id: QRadar Indicator Hunting V2 version: -1 contentitemexportablefields: contentitemfields: {} name: QRadar Indicator Hunting V2 description: 'The Playbook queries QRadar SIEM for indicators such as file hashes, IP addresses, domains, or urls. ' starttaskid: "0" tasks: "0": id: "0" taskid: a2b99d88-69c8-4a87-8d60-74d21ca2db74 type: start task: id: a2b99d88-69c8-4a87-8d60-74d21ca2db74 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "55" separatecontext: false view: |- { "position": { "x": 1875, "y": -125 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: 30250b5a-c4ae-4477-8d7d-aa586c6a5c2f type: title task: id: 30250b5a-c4ae-4477-8d7d-aa586c6a5c2f version: -1 name: Hash Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "8" separatecontext: false view: |- { "position": { "x": 842.5, "y": 350 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: b4ad1b02-a07b-4f3b-8949-2389d2c0c08e type: title task: id: b4ad1b02-a07b-4f3b-8949-2389d2c0c08e version: -1 name: IP Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "7" separatecontext: false view: |- { "position": { "x": 1875, "y": 360 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: b2482cd1-e6f4-45ab-84c4-0faf3d9e96ae type: title task: id: b2482cd1-e6f4-45ab-84c4-0faf3d9e96ae version: -1 name: Domain/Url Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "9" separatecontext: false view: |- { "position": { "x": 2775, "y": 350 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: b3700546-6a71-4c26-89dc-6ac3ffe0439a type: condition task: id: b3700546-6a71-4c26-89dc-6ac3ffe0439a version: -1 name: Is there an IP to search? description: Is there an IP on which to search? type: condition iscommand: false brand: "" nexttasks: '#default#': - "166" "yes": - "50" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.IPAddress iscontext: true view: |- { "position": { "x": 1875, "y": 490 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 4ca411b2-9118-4c88-80ba-fd45cf7dc4d4 type: condition task: id: 4ca411b2-9118-4c88-80ba-fd45cf7dc4d4 version: -1 name: Is there a hash to search? description: Is there a hash on which to search? type: condition iscommand: false brand: "" nexttasks: '#default#': - "166" "yes": - "26" - "27" - "38" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.MD5 iscontext: true - operator: isNotEmpty left: value: simple: inputs.SHA1 iscontext: true - operator: isNotEmpty left: value: simple: inputs.SHA256 iscontext: true view: |- { "position": { "x": 842.5, "y": 475 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: 8a910c41-e636-4df8-873d-55961fd9f5ff type: condition task: id: 8a910c41-e636-4df8-873d-55961fd9f5ff version: -1 name: Is there a domain or url to search? description: Is there a domain or URL on which to search? type: condition iscommand: false brand: "" nexttasks: '#default#': - "166" "yes": - "11" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.URLDomain iscontext: true view: |- { "position": { "x": 2775, "y": 475 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 2afade2a-c653-4db2-8fc2-7dc20abba4f6 type: condition task: id: 2afade2a-c653-4db2-8fc2-7dc20abba4f6 version: -1 name: Is there a custom domain or url field? description: Is there a custom domain or url field? type: condition iscommand: false brand: "" nexttasks: '#default#': - "56" "yes": - "57" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.QradarURLDomainField iscontext: true view: |- { "position": { "x": 2775, "y": 660 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: 9dbc1709-6693-4705-8a81-90432e69bbc5 type: condition task: id: 9dbc1709-6693-4705-8a81-90432e69bbc5 version: -1 name: Is there a custom MD5 field? description: Is there a custom MD5 field? type: condition iscommand: false brand: "" nexttasks: '#default#': - "64" "yes": - "65" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.QradarMD5Field iscontext: true view: |- { "position": { "x": -1385, "y": 950 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "22": id: "22" taskid: 9719193a-aa81-4017-8fe3-9b9c54f7c510 type: condition task: id: 9719193a-aa81-4017-8fe3-9b9c54f7c510 version: -1 name: Is there an MD5 to search? description: Is there an MD5 on which to search? type: condition iscommand: false brand: "" nexttasks: '#default#': - "166" "yes": - "21" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.MD5 iscontext: true view: |- { "position": { "x": -1385, "y": 775 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: 37b3d830-4401-42fa-8c4a-ec9952bf39fd type: title task: id: 37b3d830-4401-42fa-8c4a-ec9952bf39fd version: -1 name: MD5 Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "22" separatecontext: false view: |- { "position": { "x": -1385, "y": 650 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 2f6a1090-e0b8-4485-8185-83165e489c33 type: title task: id: 2f6a1090-e0b8-4485-8185-83165e489c33 version: -1 name: SHA1 Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "29" separatecontext: false view: |- { "position": { "x": -505, "y": 650 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: eab04f66-1e17-4945-8f72-a5cdda1bc308 type: condition task: id: eab04f66-1e17-4945-8f72-a5cdda1bc308 version: -1 name: Is there a SHA1 to search? description: Is there a SHA1 hash on which to search? type: condition iscommand: false brand: "" nexttasks: '#default#': - "166" "yes": - "31" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.SHA1 iscontext: true view: |- { "position": { "x": -515, "y": 775 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: d6eb18bc-0884-47a5-829b-d1ae0060d3bc type: condition task: id: d6eb18bc-0884-47a5-829b-d1ae0060d3bc version: -1 name: Was there a custom SHA1 field? description: Was there a custom SHA1 field? type: condition iscommand: false brand: "" nexttasks: '#default#': - "62" "yes": - "63" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.QradarSHA1Field iscontext: true view: |- { "position": { "x": -505, "y": 940 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "38": id: "38" taskid: 7a308843-7a82-4f8a-8273-bc8c81ac4d39 type: title task: id: 7a308843-7a82-4f8a-8273-bc8c81ac4d39 version: -1 name: SHA256 Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "39" separatecontext: false view: |- { "position": { "x": 372.5, "y": 650 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "39": id: "39" taskid: d4834696-2334-462e-8fbb-d978b9079097 type: condition task: id: d4834696-2334-462e-8fbb-d978b9079097 version: -1 name: Is there a SHA256 to search? description: Is there a SHA256 hash on which to search? type: condition iscommand: false brand: "" nexttasks: '#default#': - "166" "yes": - "41" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.SHA256 iscontext: true view: |- { "position": { "x": 372.5, "y": 775 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "41": id: "41" taskid: 9202b39d-89cd-4fde-83a5-4912e2a7913b type: condition task: id: 9202b39d-89cd-4fde-83a5-4912e2a7913b version: -1 name: Is there a custom SHA256 field? description: Is there a custom SHA256 field? type: condition iscommand: false brand: "" nexttasks: '#default#': - "60" "yes": - "61" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.QradarSHA256Field iscontext: true view: |- { "position": { "x": 372.5, "y": 950 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "50": id: "50" taskid: e9557ca0-59b9-4011-85df-20107a011f2c type: condition task: id: e9557ca0-59b9-4011-85df-20107a011f2c version: -1 name: Is there a custom IP field? description: Is there a custom IP field? type: condition iscommand: false brand: "" nexttasks: '#default#': - "59" "yes": - "58" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.QradarIPfield iscontext: true view: |- { "position": { "x": 1575, "y": 660 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "55": id: "55" taskid: a9fa4f2d-8daf-456c-8d88-7c1c7eb830b4 type: condition task: id: a9fa4f2d-8daf-456c-8d88-7c1c7eb830b4 version: -1 name: Is Qradar enabled? description: Is Qradar enabled? type: condition iscommand: false brand: "" nexttasks: '#default#': - "165" "yes": - "176" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: inList left: value: simple: modules.brand iscontext: true right: value: simple: QRadar,QRadar_v2,QRadar v3 - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active iscontext: true view: |- { "position": { "x": 1350, "y": 30 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "56": id: "56" taskid: caed8241-b8b1-4f34-8f29-2177fdb3e10f type: title task: id: caed8241-b8b1-4f34-8f29-2177fdb3e10f version: -1 name: QRadar query without custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "102" separatecontext: false view: |- { "position": { "x": 2570, "y": 845 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "57": id: "57" taskid: 148ec15e-e700-43d9-80a1-6867e0e697c4 type: title task: id: 148ec15e-e700-43d9-80a1-6867e0e697c4 version: -1 name: QRadar query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "175" separatecontext: false view: |- { "position": { "x": 3000, "y": 840 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "58": id: "58" taskid: b376ca7c-0ef3-4ce6-8188-27c49b3d14f3 type: title task: id: b376ca7c-0ef3-4ce6-8188-27c49b3d14f3 version: -1 name: QRadar query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "172" separatecontext: false view: |- { "position": { "x": 2100, "y": 840 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "59": id: "59" taskid: 352bb2ce-fe56-4415-805b-d15436205a16 type: title task: id: 352bb2ce-fe56-4415-805b-d15436205a16 version: -1 name: QRadar query without custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "101" separatecontext: false view: |- { "position": { "x": 1670, "y": 840 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "60": id: "60" taskid: 7c514669-525a-41e6-89b3-4b03683cd2cd type: title task: id: 7c514669-525a-41e6-89b3-4b03683cd2cd version: -1 name: QRadar query without custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "100" separatecontext: false view: |- { "position": { "x": 170, "y": 1125 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "61": id: "61" taskid: 3fb63155-a852-454d-8c8a-7e77db25eb7f type: title task: id: 3fb63155-a852-454d-8c8a-7e77db25eb7f version: -1 name: QRadar query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "169" separatecontext: false view: |- { "position": { "x": 600, "y": 1125 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "62": id: "62" taskid: 3aae3e82-5aad-4f67-83df-46ed41175b6d type: title task: id: 3aae3e82-5aad-4f67-83df-46ed41175b6d version: -1 name: QRadar query without custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "99" separatecontext: false view: |- { "position": { "x": -710, "y": 1125 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "63": id: "63" taskid: 289810bf-110b-4c31-8ebc-907f334ad50a type: title task: id: 289810bf-110b-4c31-8ebc-907f334ad50a version: -1 name: QRadar query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "170" separatecontext: false view: |- { "position": { "x": -280, "y": 1125 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "64": id: "64" taskid: ce8af6fc-bdde-4ba4-8df1-81430d419c3b type: title task: id: ce8af6fc-bdde-4ba4-8df1-81430d419c3b version: -1 name: QRadar query without custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "98" separatecontext: false view: |- { "position": { "x": -1590, "y": 1125 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "65": id: "65" taskid: dc5b8a0d-79f6-4865-8e9c-3a2638bbd6c7 type: title task: id: dc5b8a0d-79f6-4865-8e9c-3a2638bbd6c7 version: -1 name: QRadar query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "181" separatecontext: false view: |- { "position": { "x": -1160, "y": 1125 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "98": id: "98" taskid: dff6c803-c9df-4549-89ce-8713862e29fe type: regular task: id: dff6c803-c9df-4549-89ce-8713862e29fe version: -1 name: Set MD5 to an array description: Sets a value into the context with the given context key scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "173" scriptarguments: append: simple: "true" key: simple: FileMD5 value: complex: root: inputs.MD5 transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": -1590, "y": 1290 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "99": id: "99" taskid: e5f785bb-75ea-4ff2-87e2-7ed44fdcf134 type: regular task: id: e5f785bb-75ea-4ff2-87e2-7ed44fdcf134 version: -1 name: Set SHA1 to an array description: Sets a value into the context with the given context key scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "171" scriptarguments: append: simple: "true" key: simple: FileSHA1 value: complex: root: inputs.SHA1 transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": -710, "y": 1290 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "100": id: "100" taskid: 6cc731ba-436e-4959-887e-973dffd05aa4 type: regular task: id: 6cc731ba-436e-4959-887e-973dffd05aa4 version: -1 name: Set SHA256 to an array description: Sets a value into the context with the given context key scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "168" scriptarguments: append: simple: "true" key: simple: FileSHA256 value: complex: root: inputs.SHA256 transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": 170, "y": 1270 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "101": id: "101" taskid: 9699d2e9-2d1f-48ba-85fc-144e59bcf3a1 type: regular task: id: 9699d2e9-2d1f-48ba-85fc-144e59bcf3a1 version: -1 name: Set IP to an array description: Sets a value into the context with the given context key scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "167" scriptarguments: append: simple: "true" key: simple: IPAddress value: complex: root: inputs.IPAddress transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": 1670, "y": 1000 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "102": id: "102" taskid: 2e9bf4dc-56ce-4125-86b0-66f99fdf4651 type: regular task: id: 2e9bf4dc-56ce-4125-86b0-66f99fdf4651 version: -1 name: Set Domain or URL to the array description: Sets a value into the context with the given context key scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "174" scriptarguments: append: simple: "true" key: simple: DomainURL value: complex: root: inputs.URLDomain transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": 2570, "y": 990 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "120": id: "120" taskid: f1aaa2dc-6ab1-408e-8851-d73171be6244 type: title task: id: f1aaa2dc-6ab1-408e-8851-d73171be6244 version: -1 name: Sort internal and external IP addresses type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "124" separatecontext: false view: |- { "position": { "x": 1875, "y": 2640 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "123": id: "123" taskid: 777b2d48-c9f0-433d-8de3-7b015ba4c472 type: regular task: id: 777b2d48-c9f0-433d-8de3-7b015ba4c472 version: -1 name: Set detected IP addresses as external description: Checks if the specified value exists in context. If the value exists, it will be set in context, otherwise no value will be set it context. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "165" scriptarguments: append: simple: "true" key: simple: QRadar.DetectedExternalIPs value: complex: root: IP filters: - - operator: isEqualString left: value: simple: IP.InRange iscontext: true right: value: simple: "no" accessor: Address transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": 2080, "y": 3280 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "124": id: "124" taskid: 62deb054-e2c8-4fc9-88c5-ecc24d8fd88f type: condition task: id: 62deb054-e2c8-4fc9-88c5-ecc24d8fd88f version: -1 name: Are there detected IP addresses? description: Are there detected IP addresses? type: condition iscommand: false brand: "" nexttasks: '#default#': - "165" "yes": - "142" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: QRadar.DetectedIPs iscontext: true view: |- { "position": { "x": 1875, "y": 2775 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "142": id: "142" taskid: 1b6be11a-d587-4ef8-8784-8541d2761d85 type: regular task: id: 1b6be11a-d587-4ef8-8784-8541d2761d85 version: -1 name: Determine whether the IP address is internal or external description: Returns yes if the IP is in one of the ranges provided, returns no otherwise. scriptName: IsIPInRanges type: regular iscommand: false brand: "" nexttasks: '#none#': - "143" scriptarguments: ip: simple: ${QRadar.DetectedIPs} ipRanges: simple: ${inputs.InternalRange} separatecontext: false view: |- { "position": { "x": 2080, "y": 2950 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "143": id: "143" taskid: 61ca426a-bbab-45f5-8594-a0cadbd399b7 type: regular task: id: 61ca426a-bbab-45f5-8594-a0cadbd399b7 version: -1 name: Set detected IP addresses as internal description: Checks if the specified value exists in context. If the value exists, it will be set in context, otherwise no value will be set it context. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "123" scriptarguments: append: simple: "true" key: simple: QRadar.DetectedInternalIPs value: complex: root: IP filters: - - operator: isEqualString left: value: simple: IP.InRange iscontext: true right: value: simple: "yes" accessor: Address transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": 2080, "y": 3115 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "161": id: "161" taskid: f7b5c63c-7cbb-4907-8317-2dd39f6ed397 type: regular task: id: f7b5c63c-7cbb-4907-8317-2dd39f6ed397 version: -1 name: Set detected usernames description: Sets a value into the context with the given context key scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "162" scriptarguments: append: simple: "true" key: simple: QRadar.DetectedUsers value: complex: root: ${ accessor: =[]} transformers: - operator: GetValuesOfMultipleFields args: key: value: simple: QRadar.SearchEvents.Events iscontext: true list: value: simple: inputs.InvestigationUserFields iscontext: true separatecontext: false view: |- { "position": { "x": 2305, "y": 2110 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "162": id: "162" taskid: 1a600002-c821-46b1-82ac-d8b5ece75e26 type: regular task: id: 1a600002-c821-46b1-82ac-d8b5ece75e26 version: -1 name: Get hostnames from assets description: Retrieves assets list. script: '|||qradar-assets-list' type: regular iscommand: true brand: "" nexttasks: '#none#': - "163" scriptarguments: filter: complex: root: QRadar accessor: DetectedIPs transformers: - operator: concat args: prefix: value: simple: interfaces contains ip_addresses contains value= " suffix: value: simple: '"' - operator: join args: separator: value: simple: ' OR ' separatecontext: false continueonerror: true view: |- { "position": { "x": 2305, "y": 2290 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "163": id: "163" taskid: 7b5105b2-a7fe-4909-8226-8afb3bbcdee4 type: regular task: id: 7b5105b2-a7fe-4909-8226-8afb3bbcdee4 version: -1 name: Set detected hostnames from assets description: Sets a value into the context with the given context key scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "120" scriptarguments: append: simple: "true" key: simple: QRadar.DetectedInternalHosts value: complex: root: QRadar.Asset.Name accessor: Value transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2305, "y": 2460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "165": id: "165" taskid: b35aeb4f-d9f1-41f6-850a-a4b482a2bb8c type: title task: id: b35aeb4f-d9f1-41f6-850a-a4b482a2bb8c version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 1875, "y": 3455 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "166": id: "166" taskid: 5590f9d8-8ff3-4775-8bd0-16d911adb755 type: title task: id: 5590f9d8-8ff3-4775-8bd0-16d911adb755 version: -1 name: Set detecetd Values type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "178" separatecontext: false view: |- { "position": { "x": 1875, "y": 1640 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "167": id: "167" taskid: 483eaadc-4742-47fa-8f9e-f39f02c8eefd type: regular task: id: 483eaadc-4742-47fa-8f9e-f39f02c8eefd version: -1 name: | QRadar Full Search on IP description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: IPAddress transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) ILIKE '%$1%' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: DATEFORMAT(devicetime,'dd-MM-yyyy hh:mm'),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid), suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1670, "y": 1175 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "168": id: "168" taskid: 97d66679-4345-44cc-8e45-7682f562c85b type: regular task: id: 97d66679-4345-44cc-8e45-7682f562c85b version: -1 name: QRadar Full Search on SHA256 description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: FileSHA256 transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) ILIKE '%$1%' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: DATEFORMAT(devicetime,'dd-MM-yyyy hh:mm'),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid), suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 170, "y": 1445 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "169": id: "169" taskid: c6fc16a8-fb56-46d7-8053-384a433b5771 type: regular task: id: c6fc16a8-fb56-46d7-8053-384a433b5771 version: -1 name: QRadar Full Search on SHA256 description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: inputs.QradarSHA256Field transformers: - operator: ProductJoin args: join: value: simple: "=" list2: value: simple: inputs.SHA256 iscontext: true - operator: join args: separator: value: simple: ''' OR "' - operator: replaceMatch args: regex: value: simple: "=" replaceWith: value: simple: '" = ''' - operator: concat args: prefix: value: simple: ' from events where "' suffix: {} - operator: concat args: prefix: value: simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) ' suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ''' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 600, "y": 1445 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "170": id: "170" taskid: 6621a3dc-3b43-471a-8294-1e1fb8238276 type: regular task: id: 6621a3dc-3b43-471a-8294-1e1fb8238276 version: -1 name: QRadar Full Search on SHA1 description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: inputs.QradarSHA1Field transformers: - operator: ProductJoin args: join: value: simple: "=" list2: value: simple: inputs.SHA1 iscontext: true - operator: join args: separator: value: simple: ''' OR "' - operator: replaceMatch args: regex: value: simple: "=" replaceWith: value: simple: '" = ''' - operator: concat args: prefix: value: simple: ' from events where "' suffix: {} - operator: concat args: prefix: value: simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) ' suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ''' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -280, "y": 1465 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "171": id: "171" taskid: b9df3e96-97ba-453d-8070-dfb8338c6ee9 type: regular task: id: b9df3e96-97ba-453d-8070-dfb8338c6ee9 version: -1 name: QRadar Full Search on SHA1 description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: FileSHA1 transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) ILIKE '%$1%' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: DATEFORMAT(devicetime,'dd-MM-yyyy hh:mm'),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid), suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -710, "y": 1465 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "172": id: "172" taskid: 1260ad7c-2e3f-4cb1-8137-cfd4d023d16d type: regular task: id: 1260ad7c-2e3f-4cb1-8137-cfd4d023d16d version: -1 name: QRadar Full Search on IP description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: inputs.QradarIPfield transformers: - operator: ProductJoin args: join: value: simple: "=" list2: value: simple: inputs.IPAddress iscontext: true - operator: join args: separator: value: simple: ''' OR "' - operator: replaceMatch args: regex: value: simple: "=" replaceWith: value: simple: '" = ''' - operator: concat args: prefix: value: simple: ' from events where "' suffix: {} - operator: concat args: prefix: value: simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) ' suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ''' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2100, "y": 1175 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "173": id: "173" taskid: e4a747c0-ca2e-4a51-859d-e33a002a979b type: regular task: id: e4a747c0-ca2e-4a51-859d-e33a002a979b version: -1 name: Qradar Full Search on MD5 description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: FileMD5 transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) ILIKE '%$1%' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: DATEFORMAT(devicetime,'dd-MM-yyyy hh:mm'),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid), suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1590, "y": 1465 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "174": id: "174" taskid: a468e334-bc35-4395-88d0-55cec984dc60 type: regular task: id: a468e334-bc35-4395-88d0-55cec984dc60 version: -1 name: QRadar Full Search on Domain/URL description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: DomainURL transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: UTF8(payload) ILIKE '%$1%' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: value: simple: ' from events where ' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) ' suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2570, "y": 1165 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "175": id: "175" taskid: d2f85e1c-d849-42a9-8783-e3afbea7c91b type: regular task: id: d2f85e1c-d849-42a9-8783-e3afbea7c91b version: -1 name: QRadar Full Search on Domain/URL description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: inputs.QradarURLDomainField transformers: - operator: ProductJoin args: join: value: simple: ILIKE list2: value: simple: inputs.URLDomain iscontext: true - operator: join args: separator: value: simple: '%'' OR "' - operator: replaceMatch args: regex: value: simple: ILIKE replaceWith: value: simple: '" ILIKE ''%' - operator: concat args: prefix: value: simple: ' from events where "' suffix: {} - operator: concat args: prefix: value: simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) ' suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: 'select ' suffix: {} - operator: concat args: prefix: {} suffix: value: simple: '%'' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3000, "y": 1175 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "176": id: "176" taskid: 82ef281a-644a-4657-8453-50ca8ce25bdd type: title task: id: 82ef281a-644a-4657-8453-50ca8ce25bdd version: -1 name: Indicator Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" - "5" - "6" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1875, "y": 210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "178": id: "178" taskid: 116782ab-603b-493c-8079-e003e251ab6c type: condition task: id: 116782ab-603b-493c-8079-e003e251ab6c version: -1 name: Has query results? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "120" "yes": - "182" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: QRadar.SearchEvents accessor: Events iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 1875, "y": 1770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "181": id: "181" taskid: b4328ddc-50db-4488-8444-48fcac80a903 type: regular task: id: b4328ddc-50db-4488-8444-48fcac80a903 version: -1 name: QRadar Full Search on MD5 description: Polling command to search for events of a specific offense. script: '|||qradar-search-retrieve-events' type: regular iscommand: true brand: "" nexttasks: '#none#': - "166" scriptarguments: interval_in_seconds: simple: "1" polling: simple: "true" query_expression: complex: root: inputs.QradarMD5Field transformers: - operator: ProductJoin args: join: value: simple: "=" list2: value: simple: inputs.MD5 iscontext: true - operator: join args: separator: value: simple: ''' OR "' - operator: replaceMatch args: regex: value: simple: "=" replaceWith: value: simple: '" = ''' - operator: concat args: prefix: value: simple: ' from events where "' suffix: {} - operator: concat args: prefix: value: simple: 'DATEFORMAT(devicetime,''dd-MM-yyyy hh:mm''),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid) ' suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationUserFields iscontext: true suffix: {} - operator: concat args: prefix: value: simple: ',' suffix: {} - operator: concat args: prefix: value: simple: inputs.InvestigationIPFields iscontext: true suffix: {} - operator: concat args: prefix: {} suffix: value: simple: ''' ' - operator: concat args: prefix: value: simple: 'select ' suffix: value: simple: inputs.TimeFrame iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1160, "y": 1465 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "182": id: "182" taskid: 5414f421-9773-4d5b-83da-d723d429bfdb type: regular task: id: 5414f421-9773-4d5b-83da-d723d429bfdb version: -1 name: Set detected source and destination IP addresses description: Sets a value into the context with the given context key scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "161" scriptarguments: append: simple: "true" key: simple: QRadar.DetectedIPs value: complex: root: ${ accessor: =[]} transformers: - operator: GetValuesOfMultipleFields args: key: value: simple: QRadar.SearchEvents.Events iscontext: true list: value: simple: inputs.InvestigationIPFields iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2305, "y": 1950 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false system: true view: |- { "linkLabelsPosition": { "11_56_#default#": 0.61, "124_165_#default#": 0.65, "22_166_#default#": 0.1, "29_166_#default#": 0.12, "39_166_#default#": 0.19, "55_176_yes": 0.44, "8_166_#default#": 0.1, "8_26_yes": 0.73, "9_166_#default#": 0.25 }, "paper": { "dimensions": { "height": 3645, "width": 4970, "x": -1590, "y": -125 } } } inputs: - key: MD5 value: {} required: false description: MD5 hash file or an array of hashes to search. playbookInputQuery: - key: QradarMD5Field value: {} required: false description: MD5 field to search in QRadar. If none are specified, the search will use a payload contains filter. playbookInputQuery: - key: SHA1 value: {} required: false description: SHA1 hash file or an array of hashes to search. playbookInputQuery: - key: QradarSHA1Field value: {} required: false description: SHA1 field to search in QRadar. If none are specified, the search will use a payload contains filter. playbookInputQuery: - key: SHA256 value: {} required: false description: SHA256 hash file or an array of hashes to search. playbookInputQuery: - key: QradarSHA256Field value: {} required: false description: SHA256 field to search in QRadar. If none are specified, the search will use a payload contains filter. playbookInputQuery: - key: IPAddress value: {} required: false description: | Source or destination IP to search. Can be a single address or an array of addresses. playbookInputQuery: - key: QradarIPfield value: simple: sourceip,destinationip required: false description: IP field to search in QRadar. If none are specified, the search will use sourceip or destinationip (combined). playbookInputQuery: - key: URLDomain value: {} required: false description: | Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used. playbookInputQuery: - key: QradarURLDomainField value: {} required: false description: 'URL/Domain field to search in QRadar. If none are specified, the search will use a payload contains filter. ' playbookInputQuery: - key: TimeFrame value: simple: LAST 7 DAYS required: false description: |- Time frame as used in AQL Examples can be LAST 7 DAYS START '2019-09-25 15:51' STOP '2019-09-25 17:51' For more examples review IBM's AQL documentation. playbookInputQuery: - key: InternalRange value: complex: root: lists accessor: PrivateIPs transformers: - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2}) unpack_matches: {} - operator: join args: separator: value: simple: ',' required: false description: 'A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).' playbookInputQuery: - key: InvestigationIPFields value: simple: sourceip,destinationip required: true description: The values of these QRadar fields will be used for the playbook IP addresses outputs. playbookInputQuery: - key: InvestigationUserFields value: simple: username required: true description: The values of these QRadar fields will be used for the playbook user name outputs. playbookInputQuery: outputs: - contextPath: QRadar.DetectedUsers description: Users detected based on the username field in your search. type: string - contextPath: QRadar.DetectedInternalIPs description: Internal IP addresses detected based on fields and inputs in your search. type: string - contextPath: QRadar.DetectedExternalIPs description: External IP addresses detected based on fields and inputs in your search. type: string - contextPath: QRadar.DetectedInternalHosts description: Internal host names detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar. type: string - contextPath: QRadar.DetectedExternalHosts description: External host names detected based on hosts in your assets table. Note that the data accuracy depends on how the Asset mapping is configured in QRadar. type: string tests: - test_Qradar_v2 - QRadar_v3-test - QRadar Indicator Hunting Test fromversion: 5.0.0 supportedModules: - agentix - xsiam - edr - cloud - cloud_runtime_security