Rapid IOC Hunting Playbook Deprecated Hidden

Deprecated. Use the Hunt File Hash playbook instead. Playbook to quickly react to discovery of new IOCs. Receive a list of IOCs as attached text / csv files, extract IOCs using regular expressions and hunt rapidly across the infrastructure using various integrations. Also supports attaching multiple files.

Deprecated Content (Deprecated) · 12 tasks · 0 inputs · 0 outputs

Flowchart

yes start_task start_task Set up the investigation and acquire IOCs Set up the investigation ... Need to Load data from attached text files? - Exists Need to Load data from at... Exists Extract hashes from text file - ExtractHash Extract hashes from text ... ExtractHash Extract IP address from text file - ExtractIP Extract IP address from t... ExtractIP Hunt Hunt Collect Hashes from incident - ExtractHash Collect Hashes from incident ExtractHash Collect IPs from incident - ExtractIP Collect IPs from incident ExtractIP Load contents of attached textual files - ReadFile Load contents of attached... ReadFile Collect URLs from incident - ExtractURL Collect URLs from incident ExtractURL Analyst work - hunt manually - Print Analyst work - hunt manually Print 49 - Hunt for bad IOCs 49 Hunt for bad IOCs