Uptycs - Outbound Connection to Threat IOC Incident

Get information about connections from IOC incidents.

Uptycs · 18 tasks · 2 inputs · 7 outputs

Inputs

  • alert_id — Unique Uptycs ID for a particular alert
  • alert_time — Time the alert was fired

Outputs

  • Uptycs.ProcEvent.pid — pid for the process
  • Uptycs.ProcEvent.upt_time — time that the process was spawned
  • Uptycs.ParentEvent.pid — pid of the process (this is the same number as the input argument 'parent')
  • Uptycs.ParentEvent.upt_time — time that the process was spawned
  • Uptycs.Children.pid — pid of a child process
  • Uptycs.Children.upt_add_time — time that the process was spawned
  • Uptycs.Children.upt_remove_time — time that the process was removed

Commands used

uptycs-get-alerts uptycs-get-parent-event-information uptycs-get-parent-information uptycs-get-process-child-processes uptycs-get-process-event-information uptycs-get-socket-events

Flowchart

yes yes yes Start Start Get Bad IP alert - uptycs-get-alerts Get Bad IP alert uptycs-get-alerts Get process Info - uptycs-get-process-event-information Get process Info uptycs-get-process-event-info... Get child processes - uptycs-get-process-child-processes Get child processes uptycs-get-process-child-proc... Get information about the connection that was opened - uptycs-get-socket-events Get information about the... uptycs-get-socket-events Get parent event info - uptycs-get-parent-event-information Get parent event info uptycs-get-parent-event-infor... Rows in parent_events? Rows in parent_events? Get parent info - uptycs-get-parent-information Get parent info uptycs-get-parent-information Get child processes - uptycs-get-process-child-processes Get child processes uptycs-get-process-child-proc... Done Done Any open connections? Any open connections? Gather Evidence - AddEvidence Gather Evidence AddEvidence Gather Evidence - AddEvidence Gather Evidence AddEvidence Gather Evidence - AddEvidence Gather Evidence AddEvidence Gather Evidence - AddEvidence Gather Evidence AddEvidence Gather Evidence - AddEvidence Gather Evidence AddEvidence Gather Evidence - AddEvidence Gather Evidence AddEvidence Rows in parent_events? Rows in parent_events?