Threat Hunting - Chronicle

Use this playbook to investigate and remediate suspicious IOC domain matches with recent activity found in the enterprise. This playbook also creates indicators for the entities fetched, as well as investigating and enriching them. Supported Integrations: - Chronicle - Google SecOps - Whois

Google SecOps · 29 tasks · 1 input · 0 outputs

Inputs

  • auto_block_entities — Autoblock the detected suspicious Domain(s) and URL(s). You can set this as 'Yes' or 'No' manually here or you can set it into a custom incident field 'Chronicle Auto Block Entities' using mapping classification from integration configuration.

Commands used

closeInvestigation createNewIndicator domain gcb-assets whois

Flowchart

yes yes Yes yes yes no yes yes Start Start Extract domain from incident details - ExtractDomainFromIOCDomainMatchRes Extract domain from incid... ExtractDomainFromIOCDomainMat... Done Done Get whois information for the Domain - whois Get whois information for... whois Get the list of assets which accessed the suspicious domain - gcb-assets Get the list of assets wh... gcb-assets Manually review the fetched entities for blocking Manually review the fetch... Close investigation - closeInvestigation Close investigation closeInvestigation Create domain indicator - createNewIndicator Create domain indicator createNewIndicator PAN-OS - Block Domain - External Dynamic List - PAN-OS - Block Domain - External Dynamic List PAN-OS - Block Domain - E... PAN-OS - Block Domain - Exter... Is the user willing to block the entities? Is the user willing to bl... Create ChronicleAsset for sightings - createNewIndicator Create ChronicleAsset for... createNewIndicator Is Asset found? Is Asset found? Calculate reputation of the domain - domain Calculate reputation of t... domain Create URL indicators - Print Create URL indicators Print Is Chronicle integration enabled? Is Chronicle integration ... Is Whois integration enabled? Is Whois integration enab... Is Chronicle Auto Block Entities field set to "Yes" or "No"? Is Chronicle Auto Block E... Block URL - Generic - Block URL - Generic Block URL - Generic Block URL - Generic IP Enrichment - Generic v2 - IP Enrichment - Generic v2 IP Enrichment - Generic v2 IP Enrichment - Generic v2 Endpoint Enrichment - Generic v2.1 - Endpoint Enrichment - Generic v2.1 Endpoint Enrichment - Gen... Endpoint Enrichment - Generic... Domain Enrichment - Generic v2 - Domain Enrichment - Generic v2 Domain Enrichment - Gener... Domain Enrichment - Generic v2 URL Enrichment - Generic v2 - URL Enrichment - Generic v2 URL Enrichment - Generic v2 URL Enrichment - Generic v2 Extract Domain and perform enrichment Extract Domain and perfor... Convert Domain to URLs and perform enrichment Convert Domain to URLs an... Fetch assets that accessed the Domain and perform enrichment Fetch assets that accesse... Fetch Whois information for the Domain Fetch Whois information f... Block the suspicious Domain and URLs Block the suspicious Doma... Convert Domain to URLs - ConvertDomainToURLs Convert Domain to URLs ConvertDomainToURLs Collect all asset identifiers - ChronicleAssetIdentifierScript Collect all asset identif... ChronicleAssetIdentifierScript