id: List Device Events - Chronicle version: -1 name: List Device Events - Chronicle description: |- This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them. Supported integration: - Chronicle - Google SecOps. starttaskid: "0" tasks: "0": id: "0" taskid: 748f07e4-7cd5-4c08-8796-72b986943c39 type: start task: id: 748f07e4-7cd5-4c08-8796-72b986943c39 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "35" separatecontext: false view: |- { "position": { "x": 350, "y": -300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: ec8a3378-eb0b-4177-8146-b5f70dfad165 type: title task: id: ec8a3378-eb0b-4177-8146-b5f70dfad165 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 350, "y": 1530 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 8ec83674-1d65-4f01-806e-1cef09eb88dd type: condition task: id: 8ec83674-1d65-4f01-806e-1cef09eb88dd version: -1 name: Is there a hostname associated with the ChronicleAsset? description: Checks if there is a hostname associated with the ChronicleAsset. type: condition iscommand: false brand: "" nexttasks: '#default#': - "12" "yes": - "11" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.chronicleasset_hostname iscontext: true view: |- { "position": { "x": 120, "y": 160 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 9b07f072-9f31-4e06-8dd8-d000158fac31 type: regular task: id: 9b07f072-9f31-4e06-8dd8-d000158fac31 version: -1 name: Get the list of events for the IP address description: Gets the list of events discovered within your enterprise for the specified IP address within the specified time range. script: '|||gcb-list-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "13" scriptarguments: asset_identifier: complex: root: inputs.chronicleasset_ip asset_identifier_type: simple: IP Address preset_time_range: simple: Last 30 days reputationcalc: 3 continueonerror: true separatecontext: false view: |- { "position": { "x": -110, "y": 670 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: ed8d8fa0-3da8-488d-88f3-642745da7e47 type: regular task: id: ed8d8fa0-3da8-488d-88f3-642745da7e47 version: -1 name: Get the list of events for the product ID description: Gets the list of events discovered within your enterprise for the specified product ID within the specified time range. script: '|||gcb-list-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: asset_identifier: complex: root: inputs.chronicleasset_product_id asset_identifier_type: simple: Product ID preset_time_range: simple: Last 30 days reputationcalc: 3 continueonerror: true separatecontext: false view: |- { "position": { "x": -110, "y": 1350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: 164373e3-b86b-4a97-8964-aba5c281f8eb type: regular task: id: 164373e3-b86b-4a97-8964-aba5c281f8eb version: -1 name: Get the list of events for the MAC address description: Gets the list of events discovered within your enterprise for the specified MAC address within the specified time range. script: '|||gcb-list-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "14" scriptarguments: asset_identifier: complex: root: inputs.chronicleasset_mac asset_identifier_type: simple: MAC Address preset_time_range: simple: Last 30 days reputationcalc: 3 continueonerror: true separatecontext: false view: |- { "position": { "x": -110, "y": 1010 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 607fc131-6d40-44d4-80ec-b3ff599e692a type: regular task: id: 607fc131-6d40-44d4-80ec-b3ff599e692a version: -1 name: Get the list of events for the hostname description: Gets the list of events discovered within your enterprise for the specified hostname within the specified time range. script: '|||gcb-list-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "12" scriptarguments: asset_identifier: complex: root: inputs.chronicleasset_hostname asset_identifier_type: simple: Host Name preset_time_range: simple: Last 30 days reputationcalc: 3 continueonerror: true separatecontext: false view: |- { "position": { "x": -110, "y": 330 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: 4b5bc9bf-b67f-40b9-80e2-cecb1546568c type: condition task: id: 4b5bc9bf-b67f-40b9-80e2-cecb1546568c version: -1 name: Is there an IP address associated with the ChronicleAsset? description: Checks if there is an IP address associated with the ChronicleAsset. type: condition iscommand: false brand: "" nexttasks: '#default#': - "13" "yes": - "8" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.chronicleasset_ip iscontext: true view: |- { "position": { "x": 120, "y": 500 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: 7e9310ee-f784-4d99-8a2a-72dc2782515d type: condition task: id: 7e9310ee-f784-4d99-8a2a-72dc2782515d version: -1 name: Is there a MAC address associated with the ChronicleAsset? description: Checks if there is a MAC address associated with the ChronicleAsset. type: condition iscommand: false brand: "" nexttasks: '#default#': - "14" "yes": - "10" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.chronicleasset_mac iscontext: true view: |- { "position": { "x": 120, "y": 840 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: bab568a7-8c26-4fe2-8dd2-9f93c73b7933 type: condition task: id: bab568a7-8c26-4fe2-8dd2-9f93c73b7933 version: -1 name: Is there a product ID associated with the ChronicleAsset? description: Checks if there is a product ID associated with the ChronicleAsset. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "9" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.chronicleasset_product_id iscontext: true view: |- { "position": { "x": 120, "y": 1180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "35": id: "35" taskid: 4ade3d59-7c84-4508-8fb9-39746609d52f type: condition task: id: 4ade3d59-7c84-4508-8fb9-39746609d52f version: -1 name: Is the Chronicle or Google SecOps integration enabled? description: Checks whether there is an active instance of the Chronicle or Google SecOps integration. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "36" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Google Chronicle Backstory - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true right: value: {} - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: GoogleSecOps - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true view: |- { "position": { "x": 350, "y": -170 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "36": id: "36" taskid: 6784ef44-7bb5-46c7-8701-7b03563bc39d type: regular task: id: 6784ef44-7bb5-46c7-8701-7b03563bc39d version: -1 name: Clear the list of events fetched for the previous indicator description: Deletes the "GoogleChronicleBackstory.Events" key from the context to clear the list of events fetched for the previous indicator. scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "5" scriptarguments: key: simple: GoogleChronicleBackstory.Events subplaybook: simple: auto reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 120, "y": 0 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "14_2_#default#": 0.33, "35_2_#default#": 0.11, "5_11_yes": 0.47, "5_12_#default#": 0.42 }, "paper": { "dimensions": { "height": 1895, "width": 840, "x": -110, "y": -300 } } } inputs: - key: chronicleasset_hostname value: {} required: false description: The hostname associated with the ChronicleAsset. playbookInputQuery: - key: chronicleasset_ip value: {} required: false description: The IP address associated with the ChronicleAsset. playbookInputQuery: - key: chronicleasset_mac value: {} required: false description: The MAC address associated with the ChronicleAsset. playbookInputQuery: - key: chronicleasset_product_id value: {} required: false description: The product ID associated with the ChronicleAsset. playbookInputQuery: outputs: - contextPath: GoogleChronicleBackstory.Events description: List of events associated with the ChronicleAsset. type: unknown fromversion: 5.0.0 tests: - No tests (auto formatted)