Carbon black Protection Rapid IOC Hunting

Hunt for endpoint activity involving hash and domain IOCs, using Carbon black Protection (Bit9).

Carbon Black Enterprise Protection · 6 tasks · 0 inputs · 0 outputs

Details

ID	`playbook17`
From Version	5.0.0
Tasks	6

README

Hunts for endpoint activity involving hash and domain IOCs, using Carbon black Protection (Bit9).

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

Exists
CBPFindRule
CBPCatalogFindHash

Commands

This playbook does not use any commands.

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Carbon_black_Protection_Rapid_IOC_Hunting

Flowchart

Source

playbook-Carbon_black_Protection_Rapid_IOC_Hunting.yml

Download History Raw

id: playbook17
fromversion: 5.0.0
system: true
version: -1
name: Carbon black Protection Rapid IOC Hunting
description: Hunt for endpoint activity involving hash and domain IOCs, using Carbon black Protection (Bit9).
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a68f66e4-9f00-4be5-82d5-66a604a8e127
    type: start
    task:
      id: a68f66e4-9f00-4be5-82d5-66a604a8e127
      version: -1
      description: ""
      name: start_task
      type: start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: ee3ec982-b1ea-4c96-81d6-6b1ea068cfb4
    type: regular
    task:
      id: ee3ec982-b1ea-4c96-81d6-6b1ea068cfb4
      version: -1
      name: Search observed hashes in the Bit9 file catalog
      description: Searching The Bit9 file catalog for the hashes
      scriptName: CBPCatalogFindHash
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      md5:
        simple: ${File.MD5}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 572
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 0f461a0b-6e31-4537-8b10-564d6c2e0dfa
    type: regular
    task:
      id: 0f461a0b-6e31-4537-8b10-564d6c2e0dfa
      version: -1
      name: Check if the hashes are included in any Bit9 rules
      description: If the hashes have been approved or blocked in the past, they will be in existing rules. It is useful to see whether the hash was in some block list or allow list or a person marked them as such, possibly with a comment explaining their reasons.
      scriptName: CBPFindRule
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      hash:
        simple: ${File.MD5}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 734
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: ec572e1b-78cf-4daf-8185-688d7b04041b
    type: condition
    task:
      id: ec572e1b-78cf-4daf-8185-688d7b04041b
      version: -1
      name: Is CarbonBlack Protection v2 enabled?
      description: Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "12"
    scriptarguments:
      value:
        simple: ${modules(val.brand == 'CarbonBlackProtectionV2' && val.state == 'active')}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: b403c310-7926-4e04-8c81-ce7a9defb5c4
    type: title
    task:
      id: b403c310-7926-4e04-8c81-ce7a9defb5c4
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 902
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 71e0a3f7-355e-41b2-8623-b6a606e9e79f
    type: condition
    task:
      id: 71e0a3f7-355e-41b2-8623-b6a606e9e79f
      version: -1
      name: Do we have files to hunt?
      description: Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "8"
    scriptarguments:
      value:
        simple: ${File.MD5}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 382
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "10_11_#default#": 0.36,
      "12_11_#default#": 0.16
    },
    "paper": {
      "dimensions": {
        "height": 917,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- no test