id: Splunk Indicator Hunting version: -1 contentitemexportablefields: contentitemfields: {} name: Splunk Indicator Hunting description: This playbook queries Splunk for indicators such as file hashes, IP addresses, domains, or urls. It outputs detected users, ip addresses, and hostnames related to the indicators. starttaskid: "0" tasks: "0": id: "0" taskid: 4dbd8b35-00b4-42eb-8b71-43c7b3ca437d type: start task: id: 4dbd8b35-00b4-42eb-8b71-43c7b3ca437d version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "54" separatecontext: false view: |- { "position": { "x": 780, "y": -280 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "2": id: "2" taskid: 9dd2e0ca-2b1f-4f73-8bfb-019540e5b2f9 type: title task: id: 9dd2e0ca-2b1f-4f73-8bfb-019540e5b2f9 version: -1 name: Hash Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "8" separatecontext: false view: |- { "position": { "x": -690, "y": 210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "5": id: "5" taskid: cece138b-9b8e-4227-8f30-df121b32b2a5 type: title task: id: cece138b-9b8e-4227-8f30-df121b32b2a5 version: -1 name: IP Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "7" separatecontext: false view: |- { "position": { "x": 990, "y": 200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "6": id: "6" taskid: 32b954e1-13a3-4ad0-850c-0da6d85df323 type: title task: id: 32b954e1-13a3-4ad0-850c-0da6d85df323 version: -1 name: Domain/Url Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "9" separatecontext: false view: |- { "position": { "x": 3230, "y": 190 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "7": id: "7" taskid: 3b810ab0-fa13-4c0f-843a-8bd9c41f0abd type: condition task: id: 3b810ab0-fa13-4c0f-843a-8bd9c41f0abd version: -1 name: Is there an IP to search? description: Checks if IP Addresses were provided. type: condition iscommand: false brand: "" nexttasks: '#default#': - "48" "yes": - "50" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.IPAddress iscontext: true view: |- { "position": { "x": 990, "y": 420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "8": id: "8" taskid: 9fe62da8-c3ff-4857-8cbf-107a460b3769 type: condition task: id: 9fe62da8-c3ff-4857-8cbf-107a460b3769 version: -1 name: Is there a hash to search? description: Checks if file hashes were provided. type: condition iscommand: false brand: "" nexttasks: '#default#': - "48" "yes": - "26" - "27" - "38" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.MD5 iscontext: true - operator: isNotEmpty left: value: simple: inputs.SHA1 iscontext: true - operator: isNotEmpty left: value: simple: inputs.SHA256 iscontext: true view: |- { "position": { "x": -690, "y": 355 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "9": id: "9" taskid: 7a980f98-9398-410c-8999-83634bdb290e type: condition task: id: 7a980f98-9398-410c-8999-83634bdb290e version: -1 name: Is there a Domain/Url to search? description: Checks if Domains/URLs were provided. type: condition iscommand: false brand: "" nexttasks: '#default#': - "48" "yes": - "11" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.URLDomain iscontext: true view: |- { "position": { "x": 3230, "y": 480 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "11": id: "11" taskid: 408b9ad3-8041-4087-8ed6-ca8bff8b8303 type: condition task: id: 408b9ad3-8041-4087-8ed6-ca8bff8b8303 version: -1 name: Was there a custom domain/url field? description: Checks if a custom Domain/URL field was provided. type: condition iscommand: false brand: "" nexttasks: '#default#': - "89" "yes": - "90" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.SplunkURLDomainField iscontext: true view: |- { "position": { "x": 3230, "y": 970 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "20": id: "20" taskid: 995c1f61-e31d-419e-8483-f24c474fe032 type: regular task: id: 995c1f61-e31d-419e-8483-f24c474fe032 version: -1 name: Set MD5 to an array description: Sets a value into the context with the given context key. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "69" scriptarguments: append: simple: "true" key: simple: FileMD5 value: complex: root: inputs.MD5 transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": -2920, "y": 1510 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "21": id: "21" taskid: bb8c1514-4c47-4e3b-8760-3efd46ae9fc5 type: condition task: id: bb8c1514-4c47-4e3b-8760-3efd46ae9fc5 version: -1 name: Was there a custom MD5 field? description: Checks if a custom MD5 field was provided. type: condition iscommand: false brand: "" nexttasks: '#default#': - "82" "yes": - "81" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.SplunkMD5Field iscontext: true view: |- { "position": { "x": -2700, "y": 1130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "22": id: "22" taskid: 79861dce-e4fa-4c6e-857b-7421cc285cdf type: condition task: id: 79861dce-e4fa-4c6e-857b-7421cc285cdf version: -1 name: Is there an MD5 to search? description: Checks for file MD5 hashes. type: condition iscommand: false brand: "" nexttasks: '#default#': - "48" "yes": - "21" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.MD5 iscontext: true view: |- { "position": { "x": -1900, "y": 805 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "26": id: "26" taskid: c3559eab-0438-4e18-8fa9-779588ef1b2a type: title task: id: c3559eab-0438-4e18-8fa9-779588ef1b2a version: -1 name: MD5 Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "22" separatecontext: false view: |- { "position": { "x": -1900, "y": 640 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "27": id: "27" taskid: bb0c3fab-62b6-430e-8b43-28e8270d4274 type: title task: id: bb0c3fab-62b6-430e-8b43-28e8270d4274 version: -1 name: SHA1 Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "29" separatecontext: false view: |- { "position": { "x": -1400, "y": 640 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "29": id: "29" taskid: 97959f35-e288-4d03-86a0-385efcaebae7 type: condition task: id: 97959f35-e288-4d03-86a0-385efcaebae7 version: -1 name: Is there a SHA1 hash to search description: Checks for file SHA1 hashes. type: condition iscommand: false brand: "" nexttasks: '#default#': - "48" "yes": - "31" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.SHA1 iscontext: true view: |- { "position": { "x": -960, "y": 805 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "31": id: "31" taskid: ad012562-482d-466f-855b-691797adad4c type: condition task: id: ad012562-482d-466f-855b-691797adad4c version: -1 name: Was there a custom SHA1 field? description: Checks if a custom SHA1 field was provided. type: condition iscommand: false brand: "" nexttasks: '#default#': - "84" "yes": - "83" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.SplunkSHA1Field iscontext: true view: |- { "position": { "x": -1400, "y": 1130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "38": id: "38" taskid: 1d9bf6ee-8637-4da9-8c31-8b368ff5b2f9 type: title task: id: 1d9bf6ee-8637-4da9-8c31-8b368ff5b2f9 version: -1 name: SHA256 Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "39" separatecontext: false view: |- { "position": { "x": -240, "y": 640 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "39": id: "39" taskid: 77b76600-1062-43f7-874e-e51bb764277d type: condition task: id: 77b76600-1062-43f7-874e-e51bb764277d version: -1 name: Is there a SHA256 hash to search description: Checks for file SHA256 hashes. type: condition iscommand: false brand: "" nexttasks: '#default#': - "48" "yes": - "41" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.SHA256 iscontext: true view: |- { "position": { "x": 360, "y": 805 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "41": id: "41" taskid: d90ad2cb-c6a5-4d2a-8206-76ec8df2058c type: condition task: id: d90ad2cb-c6a5-4d2a-8206-76ec8df2058c version: -1 name: Was there a custom SHA256 field? description: Checks if a custom SHA256 field was provided. type: condition iscommand: false brand: "" nexttasks: '#default#': - "86" "yes": - "85" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.SplunkSHA256Field iscontext: true view: |- { "position": { "x": -70, "y": 1130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "48": id: "48" taskid: 2b4d9f60-e913-47bf-816e-177b48d6d69e type: title task: id: 2b4d9f60-e913-47bf-816e-177b48d6d69e version: -1 name: Done Searching type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "107" separatecontext: false view: |- { "position": { "x": 780, "y": 2550 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "50": id: "50" taskid: 80cfe8d1-e4fb-4d02-8cff-4552d1417cd4 type: condition task: id: 80cfe8d1-e4fb-4d02-8cff-4552d1417cd4 version: -1 name: Was there a custom IP field? description: Checks if a custom IP Address field was provided. type: condition iscommand: false brand: "" nexttasks: '#default#': - "88" "yes": - "87" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.SplunkIPField iscontext: true view: |- { "position": { "x": 1380, "y": 1130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "54": id: "54" taskid: 686ecff8-7171-428e-8c32-f7ef1d729212 type: condition task: id: 686ecff8-7171-428e-8c32-f7ef1d729212 version: -1 name: Is Splunk enabled? description: Checks if SplunkPY integration is enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "48" "yes": - "2" - "5" - "6" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: inList left: value: simple: modules.brand iscontext: true right: value: simple: SplunkPy,SplunkPy v2 - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active iscontext: true view: |- { "position": { "x": 780, "y": -140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "57": id: "57" taskid: 7596ee18-8727-4dfb-866c-714fd898b7b2 type: regular task: id: 7596ee18-8727-4dfb-866c-714fd898b7b2 version: -1 name: Splunk search with custom fields description: Search Splunk for events using custom fields. tags: - SIEMResults script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "48" scriptarguments: earliest_time: simple: ${inputs.earliest_time} event_limit: simple: ${inputs.event_limit} latest_time: simple: ${inputs.latest_time} query: complex: root: inputs.URLDomain transformers: - operator: ProductJoin args: join: value: simple: ' *' list2: value: simple: inputs.SplunkURLDomainField iscontext: true - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: $1* - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: {} suffix: value: simple: ') | table ' - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.SelectFields iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.IPFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.UserFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.HostFieldsToReturn iscontext: true - operator: concat args: prefix: value: simple: ' (' suffix: {} - operator: concat args: prefix: value: simple: inputs.IndexName iscontext: true suffix: {} - operator: concat args: prefix: value: simple: index= suffix: {} separatecontext: false view: |- { "position": { "x": 3010, "y": 1885 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" evidencedata: description: simple: Splunk search results customfields: {} "64": id: "64" taskid: b4e5b9eb-0112-4833-8bbf-d4aba5d2df03 type: regular task: id: b4e5b9eb-0112-4833-8bbf-d4aba5d2df03 version: -1 name: Splunk search with custom fields description: Search Splunk for events using custom fields. tags: - SIEMResults script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "48" scriptarguments: earliest_time: simple: ${inputs.earliest_time} event_limit: simple: ${inputs.event_limit} latest_time: simple: ${inputs.latest_time} query: complex: root: inputs.SplunkIPField transformers: - operator: ProductJoin args: join: value: simple: '=' list2: value: simple: inputs.IPAddress iscontext: true - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: {} suffix: value: simple: ') | table ' - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.SelectFields iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.IPFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.UserFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: value: simple: ' (' suffix: {} - operator: concat args: prefix: {} suffix: value: simple: inputs.HostFieldsToReturn iscontext: true - operator: concat args: prefix: value: simple: inputs.IndexName iscontext: true suffix: {} - operator: concat args: prefix: value: simple: index= suffix: {} separatecontext: false view: |- { "position": { "x": 1150, "y": 1885 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" evidencedata: description: simple: Splunk search results customfields: {} "69": id: "69" taskid: ce1a0fc1-6855-4037-8532-8ba57c3fedce type: regular task: id: ce1a0fc1-6855-4037-8532-8ba57c3fedce version: -1 name: Splunk search without custom fields description: Search Splunk for events without using custom fields. tags: - SIEMResults script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "48" scriptarguments: earliest_time: simple: ${inputs.earliest_time} event_limit: simple: ${inputs.event_limit} latest_time: simple: ${inputs.latest_time} query: complex: root: FileMD5 transformers: - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: {} suffix: value: simple: ') | table ' - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.SelectFields iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.IPFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.UserFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.HostFieldsToReturn iscontext: true - operator: concat args: prefix: value: simple: ' (' suffix: {} - operator: concat args: prefix: value: simple: inputs.IndexName iscontext: true suffix: {} - operator: concat args: prefix: value: simple: index= suffix: {} separatecontext: false view: |- { "position": { "x": -2920, "y": 1885 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" evidencedata: description: simple: Splunk search results. customfields: {} "71": id: "71" taskid: 751a2763-0efc-44b1-895d-914cd88354de type: regular task: id: 751a2763-0efc-44b1-895d-914cd88354de version: -1 name: Splunk search without custom fields description: Searches Splunk for events without using custom fields. tags: - SIEMResults script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "48" scriptarguments: earliest_time: simple: ${inputs.earliest_time} event_limit: simple: ${inputs.event_limit} latest_time: simple: ${inputs.latest_time} query: complex: root: FileSHA1 transformers: - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: {} suffix: value: simple: ') | table ' - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.SelectFields iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.IPFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.UserFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.HostFieldsToReturn iscontext: true - operator: concat args: prefix: value: simple: ' (' suffix: {} - operator: concat args: prefix: value: simple: inputs.IndexName iscontext: true suffix: {} - operator: concat args: prefix: value: simple: index= suffix: {} separatecontext: false view: |- { "position": { "x": -1610, "y": 1885 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" evidencedata: description: simple: Splunk search results customfields: {} "72": id: "72" taskid: c37977c9-cd6e-4c8a-8f66-d2bd0bfadb35 type: regular task: id: c37977c9-cd6e-4c8a-8f66-d2bd0bfadb35 version: -1 name: Splunk search without custom fields description: Searches Splunk for events without using custom fields. tags: - SIEMResults script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "48" scriptarguments: earliest_time: simple: ${inputs.earliest_time} event_limit: simple: ${inputs.event_limit} latest_time: simple: ${inputs.latest_time} query: complex: root: FileSHA256 transformers: - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: {} suffix: value: simple: ') | table ' - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.SelectFields iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.IPFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.UserFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.HostFieldsToReturn iscontext: true - operator: concat args: prefix: value: simple: ' (' suffix: {} - operator: concat args: prefix: value: simple: inputs.IndexName iscontext: true suffix: {} - operator: concat args: prefix: value: simple: index= suffix: {} separatecontext: false view: |- { "position": { "x": -370, "y": 1885 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" evidencedata: description: simple: Splunk search results customfields: {} "74": id: "74" taskid: c4e54ccb-4aba-4081-822e-4eb14578c2e9 type: regular task: id: c4e54ccb-4aba-4081-822e-4eb14578c2e9 version: -1 name: Splunk search without custom fields description: Searches Splunk for events without using custom fields. tags: - SIEMResults script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "48" scriptarguments: earliest_time: simple: ${inputs.earliest_time} event_limit: simple: ${inputs.event_limit} latest_time: simple: ${inputs.latest_time} query: complex: root: DomainURL transformers: - operator: replaceMatch args: regex: value: simple: (.*) replaceWith: value: simple: '*$1*' - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: {} suffix: value: simple: ') | table ' - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.SelectFields iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.IPFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.UserFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.HostFieldsToReturn iscontext: true - operator: concat args: prefix: value: simple: ' (' suffix: {} - operator: concat args: prefix: value: simple: inputs.IndexName iscontext: true suffix: {} - operator: concat args: prefix: value: simple: index= suffix: {} separatecontext: false view: |- { "position": { "x": 3460, "y": 1885 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" evidencedata: description: simple: Splunk search results customfields: {} "78": id: "78" taskid: 88048c43-28ad-416f-8231-ad6fbe25995d type: regular task: id: 88048c43-28ad-416f-8231-ad6fbe25995d version: -1 name: Splunk search with custom fields description: Searches Splunk for events using custom fields. tags: - SIEMResults script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "48" scriptarguments: earliest_time: simple: ${inputs.earliest_time} event_limit: simple: ${inputs.event_limit} latest_time: simple: ${inputs.latest_time} query: complex: root: inputs.SplunkSHA1Field transformers: - operator: ProductJoin args: join: value: simple: '=' list2: value: simple: inputs.SHA1 iscontext: true - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: {} suffix: value: simple: ') | table ' - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.SelectFields iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.IPFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.UserFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.HostFieldsToReturn iscontext: true - operator: concat args: prefix: value: simple: ' (' suffix: {} - operator: concat args: prefix: value: simple: inputs.IndexName iscontext: true suffix: {} - operator: concat args: prefix: value: simple: index= suffix: {} separatecontext: false view: |- { "position": { "x": -1200, "y": 1885 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" evidencedata: description: simple: Splunk search results customfields: {} "79": id: "79" taskid: 496973d6-a6f4-497f-8664-d2b715fc1ac3 type: regular task: id: 496973d6-a6f4-497f-8664-d2b715fc1ac3 version: -1 name: Splunk search with custom fields description: Searches Splunk for events using custom fields. tags: - SIEMResults script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "48" scriptarguments: earliest_time: simple: ${inputs.earliest_time} event_limit: simple: ${inputs.event_limit} latest_time: simple: ${inputs.latest_time} query: complex: root: inputs.SplunkSHA256Field transformers: - operator: ProductJoin args: join: value: simple: '=' list2: value: simple: inputs.SHA256 iscontext: true - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: {} suffix: value: simple: ') | table ' - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.SelectFields iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.IPFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.UserFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.HostFieldsToReturn iscontext: true - operator: concat args: prefix: value: simple: ' (' suffix: {} - operator: concat args: prefix: value: simple: inputs.IndexName iscontext: true suffix: {} - operator: concat args: prefix: value: simple: index= suffix: {} separatecontext: false view: |- { "position": { "x": 80, "y": 1885 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" evidencedata: description: simple: Splunk search results customfields: {} "80": id: "80" taskid: 7d7af565-85c8-4e6d-8684-ef0badadee86 type: regular task: id: 7d7af565-85c8-4e6d-8684-ef0badadee86 version: -1 name: Splunk search without custom fields description: Searches Splunk for events. tags: - SIEMResults script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "48" scriptarguments: earliest_time: simple: ${inputs.earliest_time} event_limit: simple: ${inputs.event_limit} latest_time: simple: ${inputs.latest_time} query: complex: root: IPAddress transformers: - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: {} suffix: value: simple: ') | table ' - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.SelectFields iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.IPFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.UserFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.HostFieldsToReturn iscontext: true - operator: concat args: prefix: value: simple: ' (' suffix: {} - operator: concat args: prefix: value: simple: inputs.IndexName iscontext: true suffix: {} - operator: concat args: prefix: value: simple: index= suffix: {} separatecontext: false view: |- { "position": { "x": 1570, "y": 1885 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" evidencedata: description: simple: Splunk search results customfields: {} "81": id: "81" taskid: a460d968-b21e-4560-8904-e91172dd8f50 type: title task: id: a460d968-b21e-4560-8904-e91172dd8f50 version: -1 name: Splunk query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "122" separatecontext: false view: |- { "position": { "x": -2490, "y": 1320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "82": id: "82" taskid: 874f982c-7c14-4c4a-80b1-ce0b06fc12c6 type: title task: id: 874f982c-7c14-4c4a-80b1-ce0b06fc12c6 version: -1 name: Splunk-free text query type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "20" separatecontext: false view: |- { "position": { "x": -2920, "y": 1320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "83": id: "83" taskid: 78020ff1-a587-4479-8c95-0bb03f9e6ace type: title task: id: 78020ff1-a587-4479-8c95-0bb03f9e6ace version: -1 name: Splunk query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "78" separatecontext: false view: |- { "position": { "x": -1200, "y": 1330 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "84": id: "84" taskid: b77258be-0d37-4adf-8d46-7abcd45ae834 type: title task: id: b77258be-0d37-4adf-8d46-7abcd45ae834 version: -1 name: Splunk-free text query type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "112" separatecontext: false view: |- { "position": { "x": -1610, "y": 1330 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "85": id: "85" taskid: 8f2c1cc4-1bc1-4fb8-8f2d-469b6a64646d type: title task: id: 8f2c1cc4-1bc1-4fb8-8f2d-469b6a64646d version: -1 name: Splunk query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "79" separatecontext: false view: |- { "position": { "x": 80, "y": 1330 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "86": id: "86" taskid: 40e20f5c-d512-4f09-8819-0ff00575e505 type: title task: id: 40e20f5c-d512-4f09-8819-0ff00575e505 version: -1 name: Splunk-free text query type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "113" separatecontext: false view: |- { "position": { "x": -370, "y": 1330 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "87": id: "87" taskid: ae105610-32c4-44ba-8b7f-c9bc3b8be0c1 type: title task: id: ae105610-32c4-44ba-8b7f-c9bc3b8be0c1 version: -1 name: Splunk query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "64" separatecontext: false view: |- { "position": { "x": 1150, "y": 1330 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "88": id: "88" taskid: 66259488-2ddd-48b9-83d2-3e756291fe8e type: title task: id: 66259488-2ddd-48b9-83d2-3e756291fe8e version: -1 name: Splunk-free text query type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "114" separatecontext: false view: |- { "position": { "x": 1570, "y": 1330 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "89": id: "89" taskid: 4e260a76-f248-438e-8506-d6a50ef9698a type: title task: id: 4e260a76-f248-438e-8506-d6a50ef9698a version: -1 name: Splunk-free text query type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "115" separatecontext: false view: |- { "position": { "x": 3460, "y": 1340 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "90": id: "90" taskid: 2f14773a-41a5-4f64-8ba3-d1470884d2f2 type: title task: id: 2f14773a-41a5-4f64-8ba3-d1470884d2f2 version: -1 name: Splunk-query with custom fields type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "57" separatecontext: false view: |- { "position": { "x": 3010, "y": 1340 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "107": id: "107" taskid: f0e75230-31e4-47ce-82e4-edfdb8fc643a type: condition task: id: f0e75230-31e4-47ce-82e4-edfdb8fc643a version: -1 name: Have results been detected? description: Checks for query results. type: condition iscommand: false brand: "" nexttasks: '#default#': - "127" "yes": - "123" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: Splunk.Result iscontext: true view: |- { "position": { "x": 780, "y": 2785 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "108": id: "108" taskid: 83c25e49-c267-4cb0-839a-f76e16bb31ef type: regular task: id: 83c25e49-c267-4cb0-839a-f76e16bb31ef version: -1 name: Set detected IP addresses description: Checks if the IP addresses were returned in the search results. If the IP addresses were returned, they are set in Context. Otherwise, no value is set. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "116" scriptarguments: append: simple: "true" key: simple: Splunk.DetectedIPs value: complex: root: ${ accessor: =[]} transformers: - operator: GetValuesOfMultipleFields args: key: value: simple: Splunk.Result iscontext: true list: value: simple: inputs.IPFieldsToReturn iscontext: true separatecontext: false view: |- { "position": { "x": 2820, "y": 3490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "109": id: "109" taskid: 7a1c9314-ffe0-45d7-8679-a4287c1be666 type: regular task: id: 7a1c9314-ffe0-45d7-8679-a4287c1be666 version: -1 name: Set detected user names description: Checks if the user names were returned in the search results. If the user names were returned, they are set in Context. Otherwise, no value is set. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "127" scriptarguments: append: simple: "true" key: simple: Splunk.DetectedUsers value: complex: root: ${ accessor: =[]} transformers: - operator: GetValuesOfMultipleFields args: key: value: simple: Splunk.Result iscontext: true list: value: simple: inputs.UserFieldsToReturn iscontext: true separatecontext: false view: |- { "position": { "x": 1050, "y": 3460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "110": id: "110" taskid: 4e7f15e5-94b0-48ed-8d59-063556a3afdc type: regular task: id: 4e7f15e5-94b0-48ed-8d59-063556a3afdc version: -1 name: Set detected host names description: Checks if host names were returned in the search results. If host names were returned, they are set in Context. Otherwise, no value is set. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "138" scriptarguments: append: simple: "true" key: simple: Splunk.DetectedHosts value: complex: root: ${ accessor: =[]} transformers: - operator: GetValuesOfMultipleFields args: key: value: simple: Splunk.Result iscontext: true list: value: simple: inputs.HostFieldsToReturn iscontext: true separatecontext: false view: |- { "position": { "x": 1940, "y": 3460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "112": id: "112" taskid: bae26731-6c85-4c18-88cf-97082ed68410 type: regular task: id: bae26731-6c85-4c18-88cf-97082ed68410 version: -1 name: Set a SHA1 hash to array description: Sets a SHA1 hash value into the context with the given context key. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "71" scriptarguments: append: simple: "true" key: simple: FileSHA1 value: complex: root: inputs.SHA1 transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": -1610, "y": 1510 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "113": id: "113" taskid: 1ebf3a16-3fd7-4e5e-8c0b-0592a517e26c type: regular task: id: 1ebf3a16-3fd7-4e5e-8c0b-0592a517e26c version: -1 name: Set a SHA256 hash to array description: Sets a SHA256 hash value into the context with the given context key. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "72" scriptarguments: append: simple: "true" key: simple: FileSHA256 value: complex: root: inputs.SHA256 transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": -370, "y": 1510 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "114": id: "114" taskid: 454c062c-5a6b-4445-8f26-cf7adec60d8b type: regular task: id: 454c062c-5a6b-4445-8f26-cf7adec60d8b version: -1 name: Set an IP address to array description: Sets a value for an IP address into the context with the given context key. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "80" scriptarguments: append: simple: "true" key: simple: IPAddress value: complex: root: inputs.IPAddress transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": 1570, "y": 1520 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "115": id: "115" taskid: d969dec2-158b-4b1b-87fd-619ba8c44286 type: regular task: id: d969dec2-158b-4b1b-87fd-619ba8c44286 version: -1 name: Set DomainUrl to array description: Sets a Domain or URL value into the context with the given context key. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "74" scriptarguments: append: simple: "true" key: simple: DomainURL value: complex: root: inputs.URLDomain transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq separatecontext: false view: |- { "position": { "x": 3460, "y": 1510 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "116": id: "116" taskid: 94701cbb-3c79-4bd6-8b8e-c4f476d08018 type: title task: id: 94701cbb-3c79-4bd6-8b8e-c4f476d08018 version: -1 name: Sort internal and external IP addresses type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "117" separatecontext: false view: |- { "position": { "x": 3020, "y": 3800 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "117": id: "117" taskid: 43f8f37e-2771-4084-8f4d-d8ad4b5cf3c7 type: condition task: id: 43f8f37e-2771-4084-8f4d-d8ad4b5cf3c7 version: -1 name: Are there detected IP addresses? description: Checks for IP Addresses that have been detected. type: condition iscommand: false brand: "" nexttasks: '#default#': - "121" "yes": - "118" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: Splunk.DetectedIPs iscontext: true view: |- { "position": { "x": 3020, "y": 3930 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "118": id: "118" taskid: e3b8232b-eee8-42b6-8762-c517c65e8d52 type: regular task: id: e3b8232b-eee8-42b6-8762-c517c65e8d52 version: -1 name: Determine whether the IP address is internal or external description: If the IP address is in one of the ranges provided, a yes value is returned. Otherwise, a no is returned. scriptName: IsIPInRanges type: regular iscommand: false brand: "" nexttasks: '#none#': - "119" scriptarguments: ip: simple: ${Splunk.DetectedIPs} ipRanges: simple: ${inputs.InternalIPRange} separatecontext: false view: |- { "position": { "x": 3290, "y": 4165 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "119": id: "119" taskid: ede48e1d-c9d5-4f4a-8371-7abd66130e62 type: regular task: id: ede48e1d-c9d5-4f4a-8371-7abd66130e62 version: -1 name: Set detected IP addresses as internal description: IP addresses that were found to be internal, are written to the Splunk.DetectedInternalIPs context key. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "120" scriptarguments: append: simple: "true" key: simple: Splunk.DetectedInternalIPs value: complex: root: IP filters: - - operator: isEqualString left: value: simple: IP.InRange iscontext: true right: value: simple: "yes" accessor: Address transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": 3290, "y": 4380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "120": id: "120" taskid: f95fab26-3f29-4fc9-80f2-852af16dc321 type: regular task: id: f95fab26-3f29-4fc9-80f2-852af16dc321 version: -1 name: Set detected IP addresses as external description: IP addresses that were found to be external, are written to the Splunk.DetectedExternalIPs context key. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "121" scriptarguments: append: simple: "true" key: simple: Splunk.DetectedExternalIPs value: complex: root: IP filters: - - operator: isEqualString left: value: simple: IP.InRange iscontext: true right: value: simple: "no" accessor: Address transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": 3290, "y": 4610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "121": id: "121" taskid: 81b349f7-49e5-4ace-8904-191a038cff4d type: title task: id: 81b349f7-49e5-4ace-8904-191a038cff4d version: -1 name: Done sorting IP addresses type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "127" separatecontext: false view: |- { "position": { "x": 3030, "y": 4860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "122": id: "122" taskid: ea997c7a-3a29-41fe-8133-737024d9fc59 type: regular task: id: ea997c7a-3a29-41fe-8133-737024d9fc59 version: -1 name: Splunk search with custom fields description: Searches Splunk for events using custom fields. tags: - SIEMResults script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "48" scriptarguments: earliest_time: simple: ${inputs.earliest_time} event_limit: simple: ${inputs.event_limit} latest_time: simple: ${inputs.latest_time} query: complex: root: inputs.SplunkMD5Field transformers: - operator: ProductJoin args: join: value: simple: '=' list2: value: simple: inputs.MD5 iscontext: true - operator: join args: separator: value: simple: ' OR ' - operator: concat args: prefix: {} suffix: value: simple: ') | table ' - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.SelectFields iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.IPFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.UserFieldsToReturn iscontext: true - operator: concat args: prefix: {} suffix: value: simple: ' ' - operator: concat args: prefix: {} suffix: value: simple: inputs.HostFieldsToReturn iscontext: true - operator: concat args: prefix: value: simple: ' (' suffix: {} - operator: concat args: prefix: value: simple: inputs.IndexName iscontext: true suffix: {} - operator: concat args: prefix: value: simple: index= suffix: {} separatecontext: false view: |- { "position": { "x": -2490, "y": 1885 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" evidencedata: description: simple: Splunk search results customfields: {} "123": id: "123" taskid: eae4ef10-2763-4d01-8a7e-f8dad5db561d type: title task: id: eae4ef10-2763-4d01-8a7e-f8dad5db561d version: -1 name: Setting results to outputs type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "135" - "136" - "137" separatecontext: false view: |- { "position": { "x": 2150, "y": 2960 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "124": id: "124" taskid: f88e73b5-b0b9-416e-8d29-f828e02f8a8b type: condition task: id: f88e73b5-b0b9-416e-8d29-f828e02f8a8b version: -1 name: Are there investigation fields for IP's? description: Search for investigation fields for IP Addresses. type: condition iscommand: false brand: "" nexttasks: '#default#': - "129" "yes": - "108" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.IPFieldsToReturn iscontext: true view: |- { "position": { "x": 3010, "y": 3290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "125": id: "125" taskid: 053f5f90-6842-4aba-88ad-1269529b1293 type: condition task: id: 053f5f90-6842-4aba-88ad-1269529b1293 version: -1 name: Are there investigation fields for host names? description: Search for investigation fields for Host Names. type: condition iscommand: false brand: "" nexttasks: '#default#': - "133" "yes": - "110" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.HostFieldsToReturn iscontext: true view: |- { "position": { "x": 2150, "y": 3290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "126": id: "126" taskid: cf612468-89a5-460c-83d7-8cc84d04456c type: condition task: id: cf612468-89a5-460c-83d7-8cc84d04456c version: -1 name: Are there investigation fields for user names? description: Search for investigation fields for User Names. type: condition iscommand: false brand: "" nexttasks: '#default#': - "131" "yes": - "109" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.UserFieldsToReturn iscontext: true view: |- { "position": { "x": 1260, "y": 3290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "127": id: "127" taskid: 4173da23-64e4-40d5-8f82-41b40b6562fc type: title task: id: 4173da23-64e4-40d5-8f82-41b40b6562fc version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 780, "y": 5010 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "129": id: "129" taskid: 9d168d0e-9ca5-4da6-88d2-645d8e99bf1b type: regular task: id: 9d168d0e-9ca5-4da6-88d2-645d8e99bf1b version: -1 name: Manually list detected IP addresses description: Provide a list of comma separated IP addresses in the input screen. This task is relevant if you have not entered any values in the IP investigation fields. type: regular iscommand: false brand: "" nexttasks: '#none#': - "130" separatecontext: false view: |- { "position": { "x": 3220, "y": 3490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "130": id: "130" taskid: 55a7a15a-0ed4-4961-8a2d-d40f4eee920f type: regular task: id: 55a7a15a-0ed4-4961-8a2d-d40f4eee920f version: -1 name: Set manual IP addresses description: Sets to context the IP addresses provided by the previous task. scriptName: commentsToContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "116" scriptarguments: contextKey: simple: Splunk.DetectedIPs entryId: simple: ${lastCompletedTaskEntries.[0]} listSeperator: simple: ',' separatecontext: false view: |- { "position": { "x": 3230, "y": 3630 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "131": id: "131" taskid: 9d479d9b-8344-4503-8df2-2be1faa6be49 type: regular task: id: 9d479d9b-8344-4503-8df2-2be1faa6be49 version: -1 name: Manually list detected user names description: Provide a list of comma separated user names in the input screen. This task is relevant if you have not entered any values in the user name investigation fields. type: regular iscommand: false brand: "" nexttasks: '#none#': - "132" separatecontext: false view: |- { "position": { "x": 1450, "y": 3460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "132": id: "132" taskid: 691b6764-e453-4369-81a5-57c55d90d09d type: regular task: id: 691b6764-e453-4369-81a5-57c55d90d09d version: -1 name: Set manual user names description: Sets to context the user names provided by the previous task. scriptName: commentsToContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "127" scriptarguments: contextKey: simple: Splunk.DetectedUsers entryId: simple: ${lastCompletedTaskEntries.[0]} listSeperator: simple: ',' separatecontext: false view: |- { "position": { "x": 1450, "y": 3610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "133": id: "133" taskid: cf2b7d98-132d-4903-84bb-3b16f48bdfc8 type: regular task: id: cf2b7d98-132d-4903-84bb-3b16f48bdfc8 version: -1 name: Manually list detected host names description: Provide a list of comma separated host names in the input screen. This task is relevant if you have not entered any values in the host names investigation fields. type: regular iscommand: false brand: "" nexttasks: '#none#': - "134" separatecontext: false view: |- { "position": { "x": 2340, "y": 3460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "134": id: "134" taskid: 4052430e-6fcd-4073-832e-2ef9b2f9016d type: regular task: id: 4052430e-6fcd-4073-832e-2ef9b2f9016d version: -1 name: Set manual host names description: Sets to context the host names provided by the previous task. scriptName: commentsToContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "138" scriptarguments: contextKey: simple: Splunk.DetectedHosts entryId: simple: ${lastCompletedTaskEntries.[0]} listSeperator: simple: ',' separatecontext: false view: |- { "position": { "x": 2340, "y": 3600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "135": id: "135" taskid: 617d2894-f629-4061-8b4c-ec31440f0c7d type: title task: id: 617d2894-f629-4061-8b4c-ec31440f0c7d version: -1 name: Setting user names type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "126" separatecontext: false view: |- { "position": { "x": 1260, "y": 3160 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "136": id: "136" taskid: 64012f63-5c91-4b23-86f8-3cae9ffc9d17 type: title task: id: 64012f63-5c91-4b23-86f8-3cae9ffc9d17 version: -1 name: Setting host names type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "125" separatecontext: false view: |- { "position": { "x": 2150, "y": 3170 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "137": id: "137" taskid: c297e2f5-150f-42c6-8d07-16c920c7b4f7 type: title task: id: c297e2f5-150f-42c6-8d07-16c920c7b4f7 version: -1 name: Setting IP addresses type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "124" separatecontext: false view: |- { "position": { "x": 3010, "y": 3160 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "138": id: "138" taskid: c02f7075-e5da-4829-89e9-487a957ef08c type: title task: id: c02f7075-e5da-4829-89e9-487a957ef08c version: -1 name: Sort internal and external host names type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "139" separatecontext: false view: |- { "position": { "x": 1940, "y": 3810 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "139": id: "139" taskid: afe9c679-5d6b-4ea0-8870-6d034dbfadeb type: condition task: id: afe9c679-5d6b-4ea0-8870-6d034dbfadeb version: -1 name: Are there detected host names? description: Checks for Host Names that have been detected. type: condition iscommand: false brand: "" nexttasks: '#default#': - "141" "yes": - "144" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: Splunk.DetectedHosts iscontext: true view: |- { "position": { "x": 1940, "y": 3930 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "140": id: "140" taskid: dbc3d952-1313-4344-81dc-12d46fda425d type: regular task: id: dbc3d952-1313-4344-81dc-12d46fda425d version: -1 name: Determine whether the host names are internal or external description: Returns yes if the host name provided matches the organizations internal nameing convenstion. scriptName: IsInternalHostName type: regular iscommand: false brand: "" nexttasks: '#none#': - "142" scriptarguments: domainName: simple: 1${inputs.InternalDomainName} hostName: complex: root: Splunk accessor: DetectedHosts internalRegex: simple: ${inputs.InternalHostRegex} separatecontext: false view: |- { "position": { "x": 2210, "y": 4360 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "141": id: "141" taskid: 1bdf7891-8309-491d-833f-08801905ef93 type: title task: id: 1bdf7891-8309-491d-833f-08801905ef93 version: -1 name: Done sorting host names type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "127" separatecontext: false view: |- { "position": { "x": 1940, "y": 4860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "142": id: "142" taskid: 1459cc81-34e2-46a9-82fc-a3b59ff5723e type: regular task: id: 1459cc81-34e2-46a9-82fc-a3b59ff5723e version: -1 name: Set detected host names as internal description: Host names that were found to be internal, are written to the Splunk.DetectedInternalHosts context key. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "143" scriptarguments: append: simple: "true" key: simple: Splunk.DetectedInternalHosts value: complex: root: Endpoint filters: - - operator: isEqualString left: value: simple: Endpoint.IsInternal iscontext: true right: value: simple: "true" accessor: Hostname transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": 2210, "y": 4515 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "143": id: "143" taskid: c8e6de4d-504c-40c6-8053-4aab8ce6f943 type: regular task: id: c8e6de4d-504c-40c6-8053-4aab8ce6f943 version: -1 name: Set detected host names as external description: Host names that were found to be external, are written to the Splunk.DetectedExternalHosts context key. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "141" scriptarguments: append: simple: "true" key: simple: Splunk.DetectedExternalHosts value: complex: root: Endpoint filters: - - operator: isEqualString left: value: simple: Endpoint.IsInternal iscontext: true right: value: simple: "false" accessor: Hostname transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": 2210, "y": 4660 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "144": id: "144" taskid: f104fc3c-f2bd-4d75-8a2a-5991ea8962bb type: condition task: id: f104fc3c-f2bd-4d75-8a2a-5991ea8962bb version: -1 name: Has the domain name been provided? description: Checks if the internal domain name of the organization was provided. type: condition iscommand: false brand: "" nexttasks: '#default#': - "145" "yes": - "140" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.InternalDomainName iscontext: true view: |- { "position": { "x": 2410, "y": 4165 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "145": id: "145" taskid: 08b05df0-d433-4cab-819a-8a0a708f6cdb type: regular task: id: 08b05df0-d433-4cab-819a-8a0a708f6cdb version: -1 name: Set detected host names as internal description: Hostnames that were detected as internal according to the inputs are set to the Splunk.DetectedInternalHosts key. In case the domain name was not provided in the inputs all host names will be set as internal. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "141" scriptarguments: append: simple: "true" key: simple: Splunk.DetectedInternalHosts value: simple: Splunk.DetectedHosts separatecontext: false view: |- { "position": { "x": 2650, "y": 4455 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" system: true view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 5355, "width": 6760, "x": -2920, "y": -280 } } } inputs: - key: MD5 value: {} required: false description: MD5 hash file or an array of hashes for which to search. playbookInputQuery: - key: SplunkMD5Field value: {} required: false description: The name of the fields, in Splunk, in which to find the MD5 hash. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter. playbookInputQuery: - key: SHA1 value: {} required: false description: SHA1 hash file or an array of hashes on which to search. playbookInputQuery: - key: SplunkSHA1Field value: {} required: false description: The name of the fields, in Splunk, in which to find the SHA1 field. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter. playbookInputQuery: - key: SHA256 value: {} required: false description: SHA256 hash file or an array of hashes on which to search. playbookInputQuery: - key: SplunkSHA256Field value: {} required: false description: The name of the fields, in Splunk, in which to find the SHA256. You can enter multiple field names using a comma-separated format. If no field is specified, the search uses quick filter. playbookInputQuery: - key: IPAddress value: {} required: false description: | Source or destination IP on which to search. Can be a single address or an array of addresses. playbookInputQuery: - key: SplunkIPField value: {} required: false description: The name of the fields, in Splunk, in which to find the IP addresses. You can enter multiple field names using a comma-separated format. For example, sourceip,destinationip. playbookInputQuery: - key: URLDomain value: {} required: false description: | Domain or Url can be single or an array of domain/urls to search. By default the LIKE clause is used. playbookInputQuery: - key: SplunkURLDomainField value: {} required: false description: The name of the fields, in Splunk, in which to find the URL/Domain. If no field is specified, the search uses quick filter. Only one field can be used in this parameter. playbookInputQuery: - key: earliest_time value: simple: -1d required: false description: |- Earliest time to search. Examples: -7d -24h More examples https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/Specifytimemodifiersinyoursearch For more examples view https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/SearchTimeModifiers It is recommended to set a limit for the time frame. playbookInputQuery: - key: latest_time value: {} required: false description: |- Latest time to search. Examples: -6d -23h More examples https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/Specifytimemodifiersinyoursearch For more examples view https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/SearchTimeModifiers It is recommended to set a limit for the time frame. playbookInputQuery: - key: event_limit value: simple: "100" required: true description: Limit the number of events returned by query. This argument is not mandatory for the command, but is mandatory for the playbook. playbookInputQuery: - key: IPFieldsToReturn value: {} required: false description: The value of the IP fields to return from Splunk when the specified indicator is found. These values are used as inputs in the Setting IP addresses section. For example, src,src_ip,dst,dst_ip. playbookInputQuery: - key: UserFieldsToReturn value: {} required: false description: The value of the username fields to return from Splunk when the specified indicator is found. These values are used as inputs in the Setting user names section. For example, username,src_username,dst_username. playbookInputQuery: - key: HostFieldsToReturn value: {} required: false description: The value of the hostname fields to return from Splunk when the specified indicator is found. These values are used as inputs in the Setting host names section. For example, hostname,src_hostname, dst_hostname. playbookInputQuery: - key: InternalIPRange value: {} required: false description: 'A list of internal IP ranges to check IP addresses against. The list should be provided in CIDR format, separated by commas. An example of a list of ranges could be: 172.16.0.0/12,10.0.0.0/8,192.168.0.0/16. If a list of IP ranges is not provided, the list provided in the IsIPInRanges script (the known IPv4 private address ranges) is used by default.' playbookInputQuery: - key: IndexName value: simple: '*' required: true description: A single Spunk index to use in the search. playbookInputQuery: - key: SelectFields value: simple: source,timestamp required: true description: Use this field to include additional enrichment data for the Splunk query. If you have defined one or more investigation fields, the SelectField should not include those fields. If there are no other investigation fields defined, the SelectField must contain some value. Enter a comma-separated list of field names as they appear in Splunk. * is valid value, but not recommended since it creates large output. playbookInputQuery: - key: InternalDomainName value: {} required: false description: The organizations internal domain name. This is provided for the script IsInternalHostName that checks if the detected host names are internal or external if the hosts contain the internal domains suffix. For example demisto.com. If there is more than one domain, use the | character to separate values such as (demisto.com|test.com) playbookInputQuery: - key: InternalHostRegex value: {} required: false description: This is provided for the script IsInternalHostName that checks if the detected host names are internal or external. if the hosts match the organizations naming convention. For example the host testpc1 will have the following regex \w{6}\d{1} playbookInputQuery: outputs: - contextPath: Splunk.DetectedUsers description: Users detected based on the username field in your search. type: string - contextPath: Splunk.DetectedInternalIPs description: Internal IP addresses detected by your search. type: string - contextPath: Splunk.DetectedExternalIPs description: External IP addresses detected by your search. type: string - contextPath: Splunk.DetectedInternalHosts description: Internal host names detected based on the fields in your search. type: string - contextPath: Splunk.DetectedExternalHosts description: External host names detected based on the fields in your search. type: string tests: - Splunk-Test - Splunk Indicator Hunting Test - SplunkPy-Test-V2 fromversion: 5.0.0 supportedModules: - agentix - xsiam - edr - cloud - cloud_runtime_security