TIM - Add Bad Hash Indicators To SIEM

This playbook recives indicators from its parent playbook and provides the indicators as inputs for the sub-playbooks that push the indicators to the SIEM.

TIM - SIEM Integration · 9 tasks · 1 input · 0 outputs

Details

ID	`TIM - Add Bad Hash Indicators To SIEM`
From Version	5.5.0
Tasks	9

README

This playbook recives indicators from its parent playbook
and provides the indicators as inputs for the sub-playbooks that push the indicators
to the SIEM.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

TIM - ArcSight Add Bad Hash Indicators
TIM - QRadar Add Bad Hash Indicators

Integrations

ArcSight ESM v2
QRadar

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
Indicator Query	Indicators matching the indicator query will be used as playbook input		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Inputs

Flowchart

Source

playbook-TIM_-_Add_Bad_Hash_Indicators_To_SIEM.yml

Download History Raw

id: TIM - Add Bad Hash Indicators To SIEM
version: -1
fromversion: 5.5.0
name: TIM - Add Bad Hash Indicators To SIEM
description: |-
    This playbook recives indicators from its parent playbook
    and provides the indicators as inputs for the sub-playbooks that push the indicators
    to the SIEM.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 517f74d2-925f-4863-80ea-86169679c6e1
    type: start
    task:
      id: 517f74d2-925f-4863-80ea-86169679c6e1
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 02ca6c27-849b-4617-8e4d-c331f880aa01
    type: title
    task:
      id: 02ca6c27-849b-4617-8e4d-c331f880aa01
      version: -1
      name: QRadar
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 990,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 4741c303-4a1c-4d0c-89c2-86a56850fecf
    type: condition
    task:
      id: 4741c303-4a1c-4d0c-89c2-86a56850fecf
      version: -1
      name: Is Qradar enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar,QRadar_v2,QRadar v3
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 990,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: f50ee87c-3c08-4ccd-8cf3-3a57edef0c0d
    type: title
    task:
      id: f50ee87c-3c08-4ccd-8cf3-3a57edef0c0d
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 32b61116-532f-4dbd-8032-bffb35db18b9
    type: title
    task:
      id: 32b61116-532f-4dbd-8032-bffb35db18b9
      version: -1
      name: ArcSight
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -60,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: ca335c48-b1a6-442e-894a-1230afea250b
    type: condition
    task:
      id: ca335c48-b1a6-442e-894a-1230afea250b
      version: -1
      name: Is ArcSight enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ArcSight ESM v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": -60,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 763fdb99-c58a-4ca3-869b-d95bf50ebadd
    type: condition
    task:
      id: 763fdb99-c58a-4ca3-869b-d95bf50ebadd
      version: -1
      name: Are there Hash results?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "5"
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: File
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.CustomFields.tags
                      iscontext: true
                    right:
                      value:
                        simple: approved_black
                accessor: value
                transformers:
                - operator: uniq
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: e76f1e85-104f-4753-8570-b0ea45244303
    type: playbook
    task:
      id: e76f1e85-104f-4753-8570-b0ea45244303
      version: -1
      name: TIM - ArcSight Add Bad Hash Indicators
      playbookName: TIM - ArcSight Add Bad Hash Indicators
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": -170,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: b0a6de41-61eb-44fe-8463-f891fbe8e875
    type: playbook
    task:
      id: b0a6de41-61eb-44fe-8463-f891fbe8e875
      version: -1
      name: TIM - QRadar Add Bad Hash Indicators
      playbookName: TIM - QRadar Add Bad Hash Indicators
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1075,
        "width": 1650,
        "x": -170,
        "y": -200
      }
    }
  }
inputs:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results: null
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue: null
        fromvalue: null
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
outputs: []
quiet: true
tests:
- No test