id: Endpoint Investigation Plan version: -1 contentitemexportablefields: contentitemfields: {} name: Endpoint Investigation Plan description: "This playbook handles all the endpoint investigation actions by performing the following tasks on every alert associated with the incident:\n* Pre-defined MITRE Tactics\n* Host fields (Host ID)\n* Attacker fields (Attacker IP, External host)\n* MITRE techniques\n* File hash (currently, the playbook supports only SHA256) \n\nNote: The playbook inputs enable manipulating the execution flow; read the input descriptions for details." starttaskid: "0" tasks: "0": id: "0" taskid: 26771da9-59e7-422f-8f4b-5c08be96bdfa type: start task: id: 26771da9-59e7-422f-8f4b-5c08be96bdfa version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "50" - "51" separatecontext: false view: |- { "position": { "x": 880, "y": -1090 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: 81e61b1f-bd6c-4751-856d-c11bdd35354f type: condition task: id: 81e61b1f-bd6c-4751-856d-c11bdd35354f version: -1 name: Should hunt for Discovery techniques? description: Whether to hunt for discovery techniques. type: condition iscommand: false brand: "" nexttasks: '#default#': - "7" "yes": - "20" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntDiscoveryTechniques iscontext: true right: value: simple: "True" view: |- { "position": { "x": 450, "y": 2070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: 26f1e9ec-dddf-454a-8d1c-e770f7a0a4d7 type: condition task: id: 26f1e9ec-dddf-454a-8d1c-e770f7a0a4d7 version: -1 name: Should hunt for Persistence techniques? description: Whether to hunt for persistence techniques. type: condition iscommand: false brand: "" nexttasks: '#default#': - "4" "yes": - "14" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntPersistenceTechniques iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 450, "y": 650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: 6631c326-a3b2-4bf9-859e-e7718e61eb1e type: condition task: id: 6631c326-a3b2-4bf9-859e-e7718e61eb1e version: -1 name: Should hunt for Initial Access techniques? description: Whether to hunt for initial access techniques. type: condition iscommand: false brand: "" nexttasks: '#default#': - "6" "yes": - "16" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntInitialAccessTechniques iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 450, "y": -290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: 018c1cab-9901-43fa-8995-ee0325036bcb type: condition task: id: 018c1cab-9901-43fa-8995-ee0325036bcb version: -1 name: Should hunt for Privilege Escalation techniques? description: Whether to hunt for privilege escalation techniques. type: condition iscommand: false brand: "" nexttasks: '#default#': - "5" "yes": - "18" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntPrivilegeEscalationTechniques iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 450, "y": 1120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: baa1e20f-4b89-4ef2-86e4-2eaf12d733c2 type: condition task: id: baa1e20f-4b89-4ef2-86e4-2eaf12d733c2 version: -1 name: Should hunt for Defense Evasion techniques? description: Whether to hunt for defense evasion techniques. type: condition iscommand: false brand: "" nexttasks: '#default#': - "1" "yes": - "19" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntDefenseEvasionTechniques iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 450, "y": 1590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 6daefce0-8773-4e2b-84c0-c298adf12464 type: condition task: id: 6daefce0-8773-4e2b-84c0-c298adf12464 version: -1 name: Should hunt for Execution techniques? description: Whether to hunt for execution techniques. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "17" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntExecutionTechniques iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 450, "y": 180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: b0f80114-76f0-4a92-8e6c-b74f4ee31de6 type: condition task: id: b0f80114-76f0-4a92-8e6c-b74f4ee31de6 version: -1 name: Should hunt for Lateral Movement techniques? description: Whether to hunt for lateral movement techniques. type: condition iscommand: false brand: "" nexttasks: '#default#': - "8" "yes": - "21" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntLateralMovementTechniques iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 450, "y": 2550 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 87c3bced-78d4-49ce-83a9-e99b8df241e3 type: condition task: id: 87c3bced-78d4-49ce-83a9-e99b8df241e3 version: -1 name: Should hunt for Collection techniques? description: Whether to hunt for collection techniques. type: condition iscommand: false brand: "" nexttasks: '#default#': - "23" "yes": - "22" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntCollectionTechniques iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 450, "y": 3045 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: 4814aba4-bd30-4c19-895a-8d3e28e73393 type: condition task: id: 4814aba4-bd30-4c19-895a-8d3e28e73393 version: -1 name: Should investigate by attacker source IP? description: Whether to hunt by the attacker indicators. type: condition iscommand: false brand: "" nexttasks: '#default#': - "53" "yes": - "43" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntAttacker iscontext: true right: value: simple: "True" ignorecase: true - - operator: isNotEmpty left: value: complex: root: inputs.attackerRemoteIP iscontext: true view: |- { "position": { "x": 1310, "y": -290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: c896ea76-878a-43f4-80bd-5d5be9f46fc2 type: condition task: id: c896ea76-878a-43f4-80bd-5d5be9f46fc2 version: -1 name: Should hunt by host fields? description: Whether to hunt by the host fields. type: condition iscommand: false brand: "" nexttasks: '#default#': - "9" "yes": - "39" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntByHost iscontext: true right: value: simple: "True" - - operator: isNotEmpty left: value: complex: root: inputs.agentID iscontext: true view: |- { "position": { "x": 1310, "y": -770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 7553edad-1b98-4459-834c-07f66fe82731 type: condition task: id: 7553edad-1b98-4459-834c-07f66fe82731 version: -1 name: Should investigate by MITRE techniques? description: Whether to hunt by MITRE technique. type: condition iscommand: false brand: "" nexttasks: '#default#': - "12" "yes": - "46" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntByTechnique iscontext: true right: value: simple: "True" ignorecase: true - - operator: isNotEmpty left: value: complex: root: inputs.mitreTechniqueID iscontext: true view: |- { "position": { "x": 1310, "y": 670 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: d2a6e731-c4f1-4e1c-8cfe-ff42b7726e8a type: condition task: id: d2a6e731-c4f1-4e1c-8cfe-ff42b7726e8a version: -1 name: Should investigate by file hash? description: Whether to hunt by file hash. type: condition iscommand: false brand: "" nexttasks: '#default#': - "13" "yes": - "48" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntByFile iscontext: true right: value: simple: "True" ignorecase: true - - operator: isNotEmpty left: value: complex: root: inputs.FileSHA256 iscontext: true view: |- { "position": { "x": 1310, "y": 1140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: bd9e01ff-9927-453d-8702-b81c3fe81f0a type: title task: id: bd9e01ff-9927-453d-8702-b81c3fe81f0a version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 1310, "y": 1625 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: aa13b3d0-4124-4586-87d0-a122a811588e type: title task: id: aa13b3d0-4124-4586-87d0-a122a811588e version: -1 name: Persistence type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "15" separatecontext: false view: |- { "position": { "x": 40, "y": 820 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: c171f1d7-1909-4e3e-8e4d-66761315d8d6 type: regular task: id: c171f1d7-1909-4e3e-8e4d-66761315d8d6 version: -1 name: Hunt Persistence techniques description: |- Searches Demisto incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "4" scriptarguments: query: simple: (mitreattcktechnique:*1037* or mitreattcktechnique:*T1542* or mitreattcktechnique:*T1053* or mitreattcktechnique:*T1543.002* or mitreattcktechnique:*T1543.003* or mitreattcktechnique:*T1569.002* or mitreattcktechnique:*T1547.001* or mitreattcktechnique:*T1547.005* or mitreattcktechnique:*T1546.002* or mitreattcktechnique:*T1546.011* or mitreattcktechnique:*T1546.012* or mitreattcktechnique:*T1136* or mitreattcktechnique:*T1150*) and agentid:${inputs.agentID} and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 40, "y": 950 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: 17850962-ee9d-462e-8a68-86992f3476b1 type: title task: id: 17850962-ee9d-462e-8a68-86992f3476b1 version: -1 name: Initial Access type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "30" separatecontext: false view: |- { "position": { "x": 40, "y": -120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: 38d79a1d-432e-4b43-84fb-2df946466f06 type: title task: id: 38d79a1d-432e-4b43-84fb-2df946466f06 version: -1 name: Execution type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "31" separatecontext: false view: |- { "position": { "x": 40, "y": 350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "18": id: "18" taskid: 54aede8a-286a-47f8-8578-da4cd0b042ce type: title task: id: 54aede8a-286a-47f8-8578-da4cd0b042ce version: -1 name: Privilege Escalation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "32" separatecontext: false view: |- { "position": { "x": 40, "y": 1290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: d9287202-7433-4836-8e86-59f0acebaf1b type: title task: id: d9287202-7433-4836-8e86-59f0acebaf1b version: -1 name: Defense Evasion type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "33" separatecontext: false view: |- { "position": { "x": 40, "y": 1760 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "20": id: "20" taskid: bb43e613-8041-41cc-8d6a-031d2ea4bcb6 type: title task: id: bb43e613-8041-41cc-8d6a-031d2ea4bcb6 version: -1 name: Discovery type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "34" separatecontext: false view: |- { "position": { "x": 40, "y": 2240 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: e132947f-bf00-48da-8305-fa34c72c42dc type: title task: id: e132947f-bf00-48da-8305-fa34c72c42dc version: -1 name: Lateral Movement type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "35" separatecontext: false view: |- { "position": { "x": 40, "y": 2720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "22": id: "22" taskid: 7f301311-2cb6-4f0a-8d10-4e8d5f82cea1 type: title task: id: 7f301311-2cb6-4f0a-8d10-4e8d5f82cea1 version: -1 name: Collection type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "36" separatecontext: false view: |- { "position": { "x": 50, "y": 3220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: 1ff80560-73b2-4e6d-8713-fdbddb0c8958 type: condition task: id: 1ff80560-73b2-4e6d-8713-fdbddb0c8958 version: -1 name: Should hunt for CnC techniques? description: Whether to hunt for command and control techniques. type: condition iscommand: false brand: "" nexttasks: '#default#': - "24" "yes": - "25" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntCnCTechniques iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 450, "y": 3530 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: 21f9942f-6dd3-426f-8e9a-eb3ae3a2fb4b type: condition task: id: 21f9942f-6dd3-426f-8e9a-eb3ae3a2fb4b version: -1 name: Should hunt for Impact techniques? description: Whether to hunt for impact techniques. type: condition iscommand: false brand: "" nexttasks: '#default#': - "52" "yes": - "26" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntImpactTechniques iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 450, "y": 4000 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: ff4496b4-e914-4bba-8112-6ed6b4508c79 type: title task: id: ff4496b4-e914-4bba-8112-6ed6b4508c79 version: -1 name: Command and Control type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "37" separatecontext: false view: |- { "position": { "x": 40, "y": 3700 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: c89859a8-0333-4872-8dc7-9feb1fad74fb type: title task: id: c89859a8-0333-4872-8dc7-9feb1fad74fb version: -1 name: Impact type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "38" separatecontext: false view: |- { "position": { "x": 40, "y": 4170 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 9cd16df8-9f8c-4040-81e9-345ffb028daf type: condition task: id: 9cd16df8-9f8c-4040-81e9-345ffb028daf version: -1 name: Should hunt for suspicious Reconnaissance techniques? description: Whether to hunt for reconnaissance techniques. type: condition iscommand: false brand: "" nexttasks: '#default#': - "3" "yes": - "28" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntReconnaissanceTechniques iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 450, "y": -770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: fda5f54d-76eb-4fba-8dd4-7e74b0e9da86 type: title task: id: fda5f54d-76eb-4fba-8dd4-7e74b0e9da86 version: -1 name: Reconnaissance type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "29" separatecontext: false view: |- { "position": { "x": 40, "y": -600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: fe8a2a21-ea37-4a7d-8c9c-156ae13b2c3a type: regular task: id: fe8a2a21-ea37-4a7d-8c9c-156ae13b2c3a version: -1 name: Hunt Reconnaissance techniques description: |- Searches Cortex XSIAM incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: query: simple: mitreattcktechnique:*T1595* and agentid:${inputs.agentID} and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 40, "y": -470 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: fcaf59e8-6da8-4276-8d68-01bbf4b32ad8 type: regular task: id: fcaf59e8-6da8-4276-8d68-01bbf4b32ad8 version: -1 name: Hunt Initial Access techniques description: |- Searches Cortex XSIAM incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "6" scriptarguments: query: simple: (mitreattcktechnique:*T1078* or mitreattcktechnique:*T1078.002*) and agentid:${inputs.agentID} and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 40, "y": 10 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: a9a020af-3724-46e0-8895-d9ac8b8db88a type: regular task: id: a9a020af-3724-46e0-8895-d9ac8b8db88a version: -1 name: Hunt Execution techniques description: |- Searches Demisto incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "2" scriptarguments: query: simple: (mitreattcktechnique:*T1204* or mitreattcktechnique:*T1569.002* or mitreattcktechnique:*T1059.001* or mitreattcktechnique:*T1059.002* or mitreattcktechnique:*T1059.004* or mitreattcktechnique:*T1059.005*) and agentid:${inputs.agentID} and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 40, "y": 480 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: fc87d063-74fb-4c8a-8fbf-59b6f64fbf26 type: regular task: id: fc87d063-74fb-4c8a-8fbf-59b6f64fbf26 version: -1 name: Hunt Privilege Escalation techniques description: |- Searches Demisto incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "5" scriptarguments: query: simple: (mitreattcktechnique:*T1055* or mitreattcktechnique:*T1546.001*) and agentid:${inputs.agentID} and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 40, "y": 1420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: e7403fe7-b8b6-4a35-88d8-d78b140cc703 type: regular task: id: e7403fe7-b8b6-4a35-88d8-d78b140cc703 version: -1 name: Hunt Defense Evasion techniques description: |- Searches Demisto incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "1" scriptarguments: query: simple: (mitreattcktechnique:*T1218.005* or mitreattcktechnique:*T1218.008* or mitreattcktechnique:*T1218.011* or mitreattcktechnique:*T1036* or mitreattcktechnique:*T1140* or mitreattcktechnique:*T1564.001* or mitreattcktechnique:*T1222* or mitreattcktechnique:*T1197*) and agentid:${inputs.agentID} and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 40, "y": 1900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: 9f0fdace-ea0d-4667-80b3-192681279a76 type: regular task: id: 9f0fdace-ea0d-4667-80b3-192681279a76 version: -1 name: Hunt Discovery techniques description: |- Searches Demisto incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "7" scriptarguments: query: simple: (mitreattcktechnique:*1087* or mitreattcktechnique:*1046* or mitreattcktechnique:*1018* or mitreattcktechnique:*1135* or mitreattcktechnique:*1016*) and agentid:${inputs.agentID} and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 40, "y": 2380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "35": id: "35" taskid: e5c9f989-be36-4539-8b14-b452403671a1 type: regular task: id: e5c9f989-be36-4539-8b14-b452403671a1 version: -1 name: Hunt Lateral Movement techniques description: |- Searches Demisto incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: query: simple: (mitreattcktechnique:*1021.001* or mitreattcktechnique:*1021.002* or mitreattcktechnique:*1021.003* or mitreattcktechnique:*1021.006* or mitreattcktechnique:*1021* or mitreattcktechnique:*1550.002*) and agentid:${inputs.agentID} and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 40, "y": 2870 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "36": id: "36" taskid: 4229a499-c399-49db-8be6-e72102760e0a type: regular task: id: 4229a499-c399-49db-8be6-e72102760e0a version: -1 name: Hunt Collection techniques description: |- Searches Demisto incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "23" scriptarguments: query: simple: (mitreattcktechnique:*1213* or mitreattcktechnique:*1074* or mitreattcktechnique:*1074.001*) and agentid:${inputs.agentID} and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 50, "y": 3360 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "37": id: "37" taskid: c31cce38-c1cd-4b87-8ea8-ab7d1962d945 type: regular task: id: c31cce38-c1cd-4b87-8ea8-ab7d1962d945 version: -1 name: Hunt Command and Control techniques description: |- Searches Demisto incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "24" scriptarguments: query: simple: (mitreattcktechnique:*1132* or mitreattcktechnique:*1102* or mitreattcktechnique:*1071*) and agentid:${inputs.agentID} and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 40, "y": 3830 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "38": id: "38" taskid: cb04294c-829c-492d-89f7-3bd67e3031b8 type: regular task: id: cb04294c-829c-492d-89f7-3bd67e3031b8 version: -1 name: Hunt Impact techniques description: |- Searches Demisto incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "52" scriptarguments: query: simple: (mitreattcktechnique:*1561* or mitreattcktechnique:*1485* or mitreattcktechnique:*1486* or mitreattcktechnique:*1490* or mitreattcktechnique:*1495*) and agentid:${inputs.agentID} and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 40, "y": 4310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "39": id: "39" taskid: 790c95cf-af51-440a-8cc6-0d22ec470532 type: title task: id: 790c95cf-af51-440a-8cc6-0d22ec470532 version: -1 name: Host activity type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "41" separatecontext: false view: |- { "position": { "x": 1710, "y": -600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "41": id: "41" taskid: 51eb1abc-7166-45d8-83c0-9829258bb17d type: regular task: id: 51eb1abc-7166-45d8-83c0-9829258bb17d version: -1 name: Hunt by host ID description: |- Searches Demisto incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "9" scriptarguments: query: simple: agentid:${inputs.agentID} and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 1710, "y": -470 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "43": id: "43" taskid: d679a72b-0099-4649-8887-8458fb29b79c type: title task: id: d679a72b-0099-4649-8887-8458fb29b79c version: -1 name: Attacker network activity type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "44" separatecontext: false view: |- { "position": { "x": 1710, "y": -120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "44": id: "44" taskid: 5f2ba1a9-54c3-4c18-8332-31e820dc3238 type: regular task: id: 5f2ba1a9-54c3-4c18-8332-31e820dc3238 version: -1 name: Hunt by attacker source IP description: |- Searches Demisto incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "53" scriptarguments: query: simple: localip:${inputs.attackerRemoteIP} and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 1710, "y": 10 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "46": id: "46" taskid: 710569db-85e4-4d8d-8f63-dd9904d01d04 type: title task: id: 710569db-85e4-4d8d-8f63-dd9904d01d04 version: -1 name: MITRE Techniques type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "47" separatecontext: false view: |- { "position": { "x": 1710, "y": 840 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "47": id: "47" taskid: 90e12387-bcbb-4341-85e2-22f89ede1b50 type: regular task: id: 90e12387-bcbb-4341-85e2-22f89ede1b50 version: -1 name: Hunt by technique ID description: |- Searches Demisto incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "12" scriptarguments: query: simple: mitreattcktechnique:*${inputs.mitreTechniqueID}* and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 1710, "y": 970 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "48": id: "48" taskid: d481827b-144e-4cc6-8dff-92f2293d587e type: title task: id: d481827b-144e-4cc6-8dff-92f2293d587e version: -1 name: Hunt File Hash type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "49" separatecontext: false view: |- { "position": { "x": 1710, "y": 1310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "49": id: "49" taskid: 6a9284a2-6372-48c8-83ef-5588d41fca18 type: regular task: id: 6a9284a2-6372-48c8-83ef-5588d41fca18 version: -1 name: Hunt by file hash description: |- Searches Demisto incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "13" scriptarguments: query: simple: (initiatorsha256:${inputs.FileSHA256} or cgosha256:${inputs.FileSHA256} or filesha256:${inputs.FileSHA256} or filemacrosha256:${inputs.FileSHA256} or osparentsha256:${inputs.FileSHA256}) and caseid:${parentIncidentFields.incident_id} separatecontext: false view: |- { "position": { "x": 1710, "y": 1440 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "50": id: "50" taskid: c224069c-cebb-446b-8dc6-07d9a5a63438 type: title task: id: c224069c-cebb-446b-8dc6-07d9a5a63438 version: -1 name: Hunt by MITRE Tactics type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false view: |- { "position": { "x": 450, "y": -940 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "51": id: "51" taskid: 1b10baff-223f-4a9b-88fc-f6e30e6d0273 type: title task: id: 1b10baff-223f-4a9b-88fc-f6e30e6d0273 version: -1 name: Hunt by Indicators type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "10" separatecontext: false view: |- { "position": { "x": 1310, "y": -940 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "52": id: "52" taskid: f5f485bf-8035-4c97-8529-bc289e584adf type: title task: id: f5f485bf-8035-4c97-8529-bc289e584adf version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 450, "y": 4480 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "53": id: "53" taskid: ea421052-65ec-4e66-81e9-179f1b37c4c3 type: condition task: id: ea421052-65ec-4e66-81e9-179f1b37c4c3 version: -1 name: Should investigate by attacker's external host? description: Whether to hunt by the attacker indicators. type: condition iscommand: false brand: "" nexttasks: '#default#': - "11" "yes": - "54" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.HuntAttacker iscontext: true right: value: simple: "True" ignorecase: true - - operator: isNotEmpty left: value: complex: root: inputs.attackerExternalHost iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "54": id: "54" taskid: 94139bf4-5524-4a4a-8d8e-d3860d4d1054 type: title task: id: 94139bf4-5524-4a4a-8d8e-d3860d4d1054 version: -1 name: Attacker network activity type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "55" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1710, "y": 350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "55": id: "55" taskid: 82c5b670-b168-4827-818e-917e725f93b8 type: regular task: id: 82c5b670-b168-4827-818e-917e725f93b8 version: -1 name: Hunt by attacker source external host description: |- Searches Demisto alerts. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "11" scriptarguments: query: simple: dnsqueryname:${inputs.attackerExternalHost} and caseid:${parentIncidentFields.incident_id} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1710, "y": 490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 5635, "width": 2050, "x": 40, "y": -1090 } } } inputs: - key: HuntReconnaissanceTechniques value: simple: "True" required: false description: Set to True to hunt for identified alerts with MITRE Reconnaissance techniques. playbookInputQuery: - key: HuntInitialAccessTechniques value: simple: "True" required: false description: Set to True to hunt for identified alerts with MITRE Access techniques. playbookInputQuery: - key: HuntExecutionTechniques value: simple: "True" required: false description: Set to True to hunt for identified alerts with MITRE Execution techniques. playbookInputQuery: - key: HuntPersistenceTechniques value: simple: "True" required: false description: Set to True to hunt for identified alerts with MITRE Persistence techniques. playbookInputQuery: - key: HuntPrivilegeEscalationTechniques value: simple: "True" required: false description: Set to True to hunt for identified alerts with MITRE Privilege Escalation techniques. playbookInputQuery: - key: HuntDefenseEvasionTechniques value: simple: "True" required: false description: Set to True to hunt for identified alerts with MITRE Defense Evasion techniques. playbookInputQuery: - key: HuntDiscoveryTechniques value: simple: "True" required: false description: Set to True to hunt for identified alerts with MITRE Discovery techniques. playbookInputQuery: - key: HuntLateralMovementTechniques value: simple: "True" required: false description: Set to True to hunt for identified alerts with MITRE Lateral Movement techniques. playbookInputQuery: - key: HuntCollectionTechniques value: simple: "True" required: false description: Set to True to hunt for MITRE Collection techniques identified alerts. playbookInputQuery: - key: HuntCnCTechniques value: simple: "True" required: false description: Set to True to hunt for identified alerts with MITRE Command and Control techniques. playbookInputQuery: - key: HuntImpactTechniques value: simple: "True" required: false description: Set to True to hunt for identified alerts with MITRE Impact techniques. playbookInputQuery: - key: HuntAttacker value: {} required: false description: Set to True to hunt the attacker IP address or external hostname. playbookInputQuery: - key: HuntByTechnique value: {} required: false description: Set to True to hunt by a specific MITRE technique. playbookInputQuery: - key: HuntByHost value: {} required: false description: Set to True to hunt by the endpoint ID. The agentID input must be provided as well. playbookInputQuery: - key: HuntByFile value: {} required: false description: |- Boolean. Set to True to hunt by a specific file hash. Supports SHA256. playbookInputQuery: - key: agentID value: simple: '*' required: false description: The agent ID. playbookInputQuery: - key: attackerRemoteIP value: {} required: false description: The IP address of the attacker. The 'HuntAttacker' inputs should also be set to True. playbookInputQuery: - key: attackerExternalHost value: {} required: false description: The external host used by the attacker. The 'HuntAttacker' inputs should also be set to True. playbookInputQuery: - key: mitreTechniqueID value: {} required: false description: A MITRE technique identifier. The 'HuntByTechnique' inputs should also be set to True. playbookInputQuery: - key: FileSHA256 value: {} required: false description: The file SHA256. The 'HuntByFile' inputs should also be set to True. playbookInputQuery: outputs: [] tests: - Endpoint Investigation Plan - Test marketplaces: - marketplacev2 - platform - xpanse fromversion: 6.6.0