Uptycs - Bad IP Incident

Get information about processes which open connections to known Bad IP's

Uptycs · 9 tasks · 1 input · 12 outputs

Inputs

  • alert_id — Unique Uptycs ID for a particular alert

Outputs

  • Uptycs.Proc.pid — pid for the process
  • Uptycs.Proc.upt_add_time — time that the process was spawned
  • Uptycs.Proc.upt_remove_time — time that the process was removed
  • Uptycs.Parent.pid — pid of the parent process
  • Uptycs.Parent.upt_add_time — time that the process was spawned
  • Uptycs.Parent.upt_remove_time — time that the process was removed
  • Uptycs.Sockets.local_address — local IP for specified connection
  • Uptycs.Sockets.local_port — local port for specified connection
  • Uptycs.Sockets.remote_port — remote port for specified connection
  • Uptycs.Children.pid — pid of a child process
  • Uptycs.Children.upt_add_time — time that the process was spawned
  • Uptycs.Children.upt_remove_time — time that the process was removed

Commands used

uptycs-get-alerts uptycs-get-parent-information uptycs-get-process-child-processes uptycs-get-process-information uptycs-get-process-open-sockets uptycs-get-threat-indicator uptycs-get-threat-source

Flowchart

Start Start Get Bad IP alert - uptycs-get-alerts Get Bad IP alert uptycs-get-alerts Get process Info - uptycs-get-process-information Get process Info uptycs-get-process-information Get child processes - uptycs-get-process-child-processes Get child processes uptycs-get-process-child-proc... Get information about the connection that was opened - uptycs-get-process-open-sockets Get information about the... uptycs-get-process-open-sockets Get parent info - uptycs-get-parent-information Get parent info uptycs-get-parent-information Get threat indicator info - uptycs-get-threat-indicator Get threat indicator info uptycs-get-threat-indicator Get threat source info - uptycs-get-threat-source Get threat source info uptycs-get-threat-source Done Done