id: CrowdStrike Falcon - Search Endpoints By Hash version: -1 fromversion: 6.5.0 name: CrowdStrike Falcon - Search Endpoints By Hash description: "This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. \nThis playbook searches across the organization for other endpoints associated with a specific SHA256/MD5/SHA1 hash." starttaskid: "0" tasks: "0": id: "0" taskid: fdebf4c2-18fa-45ad-8931-a1df035a26d8 type: start task: id: fdebf4c2-18fa-45ad-8931-a1df035a26d8 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "6" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 170, "y": -90 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: 9ce410b8-ddde-4690-8625-2cfab080cd83 type: regular task: id: 9ce410b8-ddde-4690-8625-2cfab080cd83 version: -1 name: Get device ID list by SHA1 description: Returns a list of device IDs that the indicator ran on. script: '|||cs-falcon-device-ran-on' type: regular iscommand: true brand: "" nexttasks: '#none#': - "5" scriptarguments: type: simple: sha1 value: complex: root: inputs.SHA1 transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 830, "y": 950 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: 04610f87-fee9-4de1-8980-1649f61b38d0 type: regular task: id: 04610f87-fee9-4de1-8980-1649f61b38d0 version: -1 name: Count devices in the environment by SHA256 description: The number of hosts that observed the provided IOC. script: '|||cs-falcon-device-count-ioc' type: regular iscommand: true brand: "" nexttasks: '#none#': - "19" scriptarguments: type: simple: sha256 value: complex: root: inputs.FileSha256 transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1240, "y": 580 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: 0204bfc2-fc2d-483c-869b-8f85d0580b31 type: title task: id: 0204bfc2-fc2d-483c-869b-8f85d0580b31 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 170, "y": 1290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: 9b555544-59aa-45db-81b2-a12eb98fc56e type: condition task: id: 9b555544-59aa-45db-81b2-a12eb98fc56e version: -1 name: Should enrich the returned results? description: "If the hash was found on additional hosts the playbook will enrich the endpoint details.\nIn case we provided a host ID and there is no additional endpoints that were found, the playbook will stop and finish without the enrichment." type: condition iscommand: false brand: "" nexttasks: '#default#': - "16" "no": - "3" separatecontext: false conditions: - label: "no" condition: - - operator: lessThanOrEqual left: value: simple: CrowdStrike.IOC.DeviceCount iscontext: true right: value: simple: "1" - operator: isNotExists left: value: simple: CrowdStrike.IOC.DeviceCount iscontext: true - - operator: isNotEmpty left: value: complex: root: inputs.HostId transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs conditionB: {} conditionInBetween: {} else: value: simple: inputs.HostId iscontext: true equals: {} lhs: value: simple: CrowdStrike.IOC.DeviceCount iscontext: true lhsB: {} options: {} optionsB: {} rhs: {} rhsB: {} then: value: simple: 'return empty string' iscontext: true continueonerrortype: "" view: |- { "position": { "x": 420, "y": 760 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: f7a79437-c0fa-4613-84fa-22581196d8ef type: regular task: id: f7a79437-c0fa-4613-84fa-22581196d8ef version: -1 name: Enrich endpoint details for non original host description: Returns information about an endpoint. script: '|||endpoint' type: regular iscommand: true brand: "" nexttasks: '#none#': - "3" scriptarguments: id: complex: root: CrowdStrike.DeviceID filters: - - operator: notInList left: value: simple: CrowdStrike.DeviceID iscontext: true right: value: simple: inputs.HostId iscontext: true transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 830, "y": 1120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 13169d17-92b3-4cbf-8930-86e9b5d6f265 type: condition task: id: 13169d17-92b3-4cbf-8930-86e9b5d6f265 version: -1 name: Is CrowdStrike Falcon enabled? description: Returns 'yes' if the integration brand is available. Otherwise returns 'no'. scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "3" "yes": - "10" - "9" - "8" scriptarguments: brandname: simple: CrowdstrikeFalcon separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 170, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: dbbe5796-a11a-4682-8355-d62b43d44498 type: title task: id: dbbe5796-a11a-4682-8355-d62b43d44498 version: -1 name: SHA256 type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "15" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1240, "y": 250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: 1e898ed2-5266-4f3e-81fa-101c8497e8ab type: title task: id: 1e898ed2-5266-4f3e-81fa-101c8497e8ab version: -1 name: SHA1 type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "14" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 830, "y": 250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: f9e430dd-d528-4fc6-8266-6bb1678b7d57 type: title task: id: f9e430dd-d528-4fc6-8266-6bb1678b7d57 version: -1 name: MD5 type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "13" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 420, "y": 250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: e1e46c37-8e78-40f8-811e-06f7b0cd2294 type: regular task: id: e1e46c37-8e78-40f8-811e-06f7b0cd2294 version: -1 name: Count devices in the environment by SHA1 description: The number of hosts that observed the provided IOC. script: '|||cs-falcon-device-count-ioc' type: regular iscommand: true brand: "" nexttasks: '#none#': - "18" scriptarguments: type: simple: sha1 value: complex: root: inputs.SHA1 transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 830, "y": 580 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: 7a424a6a-334c-412c-843a-863643c14b36 type: regular task: id: 7a424a6a-334c-412c-843a-863643c14b36 version: -1 name: Count devices in the environment by MD5 description: The number of hosts that observed the provided IOC. script: '|||cs-falcon-device-count-ioc' type: regular iscommand: true brand: "" nexttasks: '#none#': - "4" scriptarguments: type: simple: md5 value: complex: root: inputs.MD5 transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 420, "y": 580 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: b930b6ef-bb8c-417e-88a8-d5cecabb228d type: condition task: id: b930b6ef-bb8c-417e-88a8-d5cecabb228d version: -1 name: Is there any MD5? description: Are there any MD5 files provided? type: condition iscommand: false brand: "" nexttasks: '#default#': - "3" "yes": - "12" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.MD5 transformers: - operator: uniq iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 420, "y": 390 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: 169383f7-4adc-460a-8cf3-125b8422fecc type: condition task: id: 169383f7-4adc-460a-8cf3-125b8422fecc version: -1 name: Is there any SHA1? description: Are there any SHA1 files provided? type: condition iscommand: false brand: "" nexttasks: '#default#': - "3" "yes": - "11" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.SHA1 transformers: - operator: uniq iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 830, "y": 390 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: 2334a9cf-94c0-4b2c-81fc-90330616c546 type: condition task: id: 2334a9cf-94c0-4b2c-81fc-90330616c546 version: -1 name: Is there any SHA256? description: Are there any SHA256 files provided? type: condition iscommand: false brand: "" nexttasks: '#default#': - "3" "yes": - "2" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.FileSha256 transformers: - operator: uniq iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 1240, "y": 390 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: 88326013-5240-41bd-8987-6452a1d73e3c type: regular task: id: 88326013-5240-41bd-8987-6452a1d73e3c version: -1 name: Get device id list by MD5 description: Returns a list of device IDs that the indicator ran on. script: '|||cs-falcon-device-ran-on' type: regular iscommand: true brand: "" nexttasks: '#none#': - "5" scriptarguments: type: simple: md5 value: complex: root: inputs.MD5 transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 420, "y": 950 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: 89e8a9f8-2b7c-4d41-89e6-06dd3a90561d type: regular task: id: 89e8a9f8-2b7c-4d41-89e6-06dd3a90561d version: -1 name: Get device id list by SHA256 description: Returns a list of device IDs that the indicator ran on. script: '|||cs-falcon-device-ran-on' type: regular iscommand: true brand: "" nexttasks: '#none#': - "5" scriptarguments: type: simple: sha256 value: complex: root: inputs.FileSha256 transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1240, "y": 950 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "18": id: "18" taskid: a69c0320-8da4-4f7d-8c06-e1b3733e544f type: condition task: id: a69c0320-8da4-4f7d-8c06-e1b3733e544f version: -1 name: Should enrich the returned results? description: "If the hash was found on additional hosts the playbook will enrich the endpoint details.\nIn case we provided a host ID and there is no additional endpoints that were found, the playbook will stop and finish without the enrichment." type: condition iscommand: false brand: "" nexttasks: '#default#': - "1" "no": - "3" separatecontext: false conditions: - label: "no" condition: - - operator: lessThanOrEqual left: value: simple: CrowdStrike.IOC.DeviceCount iscontext: true right: value: simple: "1" - operator: isNotExists left: value: simple: CrowdStrike.IOC.DeviceCount iscontext: true - - operator: isNotEmpty left: value: complex: root: inputs.HostId transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs conditionB: {} conditionInBetween: {} else: value: simple: inputs.HostId iscontext: true equals: {} lhs: value: simple: CrowdStrike.IOC.DeviceCount iscontext: true lhsB: {} options: {} optionsB: {} rhs: {} rhsB: {} then: value: simple: 'return empty string' iscontext: true continueonerrortype: "" view: |- { "position": { "x": 830, "y": 760 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: d61e2bb3-62ba-4eaa-850f-e4c4e0ab3342 type: condition task: id: d61e2bb3-62ba-4eaa-850f-e4c4e0ab3342 version: -1 name: Should enrich the returned results? description: "If the hash was found on additional hosts the playbook will enrich the endpoint details.\nIn case we provided a host ID and there is no additional endpoints that were found, the playbook will stop and finish without the enrichment. " type: condition iscommand: false brand: "" nexttasks: '#default#': - "17" "no": - "3" separatecontext: false conditions: - label: "no" condition: - - operator: lessThanOrEqual left: value: simple: CrowdStrike.IOC.DeviceCount iscontext: true right: value: simple: "1" - operator: isNotExists left: value: simple: CrowdStrike.IOC.DeviceCount iscontext: true - - operator: isNotEmpty left: value: complex: root: inputs.HostId transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs conditionB: {} conditionInBetween: {} else: value: simple: inputs.HostId iscontext: true equals: {} lhs: value: simple: CrowdStrike.IOC.DeviceCount iscontext: true lhsB: {} options: {} optionsB: {} rhs: {} rhsB: {} then: value: simple: 'return empty string' iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1240, "y": 760 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "13_12_yes": 0.54, "13_3_#default#": 0.2, "14_11_yes": 0.54, "14_3_#default#": 0.14, "15_2_yes": 0.5, "15_3_#default#": 0.11, "18_3_no": 0.2, "19_3_no": 0.14, "4_3_no": 0.34, "6_10_yes": 0.48, "6_3_#default#": 0.14, "6_8_yes": 0.78, "6_9_yes": 0.68 }, "paper": { "dimensions": { "height": 1445, "width": 1450, "x": 170, "y": -90 } } } inputs: - key: FileSha256 value: {} required: false description: The SHA256 file hash to search for. playbookInputQuery: - key: HostId value: {} required: false description: The ID of the host that originated the detection. playbookInputQuery: - key: SHA1 value: {} required: false description: The SHA1 file hash to search for. playbookInputQuery: - key: MD5 value: {} required: false description: The MD5 file hash to search for. playbookInputQuery: outputs: - contextPath: Endpoint description: Additional hosts that have the hash present. type: string - contextPath: CrowdStrike.IOC.DeviceCount description: The number of devices the IOC ran on. type: number - contextPath: Endpoint.Hostname description: The endpoint's hostname. - contextPath: CrowdStrike.IOC.Type description: The type of the IOC. - contextPath: Endpoint.IPAddress description: The endpoint's IP address or list of IP addresses. - contextPath: CrowdStrike.IOC.Value description: The string representation of the indicator. - contextPath: Endpoint.OS description: The endpoint operation system. - contextPath: Endpoint.Status description: The endpoint status. - contextPath: Endpoint.IsIsolated description: The endpoint isolation status. - contextPath: CrowdStrike.DeviceID description: Device IDs an indicator ran on. tests: - No tests (auto formatted) contentitemexportablefields: contentitemfields: {} system: true marketplaces: - xsoar # Should not appear in marketplacev2