id: Illusive-Collect-Forensics-On-Demand version: -1 name: Illusive-Collect-Forensics-On-Demand description: This playbook is used to collect forensics on-demand on any compromised host and retrieve the forensics timeline upon successful collection. starttaskid: "0" tasks: "0": id: "0" taskid: 5c5a46fa-b621-45ab-8b8b-dc78415f2965 type: start task: id: 5c5a46fa-b621-45ab-8b8b-dc78415f2965 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "1" separatecontext: false view: |- { "position": { "x": 440, "y": -160 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "1": id: "1" taskid: 3d5d08b1-8544-487f-8f04-30ed968d8168 type: regular task: id: 3d5d08b1-8544-487f-8f04-30ed968d8168 version: -1 name: illusive-run-forensics-on-demand description: Collect forensics on a specified host and retrieve the forensics timeline. tags: - forensics script: IllusiveNetworks|||illusive-run-forensics-on-demand type: regular iscommand: true brand: IllusiveNetworks nexttasks: '#none#': - "7" scriptarguments: fqdn_or_ip: complex: root: inputs.fqdn_or_ip hostname_or_ip: complex: root: 'inputs.fqdn_or_ip ' separatecontext: false view: |- { "position": { "x": 440, "y": -10 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "2": id: "2" taskid: da5eee43-a8b5-48bc-889a-923df50b909d type: playbook task: id: da5eee43-a8b5-48bc-889a-923df50b909d version: -1 name: GenericPolling playbookName: GenericPolling type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "3" scriptarguments: AdditionalPollingCommandArgNames: {} AdditionalPollingCommandArgValues: {} Ids: complex: root: Illusive accessor: Event.eventId Interval: simple: "1" PollingCommandArgName: simple: event_id PollingCommandName: simple: illusive-get-event-incident-id Timeout: simple: "5" dt: simple: Illusive.Event(val.status != 'Done').eventId separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 440, "y": 360 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "3": id: "3" taskid: 17a4a75a-fba1-4981-8b02-347d75fd10ba type: regular task: id: 17a4a75a-fba1-4981-8b02-347d75fd10ba version: -1 name: illusive-get-event-incident-id description: event_id tags: - forensics script: IllusiveNetworks|||illusive-get-event-incident-id type: regular iscommand: true brand: IllusiveNetworks nexttasks: '#none#': - "4" scriptarguments: event_id: complex: root: Illusive accessor: Event.eventId separatecontext: false view: |- { "position": { "x": 440, "y": 540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "4": id: "4" taskid: d1a6b201-4d05-46f2-8781-daf8c46d9f37 type: playbook task: id: d1a6b201-4d05-46f2-8781-daf8c46d9f37 version: -1 name: GenericPolling playbookName: GenericPolling type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "5" scriptarguments: AdditionalPollingCommandArgNames: {} AdditionalPollingCommandArgValues: {} Ids: complex: root: Illusive accessor: Event.incidentId Interval: simple: "2" PollingCommandArgName: simple: incident_id PollingCommandName: simple: illusive-get-forensics-timeline Timeout: simple: "15" dt: simple: Illusive.Forensics(val.Status != 'Done').IncidentId separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 440, "y": 730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "5": id: "5" taskid: 17e61225-ffe1-4c2f-8f57-f444f9cb0902 type: regular task: id: 17e61225-ffe1-4c2f-8f57-f444f9cb0902 version: -1 name: illusive-get-forensics-timeline description: Retrieve forensics timeline for a specific incident. tags: - forensics script: IllusiveNetworks|||illusive-get-forensics-timeline type: regular iscommand: true brand: IllusiveNetworks nexttasks: '#none#': - "6" scriptarguments: end_date: complex: root: inputs.end_date incident_id: complex: root: Illusive accessor: Event.incidentId start_date: complex: root: inputs.end_date separatecontext: false view: |- { "position": { "x": 440, "y": 910 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "6": id: "6" taskid: 222a72af-c675-4ea4-8719-ce3285fa2900 type: regular task: id: 222a72af-c675-4ea4-8719-ce3285fa2900 version: -1 name: Print Forensics Timeline description: Prints text to the War Room. (Markdown supported.) tags: - forensics scriptName: Print type: regular iscommand: false brand: "" scriptarguments: value: complex: root: Illusive accessor: Forensics.Evidence separatecontext: false view: |- { "position": { "x": 440, "y": 1090 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "7": id: "7" taskid: 6a3cbc0f-98d0-42a1-86ae-0eb43a2c1637 type: regular task: id: 6a3cbc0f-98d0-42a1-86ae-0eb43a2c1637 version: -1 name: Waiter description: Sleep for 5 seconds. Waiting for event creation. scriptName: Sleep type: regular iscommand: false brand: "" nexttasks: '#none#': - "2" scriptarguments: seconds: simple: "5" separatecontext: false view: |- { "position": { "x": 440, "y": 160 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 system: true view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 1345, "width": 380, "x": 440, "y": -160 } } } inputs: - key: fqdn_or_ip value: simple: 172.27.102.12 required: true description: The host FQDN or IP address on which to collect forensics. playbookInputQuery: - key: start_date value: {} required: false description: | The starting date of the forensics timeline. playbookInputQuery: - key: end_date value: {} required: false description: | The last date of the forensics timeline. playbookInputQuery: outputs: - contextPath: Illusive.Forensics.Evidence.details description: The forensics evidence details. - contextPath: Illusive.Forensics.Evidence.eventId description: The event ID. - contextPath: Illusive.Forensics.Evidence.id description: The forensics evidence ID. - contextPath: Illusive.Forensics.Evidence.source description: The evidence source. - contextPath: Illusive.Forensics.Evidence.starred description: Whether the forensics evidence has been starred. - contextPath: Illusive.Forensics.Evidence.time description: 'Date and time of the forensics evidence. ' - contextPath: Illusive.Forensics.Evidence.title description: The forensics evidence description. - contextPath: Illusive.Forensics.IncidentId description: The incident ID. fromversion: 5.0.0 tests: - No tests (auto formatted)