id: Search Endpoints By Hash - Carbon Black Response V2
version: -1
name: Search Endpoints By Hash - Carbon Black Response V2
description: Hunt for malicious indicators using Carbon Black
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: edc8b672-13e8-48fa-87c9-594118876ac4
    type: start
    task:
      id: edc8b672-13e8-48fa-87c9-594118876ac4
      version: -1
      name: ""
      description: Playbook start point
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 71c8642a-2af7-4af6-8015-5a2f89fd40d2
    type: regular
    task:
      id: 71c8642a-2af7-4af6-8015-5a2f89fd40d2
      version: -1
      name: Hunt MD5 Hash
      description: Query processes based on given parameters
      script: '|||cb-get-processes'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      facet: {}
      group: {}
      hostname: {}
      md5:
        complex:
          root: inputs
          accessor: Hash
      name: {}
      parent-process-name: {}
      process-path: {}
      query: {}
      rows: {}
      sort: {}
      start: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: a43ea7bf-d5e3-4c0b-8da7-5ce65cc1aae3
    type: condition
    task:
      id: a43ea7bf-d5e3-4c0b-8da7-5ce65cc1aae3
      version: -1
      name: Is Carbon Black enabled?
      description: Is Carbon Black enabled?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "5"
    scriptarguments:
      value:
        simple: ${modules(val.brand == 'carbonblack' && val.state == 'active')}
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: carbonblack-v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 108ba97d-b9da-4162-808d-025b5f6b7986
    type: title
    task:
      id: 108ba97d-b9da-4162-808d-025b5f6b7986
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 00c09fd8-6352-4b6c-8e7a-5a2459544fc7
    type: condition
    task:
      id: 00c09fd8-6352-4b6c-8e7a-5a2459544fc7
      version: -1
      name: Is there an MD5 hash to hunt?
      description: Checks if there is an MD5 hash to hunt.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Hash
            iscontext: true
    view: |-
      {
        "position": {
          "x": 290,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: 4fd8eec7-f7ec-4f53-8473-932db46cc0ec
    type: title
    task:
      id: 4fd8eec7-f7ec-4f53-8473-932db46cc0ec
      version: -1
      name: Hunt MD5
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 863da4aa-ab0b-416b-8072-1f36602773aa
    type: title
    task:
      id: 863da4aa-ab0b-416b-8072-1f36602773aa
      version: -1
      name: No Integration \ No Hash
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "2_5_yes": 0.41,
      "2_7_#default#": 0.42,
      "5_6_yes": 0.47,
      "5_7_#default#": 0.41
    },
    "paper": {
      "dimensions": {
        "height": 880,
        "width": 830,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: Hash
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: MD5 Hash
outputs:
- contextPath: Endpoint.Hostname
  description: The device hostname
  type: string
- contextPath: Endpoint
  description: The endpoint
  type: unknown
fromversion: 5.0.0
tests:
- No tests