id: QRadar Indicator Hunting
version: -1
fromversion: 5.0.0
name: QRadar Indicator Hunting
description: Deprecated. Use the "QRadar Indicator Hunting V2" playbook instead.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 7d17f748-2cfe-4bcb-85c8-4bafa54092c0
    type: start
    task:
      id: 7d17f748-2cfe-4bcb-85c8-4bafa54092c0
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '55'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 760,
          "y": -240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '2':
    id: '2'
    taskid: 901ec201-fe71-4f21-8427-aaf146de7771
    type: title
    task:
      id: 901ec201-fe71-4f21-8427-aaf146de7771
      version: -1
      name: Hash Search
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '8'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -670,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '3':
    id: '3'
    taskid: f6a24f1f-2288-420d-81f0-0fb757c103b6
    type: playbook
    task:
      id: f6a24f1f-2288-420d-81f0-0fb757c103b6
      version: -1
      name: QRadarFullSearch
      description: ''
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '89'
    scriptarguments:
      headers: {}
      interval:
        simple: '1'
      query_expression:
        complex:
          root: .
          transformers:
          - operator: DT
            args:
              dt:
                value:
                  simple: '.=function(val){var fields = Array.isArray(val.DomainURLFields) ? val.DomainURLFields : [val.DomainURLFields]; var domainurls = Array.isArray(val.DomainURL) ? val.DomainURL : [val.DomainURL]; return fields.map(field => domainurls.map(domainurl => "\"" + field + "\" ILIKE " + "''%" + domainurl + "%''").join('' OR ''))}(val)'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
      range: {}
      timeout:
        simple: '600'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: |-
      {
        "position": {
          "x": 2540,
          "y": 1450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '5':
    id: '5'
    taskid: 93c98c75-6611-4f02-8bc0-18d0b3cbb13f
    type: title
    task:
      id: 93c98c75-6611-4f02-8bc0-18d0b3cbb13f
      version: -1
      name: IP Search
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '7'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '6':
    id: '6'
    taskid: 14e174ac-c95e-4907-8f7f-2ed75fe40735
    type: title
    task:
      id: 14e174ac-c95e-4907-8f7f-2ed75fe40735
      version: -1
      name: Domain/Url Search
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '9'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2100,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '7':
    id: '7'
    taskid: 1a4a1f82-2d75-4552-8e5f-38d2668ed12e
    type: condition
    task:
      id: 1a4a1f82-2d75-4552-8e5f-38d2668ed12e
      version: -1
      name: Is there an IP to search?
      description: Is there an IP on which to search?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '48'
      'yes':
      - '49'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.IPAddress
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '8':
    id: '8'
    taskid: 11b6d002-63f5-4c7b-8888-a7f567a4c752
    type: condition
    task:
      id: 11b6d002-63f5-4c7b-8888-a7f567a4c752
      version: -1
      name: Is there a hash to search?
      description: Is there a hash on which to search?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '25'
      'yes':
      - '26'
      - '27'
      - '38'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.MD5
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA1
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": -670,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '9':
    id: '9'
    taskid: 52b92040-9e3e-4241-80e2-ca7b4612135a
    type: condition
    task:
      id: 52b92040-9e3e-4241-80e2-ca7b4612135a
      version: -1
      name: Is there a domain or url to search?
      description: Is there a domain or URL on which to search?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '10'
      'yes':
      - '15'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.URLDomain
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2100,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '10':
    id: '10'
    taskid: a55559ca-b477-48ca-8725-c0bb5bfcae82
    type: title
    task:
      id: a55559ca-b477-48ca-8725-c0bb5bfcae82
      version: -1
      name: Domain/Url hunting done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2100,
          "y": 2540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '11':
    id: '11'
    taskid: 9676bcae-277b-4020-8ac0-0a4a114c2e4a
    type: condition
    task:
      id: 9676bcae-277b-4020-8ac0-0a4a114c2e4a
      version: -1
      name: Is there a custom domain or url field?
      description: Is there a custom domain or url field?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '56'
      'yes':
      - '57'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.URLDomainField
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2810,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '15':
    id: '15'
    taskid: 3d2f242d-c10d-45fe-8248-10d9fa6b2872
    type: regular
    task:
      id: 3d2f242d-c10d-45fe-8248-10d9fa6b2872
      version: -1
      name: Set DomainUrl to array
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '11'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: DomainURL
      value:
        complex:
          root: inputs.URLDomain
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2810,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '16':
    id: '16'
    taskid: 1c9bb9f3-1b75-45ba-8215-a76d4ba56ffb
    type: regular
    task:
      id: 1c9bb9f3-1b75-45ba-8215-a76d4ba56ffb
      version: -1
      name: Set DomainUrlFields to Array
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '3'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: DomainURLFields
      value:
        complex:
          root: inputs.URLDomainField
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2540,
          "y": 1305
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '17':
    id: '17'
    taskid: 389e09e6-b264-4b52-8e94-51af0c84e657
    type: playbook
    task:
      id: 389e09e6-b264-4b52-8e94-51af0c84e657
      version: -1
      name: QRadarFullSearch
      description: ''
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '89'
    scriptarguments:
      headers: {}
      interval:
        simple: '1'
      query_expression:
        complex:
          root: DomainURL
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: UTF8(payload) ILIKE  '%$1%'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
      range: {}
      timeout:
        simple: '600'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: |-
      {
        "position": {
          "x": 3110,
          "y": 1450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '20':
    id: '20'
    taskid: 1a8c0e20-1f13-4d6a-869c-f60973a93ea6
    type: regular
    task:
      id: 1a8c0e20-1f13-4d6a-869c-f60973a93ea6
      version: -1
      name: Set MD5 to array
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '21'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: File.MD5
      value:
        complex:
          root: inputs.MD5
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2660,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '21':
    id: '21'
    taskid: 8fb9b356-eee0-4aca-83df-edb4ca67fbea
    type: condition
    task:
      id: 8fb9b356-eee0-4aca-83df-edb4ca67fbea
      version: -1
      name: Is there a custom MD5 field?
      description: Is there a custom MD5 field?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '64'
      'yes':
      - '65'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.QradarMD5Field
            iscontext: true
    view: |-
      {
        "position": {
          "x": -2660,
          "y": 1160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '22':
    id: '22'
    taskid: b06815b7-9e80-46bd-800c-013ed9a59ceb
    type: condition
    task:
      id: b06815b7-9e80-46bd-800c-013ed9a59ceb
      version: -1
      name: Is there an MD5 to search?
      description: Is there an MD5 on which to search?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '25'
      'yes':
      - '20'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": -1930,
          "y": 775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '23':
    id: '23'
    taskid: ccb6c3a4-8c60-4c51-8a3d-331d022ef257
    type: playbook
    task:
      id: ccb6c3a4-8c60-4c51-8a3d-331d022ef257
      version: -1
      name: QRadarFullSearch
      description: ''
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '93'
    scriptarguments:
      headers: {}
      interval:
        simple: '1'
      query_expression:
        complex:
          root: File
          accessor: MD5
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: UTF8(payload) LIKE  '$1'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
      range: {}
      timeout:
        simple: '600'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: |-
      {
        "position": {
          "x": -2950,
          "y": 1640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '25':
    id: '25'
    taskid: 9c085b17-06d1-49a0-8ec0-50f0ff3e72d4
    type: title
    task:
      id: 9c085b17-06d1-49a0-8ec0-50f0ff3e72d4
      version: -1
      name: Hash hunting done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -670,
          "y": 2790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '26':
    id: '26'
    taskid: 5ad35d56-bdbc-4fef-80c4-06f4298970e5
    type: title
    task:
      id: 5ad35d56-bdbc-4fef-80c4-06f4298970e5
      version: -1
      name: MD5 Search
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '22'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1930,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '27':
    id: '27'
    taskid: 0b02ee2b-17e1-4a2d-8054-72dd925f10c7
    type: title
    task:
      id: 0b02ee2b-17e1-4a2d-8054-72dd925f10c7
      version: -1
      name: SHA1 Search
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '29'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1520,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '29':
    id: '29'
    taskid: f853ef67-53ce-47ff-8797-1b1f10b81f9d
    type: condition
    task:
      id: f853ef67-53ce-47ff-8797-1b1f10b81f9d
      version: -1
      name: Is there a SHA1 to search?
      description: Is there a SHA1 hash on which to search?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '25'
      'yes':
      - '30'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA1
            iscontext: true
    view: |-
      {
        "position": {
          "x": -1520,
          "y": 775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '30':
    id: '30'
    taskid: 157199ac-8187-4e6e-8fd1-0a932d0cea3c
    type: regular
    task:
      id: 157199ac-8187-4e6e-8fd1-0a932d0cea3c
      version: -1
      name: Set SHA1 to array
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '31'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: File.SHA1
      value:
        complex:
          root: inputs.SHA1
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1170,
          "y": 950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '31':
    id: '31'
    taskid: d38b9fec-cea7-4afb-82d8-638e01ec0fc2
    type: condition
    task:
      id: d38b9fec-cea7-4afb-82d8-638e01ec0fc2
      version: -1
      name: Was there a custom SHA1 field?
      description: Was there a custom SHA1 field?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '62'
      'yes':
      - '63'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.QradarSHA1Field
            iscontext: true
    view: |-
      {
        "position": {
          "x": -1170,
          "y": 1120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '34':
    id: '34'
    taskid: 9799d2df-bf3e-4fcc-8fe2-f47cb71002e8
    type: playbook
    task:
      id: 9799d2df-bf3e-4fcc-8fe2-f47cb71002e8
      version: -1
      name: QRadarFullSearch
      description: ''
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '91'
    scriptarguments:
      headers: {}
      interval:
        simple: '1'
      query_expression:
        complex:
          root: .
          transformers:
          - operator: DT
            args:
              dt:
                value:
                  simple: '.=function(val){var fields = Array.isArray(val.SHA1Fields) ? val.SHA1Fields : [val.SHA1Fields]; var sha1s = Array.isArray(val.File.SHA1) ? val.File.SHA1 : [val.File.SHA1]; return fields.map(field => sha1s.map(sha1 => "\"" + field + "\"  = " + "''" + sha1 + "''").join('' OR ''))}(val)'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
      range: {}
      timeout:
        simple: '600'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: |-
      {
        "position": {
          "x": -890,
          "y": 1650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '35':
    id: '35'
    taskid: 9a7b1c53-3694-4cac-877d-3c9848c95de3
    type: playbook
    task:
      id: 9a7b1c53-3694-4cac-877d-3c9848c95de3
      version: -1
      name: QRadarFullSearch
      description: ''
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '91'
    scriptarguments:
      headers: {}
      interval:
        simple: '1'
      query_expression:
        complex:
          root: File
          accessor: SHA1
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: UTF8(payload) LIKE  '$1'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
      range: {}
      timeout:
        simple: '600'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: |-
      {
        "position": {
          "x": -1290,
          "y": 1650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '36':
    id: '36'
    taskid: 6d184cb6-0602-4d08-8e78-f906ae572995
    type: regular
    task:
      id: 6d184cb6-0602-4d08-8e78-f906ae572995
      version: -1
      name: Set MD5Fields to Array
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '37'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: MD5Fields
      value:
        complex:
          root: inputs.QradarMD5Field
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2400,
          "y": 1505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '37':
    id: '37'
    taskid: fb43e0cc-ace7-4f6e-8b75-fe60fa3641ec
    type: playbook
    task:
      id: fb43e0cc-ace7-4f6e-8b75-fe60fa3641ec
      version: -1
      name: QRadarFullSearch
      description: ''
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '93'
    scriptarguments:
      headers: {}
      interval:
        simple: '1'
      query_expression:
        complex:
          root: .
          transformers:
          - operator: DT
            args:
              dt:
                value:
                  simple: '.=function(val){var fields = Array.isArray(val.MD5Fields) ? val.MD5Fields : [val.MD5Fields]; var md5s = Array.isArray(val.File.MD5) ? val.File.MD5 : [val.File.MD5]; return fields.map(field => md5s.map(md5 => "\"" + field + "\"  = " + "''" + md5 + "''").join('' OR ''))}(val)'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
      range: {}
      timeout:
        simple: '600'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: |-
      {
        "position": {
          "x": -2400,
          "y": 1640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '38':
    id: '38'
    taskid: 424dd29e-0aed-4cfd-8bff-68d2ea35b0b5
    type: title
    task:
      id: 424dd29e-0aed-4cfd-8bff-68d2ea35b0b5
      version: -1
      name: SHA256 Search
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '39'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -270,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '39':
    id: '39'
    taskid: e5d99d6d-1f68-4ef0-8fc3-475a3ad32d2c
    type: condition
    task:
      id: e5d99d6d-1f68-4ef0-8fc3-475a3ad32d2c
      version: -1
      name: Is there a SHA256 to search?
      description: Is there a SHA256 hash on which to search?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '25'
      'yes':
      - '40'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": -270,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '40':
    id: '40'
    taskid: 7856b49f-6425-4145-8b67-21abf184b78d
    type: regular
    task:
      id: 7856b49f-6425-4145-8b67-21abf184b78d
      version: -1
      name: Set SHA256 to array
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '41'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: File.SHA256
      value:
        complex:
          root: inputs.SHA256
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -250,
          "y": 950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '41':
    id: '41'
    taskid: 06296669-d347-4f91-8b9b-e15011755fd0
    type: condition
    task:
      id: 06296669-d347-4f91-8b9b-e15011755fd0
      version: -1
      name: Is there a custom SHA256 field?
      description: Is there a custom SHA256 field?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '60'
      'yes':
      - '61'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.QradarSHA256Field
            iscontext: true
    view: |-
      {
        "position": {
          "x": -250,
          "y": 1120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '44':
    id: '44'
    taskid: 95b47dbd-63ab-451c-8ac6-391bfe39a9e3
    type: regular
    task:
      id: 95b47dbd-63ab-451c-8ac6-391bfe39a9e3
      version: -1
      name: Set SHA1Fields to Array
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '34'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: SHA1Fields
      value:
        complex:
          root: inputs.QradarSHA1Field
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -890,
          "y": 1480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '45':
    id: '45'
    taskid: 6ce5285e-0788-43d1-8f95-5692fdf1ab8d
    type: regular
    task:
      id: 6ce5285e-0788-43d1-8f95-5692fdf1ab8d
      version: -1
      name: Set SHA256Fields to Array
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '46'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: SHA256Fields
      value:
        complex:
          root: inputs.QradarSHA256Field
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -30,
          "y": 1480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '46':
    id: '46'
    taskid: 31cdcbf0-27c0-4591-8b45-83b4979290eb
    type: playbook
    task:
      id: 31cdcbf0-27c0-4591-8b45-83b4979290eb
      version: -1
      name: QRadarFullSearch
      description: ''
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '90'
    scriptarguments:
      headers: {}
      interval:
        simple: '1'
      query_expression:
        complex:
          root: .
          transformers:
          - operator: DT
            args:
              dt:
                value:
                  simple: '.=function(val){var fields = Array.isArray(val.SHA256Fields) ? val.SHA256Fields : [val.SHA256Fields]; var sha256s = Array.isArray(val.File.SHA256) ? val.File.SHA256 : [val.File.SHA256]; return fields.map(field => sha256s.map(sha256 => "\"" + field + "\" = " + "''" + sha256 + "''").join('' OR ''))}(val)'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
      range: {}
      timeout:
        simple: '600'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: |-
      {
        "position": {
          "x": -30,
          "y": 1650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '47':
    id: '47'
    taskid: fd37d7ea-2a0c-43c3-8e11-0a694bab2c7d
    type: playbook
    task:
      id: fd37d7ea-2a0c-43c3-8e11-0a694bab2c7d
      version: -1
      name: QRadarFullSearch
      description: ''
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '90'
    scriptarguments:
      headers: {}
      interval:
        simple: '1'
      query_expression:
        complex:
          root: File
          accessor: SHA256
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: UTF8(payload) ILIKE  '$1'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
      range: {}
      timeout:
        simple: '600'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: |-
      {
        "position": {
          "x": -440,
          "y": 1650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '48':
    id: '48'
    taskid: b9bb02ea-887d-4450-8927-158b66677b7c
    type: title
    task:
      id: b9bb02ea-887d-4450-8927-158b66677b7c
      version: -1
      name: IP hunting done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 760,
          "y": 2550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '49':
    id: '49'
    taskid: 226c6740-786a-4b0b-87cd-37fc80524652
    type: regular
    task:
      id: 226c6740-786a-4b0b-87cd-37fc80524652
      version: -1
      name: Set IP to array
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '50'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: IP
      value:
        complex:
          root: inputs.IPAddress
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '50':
    id: '50'
    taskid: 59b4d1c9-0348-4d49-8ff3-7ad7ab6c0d68
    type: condition
    task:
      id: 59b4d1c9-0348-4d49-8ff3-7ad7ab6c0d68
      version: -1
      name: Is there a custom IP field?
      description: Is there a custom IP field?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '59'
      'yes':
      - '58'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.QradarIPfield
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '51':
    id: '51'
    taskid: 96663c69-8445-4188-8e3a-0327b63a2ed5
    type: regular
    task:
      id: 96663c69-8445-4188-8e3a-0327b63a2ed5
      version: -1
      name: Set IPFields to Array
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '52'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: IPFields
      value:
        complex:
          root: inputs.QradarIPfield
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1590,
          "y": 1305
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '52':
    id: '52'
    taskid: c67276ae-cf37-4483-8705-6761606e7408
    type: playbook
    task:
      id: c67276ae-cf37-4483-8705-6761606e7408
      version: -1
      name: QRadarFullSearch
      description: ''
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '88'
    scriptarguments:
      headers: {}
      interval:
        simple: '1'
      query_expression:
        complex:
          root: .
          transformers:
          - operator: DT
            args:
              dt:
                value:
                  simple: '.=function(val){var fields = Array.isArray(val.IPFields) ? val.IPFields : [val.IPFields]; var ips = Array.isArray(val.IP) ? val.IP : [val.IP]; return fields.map(field => ips.map(ip => "\"" + field + "\" = " + "''" + ip + "''").join('' OR ''))}(val)'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
      range: {}
      timeout:
        simple: '600'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: |-
      {
        "position": {
          "x": 1590,
          "y": 1450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '53':
    id: '53'
    taskid: 16aa0f07-2129-4f94-81ef-9992ad665840
    type: playbook
    task:
      id: 16aa0f07-2129-4f94-81ef-9992ad665840
      version: -1
      name: QRadarFullSearch
      description: ''
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '88'
    scriptarguments:
      headers: {}
      interval:
        simple: '1'
      query_expression:
        complex:
          root: IP
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: UTF8(payload) LIKE  '$1'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
          - operator: concat
            args:
              prefix:
                value:
                  simple: ' from events where '
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.InvestigationFields
                iscontext: true
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: ','
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.SelectFields
                iscontext: true
              suffix:
                value:
                  simple: ' '
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'select '
              suffix:
                value:
                  simple: inputs.TimeFrame
                iscontext: true
      range: {}
      timeout:
        simple: '600'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 1450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '55':
    id: '55'
    taskid: 3f966e73-39a9-4c84-86c8-8707997aacf0
    type: condition
    task:
      id: 3f966e73-39a9-4c84-86c8-8707997aacf0
      version: -1
      name: Is Qradar enabled?
      description: Is Qradar enabled?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '48'
      'yes':
      - '2'
      - '5'
      - '6'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isExists
          left:
            value:
              simple: modules.brand
            iscontext: true
      - - operator: isEqualString
          left:
            value:
              simple: modules.brand
            iscontext: true
          right:
            value:
              simple: QRadar
      - - operator: isEqualString
          left:
            value:
              simple: modules.state
            iscontext: true
          right:
            value:
              simple: active
    view: |-
      {
        "position": {
          "x": 760,
          "y": -90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '56':
    id: '56'
    taskid: 96e506c1-3c8c-4f47-8bbc-98d2aa79d74b
    type: title
    task:
      id: 96e506c1-3c8c-4f47-8bbc-98d2aa79d74b
      version: -1
      name: QRadar query without custom fields
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '17'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3110,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '57':
    id: '57'
    taskid: f1177866-0c97-4ee1-8a7e-20002a21a2c6
    type: title
    task:
      id: f1177866-0c97-4ee1-8a7e-20002a21a2c6
      version: -1
      name: QRadar query with custom fields
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '16'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2540,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '58':
    id: '58'
    taskid: 92ab1a00-cada-4654-8bb4-0d6579a46b3f
    type: title
    task:
      id: 92ab1a00-cada-4654-8bb4-0d6579a46b3f
      version: -1
      name: QRadar query with custom fields
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '51'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1590,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '59':
    id: '59'
    taskid: 7c4a3027-bee0-42ed-8b81-dab958dc227f
    type: title
    task:
      id: 7c4a3027-bee0-42ed-8b81-dab958dc227f
      version: -1
      name: QRadar query without custom fields
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '53'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '60':
    id: '60'
    taskid: 6f50e9e3-6824-47f8-8fdb-29a86df3d377
    type: title
    task:
      id: 6f50e9e3-6824-47f8-8fdb-29a86df3d377
      version: -1
      name: QRadar query without custom fields
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '47'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -440,
          "y": 1320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '61':
    id: '61'
    taskid: 4960e972-f8f5-4258-8df4-3175d0ed3a1f
    type: title
    task:
      id: 4960e972-f8f5-4258-8df4-3175d0ed3a1f
      version: -1
      name: QRadar query with custom fields
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '45'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -30,
          "y": 1320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '62':
    id: '62'
    taskid: 1688d212-f5c1-4e5b-8991-c9fcbd005cd5
    type: title
    task:
      id: 1688d212-f5c1-4e5b-8991-c9fcbd005cd5
      version: -1
      name: QRadar query without custom fields
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '35'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1290,
          "y": 1320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '63':
    id: '63'
    taskid: 788dd4b2-8aa9-4ff7-8c0a-92258c0e5e0e
    type: title
    task:
      id: 788dd4b2-8aa9-4ff7-8c0a-92258c0e5e0e
      version: -1
      name: QRadar query with custom fields
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '44'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -890,
          "y": 1320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '64':
    id: '64'
    taskid: 6ca5fe4b-693e-4cf6-8e8b-63fde60bc5ed
    type: title
    task:
      id: 6ca5fe4b-693e-4cf6-8e8b-63fde60bc5ed
      version: -1
      name: QRadar query without custom fields
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '23'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2950,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '65':
    id: '65'
    taskid: e2b3740e-4fb3-4dce-8656-654574fc14a4
    type: title
    task:
      id: e2b3740e-4fb3-4dce-8656-654574fc14a4
      version: -1
      name: QRadar query with custom fields
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '36'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2400,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '66':
    id: '66'
    taskid: 2ab45f59-c5eb-4c7d-8b4e-d644ee5f805d
    type: regular
    task:
      id: 2ab45f59-c5eb-4c7d-8b4e-d644ee5f805d
      version: -1
      name: Set detected IP addresses
      description: Sets the IP addresses found in the DetectedIPs context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '67'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedIPs
      value:
        complex:
          root: ${QRadar
          accessor: Search.Result.events.sourceip}
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: ${QRadar.Search.Result.events.destinationip}
                iscontext: true
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 1880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '67':
    id: '67'
    taskid: b6c28137-213b-4740-8ebf-b6ff6c7761a0
    type: regular
    task:
      id: b6c28137-213b-4740-8ebf-b6ff6c7761a0
      version: -1
      name: Set detected usernames
      description: Sets the usernames found in the DetectedUsers context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '68'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedUsers
      value:
        complex:
          root: ${QRadar
          accessor: Search.Result.events.username}
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 2045
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '68':
    id: '68'
    taskid: a1b68eff-34d9-486a-85a1-1cf60722503a
    type: regular
    task:
      id: a1b68eff-34d9-486a-85a1-1cf60722503a
      version: -1
      name: Get hostnames from assets
      description: List all assets found in the model
      script: '|||qradar-get-assets'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '70'
    scriptarguments:
      fields: {}
      filter:
        complex:
          root: ${QRadar
          accessor: DetectedIPs}
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: interfaces contains ip_addresses contains value= "
              suffix:
                value:
                  simple: '"'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
      headers: {}
      range: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 2200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '70':
    id: '70'
    taskid: 63d16d8f-95cf-4668-8775-b97c98fd2613
    type: regular
    task:
      id: 63d16d8f-95cf-4668-8775-b97c98fd2613
      version: -1
      name: Set detected hostnames from assets
      description: Sets the hostnames found in the DetectedHosts context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '48'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedHosts
      value:
        complex:
          root: ${QRadar
          accessor: Asset.Name.Value}
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 2355
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '71':
    id: '71'
    taskid: ea7b46f4-4c4d-458b-8801-9e9124d6ac01
    type: regular
    task:
      id: ea7b46f4-4c4d-458b-8801-9e9124d6ac01
      version: -1
      name: Set detected IP addresses
      description: Sets the IP addresses found in the DetectedIPs context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '72'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedIPs
      value:
        complex:
          root: ${QRadar
          accessor: Search.Result.events.sourceip}
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: ${QRadar.Search.Result.events.destinationip}
                iscontext: true
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2810,
          "y": 1880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '72':
    id: '72'
    taskid: 5b531c4f-9e6c-4072-8f7a-7ebc8328bc38
    type: regular
    task:
      id: 5b531c4f-9e6c-4072-8f7a-7ebc8328bc38
      version: -1
      name: Set detected usernames
      description: Sets the usernames found in the DetectedUsers context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '73'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedUsers
      value:
        complex:
          root: ${QRadar
          accessor: Search.Result.events.username}
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2810,
          "y": 2045
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '73':
    id: '73'
    taskid: ce3528f2-d0e7-49c7-8cef-fff4f19be3e1
    type: regular
    task:
      id: ce3528f2-d0e7-49c7-8cef-fff4f19be3e1
      version: -1
      name: Get hostnames from assets
      description: List all assets found in the model
      script: '|||qradar-get-assets'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '74'
    scriptarguments:
      fields: {}
      filter:
        complex:
          root: ${QRadar
          accessor: DetectedIPs}
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: interfaces contains ip_addresses contains value= "
              suffix:
                value:
                  simple: '"'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
      headers: {}
      range: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2810,
          "y": 2200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '74':
    id: '74'
    taskid: 0c266af1-631e-4a36-8339-cc9e4ed5acbd
    type: regular
    task:
      id: 0c266af1-631e-4a36-8339-cc9e4ed5acbd
      version: -1
      name: Set detected hostnames from assets
      description: Sets the hostnames found in the DetectedHosts context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '10'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedHosts
      value:
        complex:
          root: ${QRadar
          accessor: Asset.Name.Value}
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2810,
          "y": 2355
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '76':
    id: '76'
    taskid: a90db54b-31e7-4690-896d-d910cdbf12ed
    type: regular
    task:
      id: a90db54b-31e7-4690-896d-d910cdbf12ed
      version: -1
      name: Set detected usernames
      description: Sets the usernames found in the DetectedUsers context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '77'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedUsers
      value:
        complex:
          root: ${QRadar
          accessor: Search.Result.events.username}
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -200,
          "y": 2250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '77':
    id: '77'
    taskid: 8e627ec7-629d-433c-8c73-6152d2e963e2
    type: regular
    task:
      id: 8e627ec7-629d-433c-8c73-6152d2e963e2
      version: -1
      name: Get hostnames from assets
      description: List all assets found in the model
      script: '|||qradar-get-assets'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '78'
    scriptarguments:
      fields: {}
      filter:
        complex:
          root: ${QRadar
          accessor: DetectedIPs}
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: interfaces contains ip_addresses contains value= "
              suffix:
                value:
                  simple: '"'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
      headers: {}
      range: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -200,
          "y": 2395
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '78':
    id: '78'
    taskid: 47354bc5-ee46-43ef-82b9-451510b27293
    type: regular
    task:
      id: 47354bc5-ee46-43ef-82b9-451510b27293
      version: -1
      name: Set detected hostnames from assets
      description: Sets the hostnames found in the DetectedHosts context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '25'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedHosts
      value:
        complex:
          root: ${QRadar
          accessor: Asset.Name.Value}
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -200,
          "y": 2550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '79':
    id: '79'
    taskid: 427f7845-ff31-42f4-88a6-4b3da8ccafe2
    type: regular
    task:
      id: 427f7845-ff31-42f4-88a6-4b3da8ccafe2
      version: -1
      name: Set detected IP addresses
      description: Sets the IP addresses found in the DetectedIPs context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '80'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedIPs
      value:
        complex:
          root: ${QRadar
          accessor: Search.Result.events.sourceip}
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: ${QRadar.Search.Result.events.destinationip}
                iscontext: true
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1100,
          "y": 2095
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '80':
    id: '80'
    taskid: 134a4982-0e96-4623-8b15-9435c8ad7eba
    type: regular
    task:
      id: 134a4982-0e96-4623-8b15-9435c8ad7eba
      version: -1
      name: Set detected usernames
      description: Sets the usernames found in the DetectedUsers context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '81'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedUsers
      value:
        complex:
          root: ${QRadar
          accessor: Search.Result.events.username}
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1090,
          "y": 2250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '81':
    id: '81'
    taskid: 745e34b3-01f1-4f8d-865e-7d65e3e401f3
    type: regular
    task:
      id: 745e34b3-01f1-4f8d-865e-7d65e3e401f3
      version: -1
      name: Get hostnames from assets
      description: List all assets found in the model
      script: '|||qradar-get-assets'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '82'
    scriptarguments:
      fields: {}
      filter:
        complex:
          root: ${QRadar
          accessor: DetectedIPs}
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: interfaces contains ip_addresses contains value= "
              suffix:
                value:
                  simple: '"'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
      headers: {}
      range: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1090,
          "y": 2395
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '82':
    id: '82'
    taskid: 2eb43ac7-a464-41b1-8795-08370ed415b4
    type: regular
    task:
      id: 2eb43ac7-a464-41b1-8795-08370ed415b4
      version: -1
      name: Set detected hostnames from assets
      description: Sets the hostnames found in the DetectedHosts context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '25'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedHosts
      value:
        complex:
          root: ${QRadar
          accessor: Asset.Name.Value}
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1090,
          "y": 2550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '83':
    id: '83'
    taskid: acb8eb12-ff99-44a6-8765-c3b1d750f066
    type: regular
    task:
      id: acb8eb12-ff99-44a6-8765-c3b1d750f066
      version: -1
      name: Set detected IP addresses
      description: Sets the IP addresses found in the DetectedIPs context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '84'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedIPs
      value:
        complex:
          root: ${QRadar
          accessor: Search.Result.events.sourceip}
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: ${QRadar.Search.Result.events.destinationip}
                iscontext: true
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2350,
          "y": 2065
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '84':
    id: '84'
    taskid: b1fe87e9-59cc-4804-84ef-fc039d3f012b
    type: regular
    task:
      id: b1fe87e9-59cc-4804-84ef-fc039d3f012b
      version: -1
      name: Set detected usernames
      description: Sets the usernames found in the DetectedUsers context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '85'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedUsers
      value:
        complex:
          root: ${QRadar
          accessor: Search.Result.events.username}
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2350,
          "y": 2250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '85':
    id: '85'
    taskid: ed8062ce-f144-47d1-8b74-7903a81ad089
    type: regular
    task:
      id: ed8062ce-f144-47d1-8b74-7903a81ad089
      version: -1
      name: Get hostnames from assets
      description: List all assets found in the model
      script: '|||qradar-get-assets'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '86'
    scriptarguments:
      fields: {}
      filter:
        complex:
          root: ${QRadar
          accessor: DetectedIPs}
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: interfaces contains ip_addresses contains value= "
              suffix:
                value:
                  simple: '"'
          - operator: join
            args:
              separator:
                value:
                  simple: ' OR '
      headers: {}
      range: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2350,
          "y": 2395
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '86':
    id: '86'
    taskid: 453c6b03-6c0e-4a67-880d-89b7dd549969
    type: regular
    task:
      id: 453c6b03-6c0e-4a67-880d-89b7dd549969
      version: -1
      name: Set detected hostnames from assets
      description: Sets the hostnames found in the DetectedHosts context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '25'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedHosts
      value:
        complex:
          root: ${QRadar
          accessor: Asset.Name.Value}
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2350,
          "y": 2550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '87':
    id: '87'
    taskid: 33de96b1-93f5-4b0d-8fc4-445b724e0faf
    type: regular
    task:
      id: 33de96b1-93f5-4b0d-8fc4-445b724e0faf
      version: -1
      name: Set detected IP addresses
      description: Sets the IP addresses found in the DetectedIPs context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '76'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: QRadar.DetectedIPs
      value:
        complex:
          root: ${QRadar
          accessor: Search.Result.events.sourceip}
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: ${QRadar.Search.Result.events.destinationip}
                iscontext: true
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -200,
          "y": 2095
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '88':
    id: '88'
    taskid: 88a769f3-02af-420f-8ebe-7b0bf4cb7304
    type: condition
    task:
      description: ''
      id: 88a769f3-02af-420f-8ebe-7b0bf4cb7304
      version: -1
      name: Is ip detected by QRadar?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '48'
      'yes':
      - '66'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: QRadar.Search.Result
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: QRadar.Search.Result
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1310,
          "y": 1640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '89':
    id: '89'
    taskid: 527ecb0c-d661-4adc-8e96-2e4b78217022
    type: condition
    task:
      description: ''
      id: 527ecb0c-d661-4adc-8e96-2e4b78217022
      version: -1
      name: Is domain or url detected by QRadar?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '10'
      'yes':
      - '71'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: QRadar.Search.Result
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: QRadar.Search.Result
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2810,
          "y": 1650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '90':
    id: '90'
    taskid: 3280403b-1163-4d93-87f0-5f4b513bc573
    type: condition
    task:
      description: ''
      id: 3280403b-1163-4d93-87f0-5f4b513bc573
      version: -1
      name: Is SHA256 file hash detected by QRadar?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '25'
      'yes':
      - '87'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: QRadar.Search.Result
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: QRadar.Search.Result
            iscontext: true
    view: |-
      {
        "position": {
          "x": -200,
          "y": 1870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '91':
    id: '91'
    taskid: 9723aa93-2d5e-4895-80ea-33ab02556dbf
    type: condition
    task:
      description: ''
      id: 9723aa93-2d5e-4895-80ea-33ab02556dbf
      version: -1
      name: Is SHA1 file hash detected by QRadar?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '25'
      'yes':
      - '79'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: QRadar.Search.Result
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: QRadar.Search.Result
            iscontext: true
    view: |-
      {
        "position": {
          "x": -1090,
          "y": 1870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '93':
    id: '93'
    taskid: ac143d95-bceb-4594-8222-7d4d59b8a2ae
    type: condition
    task:
      description: ''
      id: ac143d95-bceb-4594-8222-7d4d59b8a2ae
      version: -1
      name: Is Md5 file hash detected by QRadar?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '25'
      'yes':
      - '83'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: QRadar.Search.Result
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: QRadar.Search.Result
            iscontext: true
    view: |-
      {
        "position": {
          "x": -3220,
          "y": 1880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 3095,
        "width": 6710,
        "x": -3220,
        "y": -240
      }
    }
  }
inputs:
- key: MD5
  value: {}
  required: false
  description: MD5 hash file or an array of hashes to search.
- key: QradarMD5Field
  value: {}
  required: false
  description: MD5 field to search in QRadar. If none are specified, the search will use a payload contains filter.
- key: SHA1
  value: {}
  required: false
  description: SHA1 hash file or an array of hashes to search.
- key: QradarSHA1Field
  value: {}
  required: false
  description: SHA1 field to search in QRadar. If none are specified, the search will use a payload contains filter.
- key: SHA256
  value: {}
  required: false
  description: SHA256 hash file or an array of hashes to search.
- key: QradarSHA256Field
  value: {}
  required: false
  description: SHA256 field to search in QRadar. If none are specified, the search will use a payload contains filter.
- key: IPAddress
  value: {}
  required: false
  description: |
    Source or destination IP to search. Can be a single address or an array of addresses.
- key: QradarIPfield
  value:
    simple: sourceip,destinationip
  required: false
  description: IP field to search in QRadar. If none are specified, the search will use sourceip or destinationip (combined).
- key: URLDomain
  value: {}
  required: false
  description: |
    Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used.
- key: URLDomainField
  value: {}
  required: false
  description: 'URL/Domain field to search in QRadar. If none are specified, the search will use a payload contains filter. '
- key: SelectFields
  value:
    simple: '*'
  required: true
  description: The fields to be used in the select. Use comma delimited field names as they appear in AQL. * is an acceptable value.
- key: TimeFrame
  value:
    simple: LAST 7 DAYS
  required: false
  description: |-
    Time frame as used in AQL
    Examples can be
    LAST 7 DAYS
    START '2019-09-25 15:51' STOP '2019-09-25 17:51'
    For more examples review IBM's AQL documentation.
- key: InvestigationFields
  value:
    simple: sourceip,destinationip,username
  required: true
  description: The fields to be used for the hunting outputs. These fields are added to the selected field's input.
outputs:
- contextPath: QRadar.Search.Result
  description: Qradar's search results.
  type: string
- contextPath: QRadar.DetectedIPs
  description: IP addresses detected based on sourceip and destinationip fields in your search.
  type: string
- contextPath: QRadar.DetectedUsers
  description: Users detected based on the username field in your search.
  type: string
- contextPath: QRadar.DetectedHosts
  description: 'Hosts detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar.'
  type: string
tests:
- No test - Deprecated playbook
deprecated: true
supportedModules:
- agentix
- xsiam