121b32b2a5
    type: title
    task:
      id: cece138b-9b8e-4227-8f30-df121b32b2a5
      version: -1
      name: IP Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 990,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "6":
    id: "6"
    taskid: 32b954e1-13a3-4ad0-850c-0da6d85df323
    type: title
    task:
      id: 32b954e1-13a3-4ad0-850c-0da6d85df323
      version: -1
      name: Domain/Url Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3230,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "7":
    id: "7"
    taskid: 3b810ab0-fa13-4c0f-843a-8bd9c41f0abd
    type: condition
    task:
      id: 3b810ab0-fa13-4c0f-843a-8bd9c41f0abd
      version: -1
      name: Is there an IP to search?
      description: Checks if IP Addresses were provided.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "48"
      "yes":
      - "50"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.IPAddress
            iscontext: true
    view: |-
      {
        "position": {
          "x": 990,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "8":
    id: "8"
    taskid: 9fe62da8-c3ff-4857-8cbf-107a460b3769
    type: condition
    task:
      id: 9fe62da8-c3ff-4857-8cbf-107a460b3769
      version: -1
      name: Is there a hash to search?
      description: Checks if file hashes were provided.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "48"
      "yes":
      - "26"
      - "27"
      - "38"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.MD5
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA1
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": -690,
          "y": 355
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "9":
    id: "9"
    taskid: 7a980f98-9398-410c-8999-83634bdb290e
    type: condition
    task:
      id: 7a980f98-9398-410c-8999-83634bdb290e
      version: -1
      name: Is there a Domain/Url to search?
      description: Checks if Domains/URLs were provided.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "48"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.URLDomain
            iscontext: true
    view: |-
      {
        "position": {
          "x": 3230,
          "y": 480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "11":
    id: "11"
    taskid: 408b9ad3-8041-4087-8ed6-ca8bff8b8303
    type: condition
    task:
      id: 408b9ad3-8041-4087-8ed6-ca8bff8b8303
      version: -1
      name: Was there a custom domain/url field?
      description: Checks if a custom Domain/URL field was provided.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "89"
      "yes":
      - "90"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SplunkURLDomainField
            iscontext: true
    view: |-
      {
        "position": {
          "x": 3230,
          "y": 970
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "20":
    id: "20"
    taskid: 995c1f61-e31d-419e-8483-f24c474fe032
    type: regular
    task:
      id: 995c1f61-e31d-419e-8483-f24c474fe032
      version: -1
      name: Set MD5 to an array
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "69"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FileMD5
      value:
        complex:
          root: inputs.MD5
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2920,
          "y": 1510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "21":
    id: "21"
    taskid: bb8c1514-4c47-4e3b-8760-3efd46ae9fc5
    type: condition
    task:
      id: bb8c1514-4c47-4e3b-8760-3efd46ae9fc5
      version: -1
      name: Was there a custom MD5 field?
      description: Checks if a custom MD5 field was provided.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "82"
      "yes":
      - "81"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SplunkMD5Field
            iscontext: true
    view: |-
      {
        "position": {
          "x": -2700,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "22":
    id: "22"
    taskid: 79861dce-e4fa-4c6e-857b-7421cc285cdf
    type: condition
    task:
      id: 79861dce-e4fa-4c6e-857b-7421cc285cdf
      version: -1
      name: Is there an MD5 to search?
      description: Checks for file MD5 hashes.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "48"
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": -1900,
          "y": 805
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "26":
    id: "26"
    taskid: c3559eab-0438-4e18-8fa9-779588ef1b2a
    type: title
    task:
      id: c3559eab-0438-4e18-8fa9-779588ef1b2a
      version: -1
      name: MD5 Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1900,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "27":
    id: "27"
    taskid: bb0c3fab-62b6-430e-8b43-28e8270d4274
    type: title
    task:
      id: bb0c3fab-62b6-430e-8b43-28e8270d4274
      version: -1
      name: SHA1 Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "29"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1400,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "29":
    id: "29"
    taskid: 97959f35-e288-4d03-86a0-385efcaebae7
    type: condition
    task:
      id: 97959f35-e288-4d03-86a0-385efcaebae7
      version: -1
      name: Is there a SHA1 hash to search
      description: Checks for file SHA1 hashes.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "48"
      "yes":
      - "31"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA1
            iscontext: true
    view: |-
      {
        "position": {
          "x": -960,
          "y": 805
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "31":
    id: "31"
    taskid: ad012562-482d-466f-855b-691797adad4c
    type: condition
    task:
      id: ad012562-482d-466f-855b-691797adad4c
      version: -1
      name: Was there a custom SHA1 field?
      description: Checks if a custom SHA1 field was provided.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "84"
      "yes":
      - "83"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SplunkSHA1Field
            iscontext: true
    view: |-
      {
        "position": {
          "x": -1400,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "38":
    id: "38"
    taskid: 1d9bf6ee-8637-4da9-8c31-8b368ff5b2f9
    type: title
    task:
      id: 1d9bf6ee-8637-4da9-8c31-8b368ff5b2f9
      version: -1
      name: SHA256 Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "39":
    id: "39"
    taskid: 77b76600-1062-43f7-874e-e51bb764277d
    type: condition
    task:
      id: 77b76600-1062-43f7-874e-e51bb764277d
      version: -1
      name: Is there a SHA256 hash to search
      description: Checks for file SHA256 hashes.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "48"
      "yes":
      - "41"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 360,
          "y": 805
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "41":
    id: "41"
    taskid: d90ad2cb-c6a5-4d2a-8206-76ec8df2058c
    type: condition
    task:
      id: d90ad2cb-c6a5-4d2a-8206-76ec8df2058c
      version: -1
      name: Was there a custom SHA256 field?
      description: Checks if a custom SHA256 field was provided.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "86"
      "yes":
      - "85"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SplunkSHA256Field
            iscontext: true
    view: |-
      {
        "position": {
          "x": -70,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "48":
    id: "48"
    taskid: 2b4d9f60-e913-47bf-816e-177b48d6d69e
    type: title
    task:
      id: 2b4d9f60-e913-47bf-816e-177b48d6d69e
      version: -1
      name: Done Searching
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "107"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 780,
          "y": 2550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "50":
    id: "50"
    taskid: 80cfe8d1-e4fb-4d02-8cff-4552d1417cd4
    type: condition
    task:
      id: 80cfe8d1-e4fb-4d02-8cff-4552d1417cd4
      version: -1
      name: Was there a custom IP field?
      description: Checks if a custom IP Address field was provided.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "88"
      "yes":
      - "87"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SplunkIPField
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "54":
    id: "54"
    taskid: 686ecff8-7171-428e-8c32-f7ef1d729212
    type: condition
    task:
      id: 686ecff8-7171-428e-8c32-f7ef1d729212
      version: -1
      name: Is Splunk enabled?
      description: Checks if SplunkPY integration is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "48"
      "yes":
      - "2"
      - "5"
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: SplunkPy,SplunkPy v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 780,
          "y": -140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "57":
    id: "57"
    taskid: 7596ee18-8727-4dfb-866c-714fd898b7b2
    type: regular
    task:
      id: 7596ee18-8727-4dfb-866c-714fd898b7b2
      version: -1
      name: Splunk search with custom fields
      description: Search Splunk for events using custom fields.
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      earliest_time:
        simple: ${inputs.earliest_time}
      event_limit:
        simple: ${inputs.event_limit}
      latest_time:
        simple: ${inputs.latest_time}
      query:
        complex:
          root: inputs.URLDomain
          transformers:
          - operator: ProductJoin
            args:
              join:
                value:
                  simple: ' *'
              list2:
                value:
                  simple: inputs.SplunkURLDomainField
                iscontext: true
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: $1*
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ')  | table '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.IPFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.UserFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.HostFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' ('
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.IndexName
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: index=
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3010,
          "y": 1885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
    evidencedata:
      description:
        simple: Splunk search results
      customfields: {}
  "64":
    id: "64"
    taskid: b4e5b9eb-0112-4833-8bbf-d4aba5d2df03
    type: regular
    task:
      id: b4e5b9eb-0112-4833-8bbf-d4aba5d2df03
      version: -1
      name: Splunk search with custom fields
      description: Search Splunk for events using custom fields.
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      earliest_time:
        simple: ${inputs.earliest_time}
      event_limit:
        simple: ${inputs.event_limit}
      latest_time:
        simple: ${inputs.latest_time}
      query:
        complex:
          root: inputs.SplunkIPField
          transformers:
          - operator: ProductJoin
            args:
              join:
                value:
                  simple: '='
              list2:
                value:
                  simple: inputs.IPAddress
                iscontext: true
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ')  | table '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.IPFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.UserFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' ('
              suffix: {}
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.HostFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.IndexName
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: index=
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1150,
          "y": 1885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
    evidencedata:
      description:
        simple: Splunk search results
      customfields: {}
  "69":
    id: "69"
    taskid: ce1a0fc1-6855-4037-8532-8ba57c3fedce
    type: regular
    task:
      id: ce1a0fc1-6855-4037-8532-8ba57c3fedce
      version: -1
      name: Splunk search without custom fields
      description: Search Splunk for events without using custom fields.
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      earliest_time:
        simple: ${inputs.earliest_time}
      event_limit:
        simple: ${inputs.event_limit}
      latest_time:
        simple: ${inputs.latest_time}
      query:
        complex:
          root: FileMD5
          transformers:
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ')  | table '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.IPFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.UserFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.HostFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' ('
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.IndexName
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: index=
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2920,
          "y": 1885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
    evidencedata:
      description:
        simple: Splunk search results.
      customfields: {}
  "71":
    id: "71"
    taskid: 751a2763-0efc-44b1-895d-914cd88354de
    type: regular
    task:
      id: 751a2763-0efc-44b1-895d-914cd88354de
      version: -1
      name: Splunk search without custom fields
      description: Searches Splunk for events without using custom fields.
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      earliest_time:
        simple: ${inputs.earliest_time}
      event_limit:
        simple: ${inputs.event_limit}
      latest_time:
        simple: ${inputs.latest_time}
      query:
        complex:
          root: FileSHA1
          transformers:
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ')  | table '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.IPFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.UserFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.HostFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' ('
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.IndexName
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: index=
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1610,
          "y": 1885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
    evidencedata:
      description:
        simple: Splunk search results
      customfields: {}
  "72":
    id: "72"
    taskid: c37977c9-cd6e-4c8a-8f66-d2bd0bfadb35
    type: regular
    task:
      id: c37977c9-cd6e-4c8a-8f66-d2bd0bfadb35
      version: -1
      name: Splunk search without custom fields
      description: Searches Splunk for events without using custom fields.
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      earliest_time:
        simple: ${inputs.earliest_time}
      event_limit:
        simple: ${inputs.event_limit}
      latest_time:
        simple: ${inputs.latest_time}
      query:
        complex:
          root: FileSHA256
          transformers:
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ')  | table '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.IPFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.UserFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.HostFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' ('
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.IndexName
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: index=
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -370,
          "y": 1885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
    evidencedata:
      description:
        simple: Splunk search results
      customfields: {}
  "74":
    id: "74"
    taskid: c4e54ccb-4aba-4081-822e-4eb14578c2e9
    type: regular
    task:
      id: c4e54ccb-4aba-4081-822e-4eb14578c2e9
      version: -1
      name: Splunk search without custom fields
      description: Searches Splunk for events without using custom fields.
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      earliest_time:
        simple: ${inputs.earliest_time}
      event_limit:
        simple: ${inputs.event_limit}
      latest_time:
        simple: ${inputs.latest_time}
      query:
        complex:
          root: DomainURL
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: '*$1*'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ')  | table '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.IPFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.UserFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.HostFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' ('
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.IndexName
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: index=
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3460,
          "y": 1885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
    evidencedata:
      description:
        simple: Splunk search results
      customfields: {}
  "78":
    id: "78"
    taskid: 88048c43-28ad-416f-8231-ad6fbe25995d
    type: regular
    task:
      id: 88048c43-28ad-416f-8231-ad6fbe25995d
      version: -1
      name: Splunk search with custom fields
      description: Searches Splunk for events using custom fields.
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      earliest_time:
        simple: ${inputs.earliest_time}
      event_limit:
        simple: ${inputs.event_limit}
      latest_time:
        simple: ${inputs.latest_time}
      query:
        complex:
          root: inputs.SplunkSHA1Field
          transformers:
          - operator: ProductJoin
            args:
              join:
                value:
                  simple: '='
              list2:
                value:
                  simple: inputs.SHA1
                iscontext: true
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ')  | table '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.IPFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.UserFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.HostFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' ('
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.IndexName
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: index=
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1200,
          "y": 1885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
    evidencedata:
      description:
        simple: Splunk search results
      customfields: {}
  "79":
    id: "79"
    taskid: 496973d6-a6f4-497f-8664-d2b715fc1ac3
    type: regular
    task:
      id: 496973d6-a6f4-497f-8664-d2b715fc1ac3
      version: -1
      name: Splunk search with custom fields
      description: Searches Splunk for events using custom fields.
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      earliest_time:
        simple: ${inputs.earliest_time}
      event_limit:
        simple: ${inputs.event_limit}
      latest_time:
        simple: ${inputs.latest_time}
      query:
        complex:
          root: inputs.SplunkSHA256Field
          transformers:
          - operator: ProductJoin
            args:
              join:
                value:
                  simple: '='
              list2:
                value:
                  simple: inputs.SHA256
                iscontext: true
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ')  | table '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.IPFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.UserFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.HostFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' ('
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.IndexName
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: index=
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 80,
          "y": 1885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
    evidencedata:
      description:
        simple: Splunk search results
      customfields: {}
  "80":
    id: "80"
    taskid: 7d7af565-85c8-4e6d-8684-ef0badadee86
    type: regular
    task:
      id: 7d7af565-85c8-4e6d-8684-ef0badadee86
      version: -1
      name: Splunk search without custom fields
      description: Searches Splunk for events.
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      earliest_time:
        simple: ${inputs.earliest_time}
      event_limit:
        simple: ${inputs.event_limit}
      latest_time:
        simple: ${inputs.latest_time}
      query:
        complex:
          root: IPAddress
          transformers:
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ')  | table '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.IPFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.UserFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.HostFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' ('
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.IndexName
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: index=
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1570,
          "y": 1885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
    evidencedata:
      description:
        simple: Splunk search results
      customfields: {}
  "81":
    id: "81"
    taskid: a460d968-b21e-4560-8904-e91172dd8f50
    type: title
    task:
      id: a460d968-b21e-4560-8904-e91172dd8f50
      version: -1
      name: Splunk query with custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "122"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2490,
          "y": 1320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "82":
    id: "82"
    taskid: 874f982c-7c14-4c4a-80b1-ce0b06fc12c6
    type: title
    task:
      id: 874f982c-7c14-4c4a-80b1-ce0b06fc12c6
      version: -1
      name: Splunk-free text query
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2920,
          "y": 1320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "83":
    id: "83"
    taskid: 78020ff1-a587-4479-8c95-0bb03f9e6ace
    type: title
    task:
      id: 78020ff1-a587-4479-8c95-0bb03f9e6ace
      version: -1
      name: Splunk query with custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "78"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1200,
          "y": 1330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "84":
    id: "84"
    taskid: b77258be-0d37-4adf-8d46-7abcd45ae834
    type: title
    task:
      id: b77258be-0d37-4adf-8d46-7abcd45ae834
      version: -1
      name: Splunk-free text query
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "112"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1610,
          "y": 1330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "85":
    id: "85"
    taskid: 8f2c1cc4-1bc1-4fb8-8f2d-469b6a64646d
    type: title
    task:
      id: 8f2c1cc4-1bc1-4fb8-8f2d-469b6a64646d
      version: -1
      name: Splunk query with custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "79"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 80,
          "y": 1330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "86":
    id: "86"
    taskid: 40e20f5c-d512-4f09-8819-0ff00575e505
    type: title
    task:
      id: 40e20f5c-d512-4f09-8819-0ff00575e505
      version: -1
      name: Splunk-free text query
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "113"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -370,
          "y": 1330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "87":
    id: "87"
    taskid: ae105610-32c4-44ba-8b7f-c9bc3b8be0c1
    type: title
    task:
      id: ae105610-32c4-44ba-8b7f-c9bc3b8be0c1
      version: -1
      name: Splunk query with custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "64"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1150,
          "y": 1330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "88":
    id: "88"
    taskid: 66259488-2ddd-48b9-83d2-3e756291fe8e
    type: title
    task:
      id: 66259488-2ddd-48b9-83d2-3e756291fe8e
      version: -1
      name: Splunk-free text query
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "114"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1570,
          "y": 1330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "89":
    id: "89"
    taskid: 4e260a76-f248-438e-8506-d6a50ef9698a
    type: title
    task:
      id: 4e260a76-f248-438e-8506-d6a50ef9698a
      version: -1
      name: Splunk-free text query
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "115"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3460,
          "y": 1340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "90":
    id: "90"
    taskid: 2f14773a-41a5-4f64-8ba3-d1470884d2f2
    type: title
    task:
      id: 2f14773a-41a5-4f64-8ba3-d1470884d2f2
      version: -1
      name: Splunk-query with custom fields
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "57"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3010,
          "y": 1340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "107":
    id: "107"
    taskid: f0e75230-31e4-47ce-82e4-edfdb8fc643a
    type: condition
    task:
      id: f0e75230-31e4-47ce-82e4-edfdb8fc643a
      version: -1
      name: Have results been detected?
      description: Checks for query results.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "127"
      "yes":
      - "123"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Splunk.Result
            iscontext: true
    view: |-
      {
        "position": {
          "x": 780,
          "y": 2785
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "108":
    id: "108"
    taskid: 83c25e49-c267-4cb0-839a-f76e16bb31ef
    type: regular
    task:
      id: 83c25e49-c267-4cb0-839a-f76e16bb31ef
      version: -1
      name: Set detected IP addresses
      description: Checks if the IP addresses were returned in the search results. If the IP addresses were returned, they are set in Context. Otherwise, no value is set.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "116"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Splunk.DetectedIPs
      value:
        complex:
          root: ${
          accessor: =[]}
          transformers:
          - operator: GetValuesOfMultipleFields
            args:
              key:
                value:
                  simple: Splunk.Result
                iscontext: true
              list:
                value:
                  simple: inputs.IPFieldsToReturn
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2820,
          "y": 3490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "109":
    id: "109"
    taskid: 7a1c9314-ffe0-45d7-8679-a4287c1be666
    type: regular
    task:
      id: 7a1c9314-ffe0-45d7-8679-a4287c1be666
      version: -1
      name: Set detected user names
      description: Checks if the user names were returned in the search results. If the user names were returned, they are set in Context. Otherwise, no value is set.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "127"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Splunk.DetectedUsers
      value:
        complex:
          root: ${
          accessor: =[]}
          transformers:
          - operator: GetValuesOfMultipleFields
            args:
              key:
                value:
                  simple: Splunk.Result
                iscontext: true
              list:
                value:
                  simple: inputs.UserFieldsToReturn
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1050,
          "y": 3460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "110":
    id: "110"
    taskid: 4e7f15e5-94b0-48ed-8d59-063556a3afdc
    type: regular
    task:
      id: 4e7f15e5-94b0-48ed-8d59-063556a3afdc
      version: -1
      name: Set detected host names
      description: Checks if host names were returned in the search results. If host names were returned, they are set in Context. Otherwise, no value is set.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "138"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Splunk.DetectedHosts
      value:
        complex:
          root: ${
          accessor: =[]}
          transformers:
          - operator: GetValuesOfMultipleFields
            args:
              key:
                value:
                  simple: Splunk.Result
                iscontext: true
              list:
                value:
                  simple: inputs.HostFieldsToReturn
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1940,
          "y": 3460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "112":
    id: "112"
    taskid: bae26731-6c85-4c18-88cf-97082ed68410
    type: regular
    task:
      id: bae26731-6c85-4c18-88cf-97082ed68410
      version: -1
      name: Set a SHA1 hash to array
      description: Sets a SHA1 hash value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "71"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FileSHA1
      value:
        complex:
          root: inputs.SHA1
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1610,
          "y": 1510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "113":
    id: "113"
    taskid: 1ebf3a16-3fd7-4e5e-8c0b-0592a517e26c
    type: regular
    task:
      id: 1ebf3a16-3fd7-4e5e-8c0b-0592a517e26c
      version: -1
      name: Set a SHA256 hash to array
      description: Sets a SHA256 hash value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "72"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: FileSHA256
      value:
        complex:
          root: inputs.SHA256
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -370,
          "y": 1510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "114":
    id: "114"
    taskid: 454c062c-5a6b-4445-8f26-cf7adec60d8b
    type: regular
    task:
      id: 454c062c-5a6b-4445-8f26-cf7adec60d8b
      version: -1
      name: Set an IP address to array
      description: Sets a value for an IP address into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "80"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: IPAddress
      value:
        complex:
          root: inputs.IPAddress
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1570,
          "y": 1520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "115":
    id: "115"
    taskid: d969dec2-158b-4b1b-87fd-619ba8c44286
    type: regular
    task:
      id: d969dec2-158b-4b1b-87fd-619ba8c44286
      version: -1
      name: Set DomainUrl to array
      description: Sets a Domain or URL value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "74"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: DomainURL
      value:
        complex:
          root: inputs.URLDomain
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3460,
          "y": 1510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "116":
    id: "116"
    taskid: 94701cbb-3c79-4bd6-8b8e-c4f476d08018
    type: title
    task:
      id: 94701cbb-3c79-4bd6-8b8e-c4f476d08018
      version: -1
      name: Sort internal and external IP addresses
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "117"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3020,
          "y": 3800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "117":
    id: "117"
    taskid: 43f8f37e-2771-4084-8f4d-d8ad4b5cf3c7
    type: condition
    task:
      id: 43f8f37e-2771-4084-8f4d-d8ad4b5cf3c7
      version: -1
      name: Are there detected IP addresses?
      description: Checks for IP Addresses that have been detected.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "121"
      "yes":
      - "118"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Splunk.DetectedIPs
            iscontext: true
    view: |-
      {
        "position": {
          "x": 3020,
          "y": 3930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "118":
    id: "118"
    taskid: e3b8232b-eee8-42b6-8762-c517c65e8d52
    type: regular
    task:
      id: e3b8232b-eee8-42b6-8762-c517c65e8d52
      version: -1
      name: Determine whether the IP address is internal or external
      description: If the IP address is in one of the ranges provided, a yes value is returned. Otherwise, a no is returned.
      scriptName: IsIPInRanges
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "119"
    scriptarguments:
      ip:
        simple: ${Splunk.DetectedIPs}
      ipRanges:
        simple: ${inputs.InternalIPRange}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3290,
          "y": 4165
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "119":
    id: "119"
    taskid: ede48e1d-c9d5-4f4a-8371-7abd66130e62
    type: regular
    task:
      id: ede48e1d-c9d5-4f4a-8371-7abd66130e62
      version: -1
      name: Set detected IP addresses as internal
      description: IP addresses that were found to be internal, are written to the Splunk.DetectedInternalIPs context key.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "120"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Splunk.DetectedInternalIPs
      value:
        complex:
          root: IP
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: IP.InRange
                iscontext: true
              right:
                value:
                  simple: "yes"
          accessor: Address
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3290,
          "y": 4380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "120":
    id: "120"
    taskid: f95fab26-3f29-4fc9-80f2-852af16dc321
    type: regular
    task:
      id: f95fab26-3f29-4fc9-80f2-852af16dc321
      version: -1
      name: Set detected IP addresses as external
      description: IP addresses that were found to be external, are written to the Splunk.DetectedExternalIPs context key.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "121"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Splunk.DetectedExternalIPs
      value:
        complex:
          root: IP
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: IP.InRange
                iscontext: true
              right:
                value:
                  simple: "no"
          accessor: Address
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3290,
          "y": 4610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "121":
    id: "121"
    taskid: 81b349f7-49e5-4ace-8904-191a038cff4d
    type: title
    task:
      id: 81b349f7-49e5-4ace-8904-191a038cff4d
      version: -1
      name: Done sorting IP addresses
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "127"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3030,
          "y": 4860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "122":
    id: "122"
    taskid: ea997c7a-3a29-41fe-8133-737024d9fc59
    type: regular
    task:
      id: ea997c7a-3a29-41fe-8133-737024d9fc59
      version: -1
      name: Splunk search with custom fields
      description: Searches Splunk for events using custom fields.
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      earliest_time:
        simple: ${inputs.earliest_time}
      event_limit:
        simple: ${inputs.event_limit}
      latest_time:
        simple: ${inputs.latest_time}
      query:
        complex:
          root: inputs.SplunkMD5Field
          transformers:
          - operator: ProductJoin
            args:
              join:
                value:
                  simple: '='
              list2:
                value:
                  simple: inputs.MD5
                iscontext: true
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ')  | table '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.IPFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.UserFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.HostFieldsToReturn
                iscontext: true
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' ('
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.IndexName
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: index=
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2490,
          "y": 1885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
    evidencedata:
      description:
        simple: Splunk search results
      customfields: {}
  "123":
    id: "123"
    taskid: eae4ef10-2763-4d01-8a7e-f8dad5db561d
    type: title
    task:
      id: eae4ef10-2763-4d01-8a7e-f8dad5db561d
      version: -1
      name: Setting results to outputs
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "135"
      - "136"
      - "137"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2150,
          "y": 2960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "124":
    id: "124"
    taskid: f88e73b5-b0b9-416e-8d29-f828e02f8a8b
    type: condition
    task:
      id: f88e73b5-b0b9-416e-8d29-f828e02f8a8b
      version: -1
      name: Are there investigation fields for IP's?
      description: Search for investigation fields for IP Addresses.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "129"
      "yes":
      - "108"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.IPFieldsToReturn
            iscontext: true
    view: |-
      {
        "position": {
          "x": 3010,
          "y": 3290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "125":
    id: "125"
    taskid: 053f5f90-6842-4aba-88ad-1269529b1293
    type: condition
    task:
      id: 053f5f90-6842-4aba-88ad-1269529b1293
      version: -1
      name: Are there investigation fields for host names?
      description: Search for investigation fields for Host Names.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "133"
      "yes":
      - "110"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.HostFieldsToReturn
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2150,
          "y": 3290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "126":
    id: "126"
    taskid: cf612468-89a5-460c-83d7-8cc84d04456c
    type: condition
    task:
      id: cf612468-89a5-460c-83d7-8cc84d04456c
      version: -1
      name: Are there investigation fields for user names?
      description: Search for investigation fields for User Names.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "131"
      "yes":
      - "109"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.UserFieldsToReturn
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1260,
          "y": 3290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "127":
    id: "127"
    taskid: 4173da23-64e4-40d5-8f82-41b40b6562fc
    type: title
    task:
      id: 4173da23-64e4-40d5-8f82-41b40b6562fc
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 780,
          "y": 5010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "129":
    id: "129"
    taskid: 9d168d0e-9ca5-4da6-88d2-645d8e99bf1b
    type: regular
    task:
      id: 9d168d0e-9ca5-4da6-88d2-645d8e99bf1b
      version: -1
      name: Manually list detected IP addresses
      description: Provide a list of comma separated IP addresses in the input screen. This task is relevant if you have not entered any values in the IP investigation fields.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "130"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3220,
          "y": 3490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "130":
    id: "130"
    taskid: 55a7a15a-0ed4-4961-8a2d-d40f4eee920f
    type: regular
    task:
      id: 55a7a15a-0ed4-4961-8a2d-d40f4eee920f
      version: -1
      name: Set manual IP addresses
      description: Sets to context the IP addresses provided by the previous task.
      scriptName: commentsToContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "116"
    scriptarguments:
      contextKey:
        simple: Splunk.DetectedIPs
      entryId:
        simple: ${lastCompletedTaskEntries.[0]}
      listSeperator:
        simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3230,
          "y": 3630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "131":
    id: "131"
    taskid: 9d479d9b-8344-4503-8df2-2be1faa6be49
    type: regular
    task:
      id: 9d479d9b-8344-4503-8df2-2be1faa6be49
      version: -1
      name: Manually list detected user names
      description: Provide a list of comma separated user names in the input screen. This task is relevant if you have not entered any values in the user name investigation fields.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "132"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1450,
          "y": 3460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "132":
    id: "132"
    taskid: 691b6764-e453-4369-81a5-57c55d90d09d
    type: regular
    task:
      id: 691b6764-e453-4369-81a5-57c55d90d09d
      version: -1
      name: Set manual user names
      description: Sets to context the user names provided by the previous task.
      scriptName: commentsToContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "127"
    scriptarguments:
      contextKey:
        simple: Splunk.DetectedUsers
      entryId:
        simple: ${lastCompletedTaskEntries.[0]}
      listSeperator:
        simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1450,
          "y": 3610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "133":
    id: "133"
    taskid: cf2b7d98-132d-4903-84bb-3b16f48bdfc8
    type: regular
    task:
      id: cf2b7d98-132d-4903-84bb-3b16f48bdfc8
      version: -1
      name: Manually list detected host names
      description: Provide a list of comma separated host names in the input screen. This task is relevant if you have not entered any values in the host names investigation fields.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "134"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2340,
          "y": 3460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "134":
    id: "134"
    taskid: 4052430e-6fcd-4073-832e-2ef9b2f9016d
    type: regular
    task:
      id: 4052430e-6fcd-4073-832e-2ef9b2f9016d
      version: -1
      name: Set manual host names
      description: Sets to context the host names provided by the previous task.
      scriptName: commentsToContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "138"
    scriptarguments:
      contextKey:
        simple: Splunk.DetectedHosts
      entryId:
        simple: ${lastCompletedTaskEntries.[0]}
      listSeperator:
        simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2340,
          "y": 3600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "135":
    id: "135"
    taskid: 617d2894-f629-4061-8b4c-ec31440f0c7d
    type: title
    task:
      id: 617d2894-f629-4061-8b4c-ec31440f0c7d
      version: -1
      name: Setting user names
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "126"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1260,
          "y": 3160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "136":
    id: "136"
    taskid: 64012f63-5c91-4b23-86f8-3cae9ffc9d17
    type: title
    task:
      id: 64012f63-5c91-4b23-86f8-3cae9ffc9d17
      version: -1
      name: Setting host names
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "125"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2150,
          "y": 3170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "137":
    id: "137"
    taskid: c297e2f5-150f-42c6-8d07-16c920c7b4f7
    type: title
    task:
      id: c297e2f5-150f-42c6-8d07-16c920c7b4f7
      version: -1
      name: Setting IP addresses
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "124"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3010,
          "y": 3160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "138":
    id: "138"
    taskid: c02f7075-e5da-4829-89e9-487a957ef08c
    type: title
    task:
      id: c02f7075-e5da-4829-89e9-487a957ef08c
      version: -1
      name: Sort internal and external host names
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "139"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1940,
          "y": 3810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "139":
    id: "139"
    taskid: afe9c679-5d6b-4ea0-8870-6d034dbfadeb
    type: condition
    task:
      id: afe9c679-5d6b-4ea0-8870-6d034dbfadeb
      version: -1
      name: Are there detected host names?
      description: Checks for Host Names that have been detected.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "141"
      "yes":
      - "144"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Splunk.DetectedHosts
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1940,
          "y": 3930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "140":
    id: "140"
    taskid: dbc3d952-1313-4344-81dc-12d46fda425d
    type: regular
    task:
      id: dbc3d952-1313-4344-81dc-12d46fda425d
      version: -1
      name: Determine whether the host names are internal or external
      description: Returns yes if the host name provided matches the organizations internal nameing convenstion.
      scriptName: IsInternalHostName
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "142"
    scriptarguments:
      domainName:
        simple: 1${inputs.InternalDomainName}
      hostName:
        complex:
          root: Splunk
          accessor: DetectedHosts
      internalRegex:
        simple: ${inputs.InternalHostRegex}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2210,
          "y": 4360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "141":
    id: "141"
    taskid: 1bdf7891-8309-491d-833f-08801905ef93
    type: title
    task:
      id: 1bdf7891-8309-491d-833f-08801905ef93
      version: -1
      name: Done sorting host names
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "127"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1940,
          "y": 4860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "142":
    id: "142"
    taskid: 1459cc81-34e2-46a9-82fc-a3b59ff5723e
    type: regular
    task:
      id: 1459cc81-34e2-46a9-82fc-a3b59ff5723e
      version: -1
      name: Set detected host names as internal
      description: Host names that were found to be internal, are written to the Splunk.DetectedInternalHosts context key.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "143"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Splunk.DetectedInternalHosts
      value:
        complex:
          root: Endpoint
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Endpoint.IsInternal
                iscontext: true
              right:
                value:
                  simple: "true"
          accessor: Hostname
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2210,
          "y": 4515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "143":
    id: "143"
    taskid: c8e6de4d-504c-40c6-8053-4aab8ce6f943
    type: regular
    task:
      id: c8e6de4d-504c-40c6-8053-4aab8ce6f943
      version: -1
      name: Set detected host names as external
      description: Host names that were found to be external, are written to the Splunk.DetectedExternalHosts context key.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "141"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Splunk.DetectedExternalHosts
      value:
        complex:
          root: Endpoint
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Endpoint.IsInternal
                iscontext: true
              right:
                value:
                  simple: "false"
          accessor: Hostname
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2210,
          "y": 4660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "144":
    id: "144"
    taskid: f104fc3c-f2bd-4d75-8a2a-5991ea8962bb
    type: condition
    task:
      id: f104fc3c-f2bd-4d75-8a2a-5991ea8962bb
      version: -1
      name: Has the domain name been provided?
      description: Checks if the internal domain name of the organization was provided.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "145"
      "yes":
      - "140"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.InternalDomainName
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2410,
          "y": 4165
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "145":
    id: "145"
    taskid: 08b05df0-d433-4cab-819a-8a0a708f6cdb
    type: regular
    task:
      id: 08b05df0-d433-4cab-819a-8a0a708f6cdb
      version: -1
      name: Set detected host names as internal
      description: Hostnames that were detected as internal according to the inputs are set to the Splunk.DetectedInternalHosts key. In case the domain name was not provided in the inputs all host names will be set as internal.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "141"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Splunk.DetectedInternalHosts
      value:
        simple: Splunk.DetectedHosts
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2650,
          "y": 4455
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 5355,
        "width": 6760,
        "x": -2920,
        "y": -280
      }
    }
  }
inputs:
- key: MD5
  value: {}
  required: false
  description: MD5 hash file or an array of hashes for which to search.
  playbookInputQuery:
- key: SplunkMD5Field
  value: {}
  required: false
  description: The name of the fields, in Splunk, in which to find the MD5 hash. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter.
  playbookInputQuery:
- key: SHA1
  value: {}
  required: false
  description: SHA1 hash file or an array of hashes on which to search.
  playbookInputQuery:
- key: SplunkSHA1Field
  value: {}
  required: false
  description: The name of the fields, in Splunk, in which to find the SHA1 field. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter.
  playbookInputQuery:
- key: SHA256
  value: {}
  required: false
  description: SHA256 hash file or an array of hashes on which to search.
  playbookInputQuery:
- key: SplunkSHA256Field
  value: {}
  required: false
  description: The name of the fields, in Splunk, in which to find the SHA256. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter.
  playbookInputQuery:
- key: IPAddress
  value: {}
  required: false
  description: |
    Source or destination IP on which to search. Can be a single address or an array of addresses.
  playbookInputQuery:
- key: SplunkIPField
  value: {}
  required: false
  description: The name of the fields, in Splunk, in which to find the IP addresses. You can enter multiple field names using a comma-separated format. For example, sourceip,destinationip.
  playbookInputQuery:
- key: URLDomain
  value: {}
  required: false
  description: |
    Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used.
  playbookInputQuery:
- key: SplunkURLDomainField
  value: {}
  required: false
  description: The name of the fields, in Splunk, in which to find the URL/Domain. If no field is specified, the search uses quick filter. Only one field can be used in this parameter.
  playbookInputQuery:
- key: earliest_time
  value:
    simple: -1d
  required: false
  description: |-
    Earliest time to search.
    Examples:
    -7d
    -24h

    More examples
    https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/Specifytimemodifiersinyoursearch


    For more examples view
    https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/SearchTimeModifiers

    It is recommended to set a limit for the time frame.
  playbookInputQuery:
- key: latest_time
  value: {}
  required: false
  description: |-
    Latest time to search.
    Examples:
    -6d
    -23h

    More examples
    https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/Specifytimemodifiersinyoursearch


    For more examples view
    https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/SearchTimeModifiers

    It is recommended to set a limit for the time frame.
  playbookInputQuery:
- key: event_limit
  value:
    simple: "100"
  required: true
  description: Limit the number of events returned by query. This argument is not mandatory for the command, but is mandatory for the playbook.
  playbookInputQuery:
- key: IPFieldsToReturn
  value: {}
  required: false
  description: The value of the IP fields to return from Splunk when the specified indicator is found. These values are used as inputs in the Setting IP addresses section. For example, src,src_ip,dst,dst_ip.
  playbookInputQuery:
- key: UserFieldsToReturn
  value: {}
  required: false
  description: The value of the username fields to return from Splunk when the specified indicator is found. These values are used as inputs in the Setting user names section. For example, username,src_username,dst_username.
  playbookInputQuery:
- key: HostFieldsToReturn
  value: {}
  required: false
  description: The value of the hostname fields to return from Splunk when the specified indicator is found. These values are used as inputs in the Setting host names section. For example, hostname,src_hostname, dst_hostname.
  playbookInputQuery:
- key: InternalIPRange
  value: {}
  required: false
  description: 'A list of internal IP ranges to check IP addresses against. The list should be provided in CIDR format, separated by commas. An example of a list of ranges could be: 172.16.0.0/12,10.0.0.0/8,192.168.0.0/16. If a list of IP ranges is not provided, the list provided in the IsIPInRanges script (the known IPv4 private address ranges) is used by default.'
  playbookInputQuery:
- key: IndexName
  value:
    simple: '*'
  required: true
  description: A single Spunk index to use in the search.
  playbookInputQuery:
- key: SelectFields
  value:
    simple: source,timestamp
  required: true
  description: Use this field to include additional enrichment data for the Splunk query. If you have defined one or more investigation fields, the SelectField should not include those fields. If there are no other investigation fields defined, the SelectField must contain some value. Enter a comma-separated list of field names as they appear in Splunk. * is valid value, but not recommended since it creates large output.
  playbookInputQuery:
- key: InternalDomainName
  value: {}
  required: false
  description: The organizations internal domain name. This is provided for the script IsInternalHostName that checks if the detected host names are internal or external if the hosts contain the internal domains suffix. For example demisto.com. If there is more than one domain, use the | character to separate values such as (demisto.com|test.com)
  playbookInputQuery:
- key: InternalHostRegex
  value: {}
  required: false
  description: This is provided for the script IsInternalHostName that checks if the detected host names are internal or external. if the hosts match the organizations naming convention. For example the host testpc1 will have the following regex \w{6}\d{1}
  playbookInputQuery:
outputs:
- contextPath: Splunk.DetectedUsers
  description: Users detected based on the username field in your search.
  type: string
- contextPath: Splunk.DetectedInternalIPs
  description: Internal IP addresses detected by your search.
  type: string
- contextPath: Splunk.DetectedExternalIPs
  description: External IP addresses detected by your search.
  type: string
- contextPath: Splunk.DetectedInternalHosts
  description: Internal host names detected based on the fields in your search.
  type: string
- contextPath: Splunk.DetectedExternalHosts
  description: External host names detected based on the fields in your search.
  type: string
tests:
- Splunk-Test
- Splunk Indicator Hunting Test
- SplunkPy-Test-V2
fromversion: 5.0.0
supportedModules:
- agentix
- xsiam
- edr
- cloud
- cloud_runtime_security