id: SpyCloud - Malware Incident Enrichment version: -1 name: SpyCloud - Malware Incident Enrichment description: SpyCloud Malware Playbook executes the spycloud-compass-device-data command when any incident of the SpyCloud Malware Data type is created, and sets the corresponding incident field. starttaskid: "0" tasks: "0": id: "0" taskid: 8a27604c-038d-4981-8a49-8aa39754918f type: start task: id: 8a27604c-038d-4981-8a49-8aa39754918f version: -1 name: "" iscommand: false brand: "" description: "" nexttasks: '#none#': - "4" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 265, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: 4f95906b-a735-4bff-8a44-d270c482b54b type: regular task: id: 4f95906b-a735-4bff-8a44-d270c482b54b version: -1 name: Adding compass data to the incident description: Change the properties of an incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "3" scriptarguments: spycloudcompassdevicedata: simple: ${SpyCloud.CompassDeviceData} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 545 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: 2d2f68f6-2661-46ab-8578-9448639cc980 type: title task: id: 2d2f68f6-2661-46ab-8578-9448639cc980 version: -1 name: Done type: title iscommand: false brand: "" description: "" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: 47abe58e-54f5-4127-8697-543402bef4dc type: regular task: id: 47abe58e-54f5-4127-8697-543402bef4dc version: -1 name: Fetch compass data for the infected machine id description: Get compass device data by infected_machine_id. script: spycloud-compass-device-data-get type: regular iscommand: true brand: SpyCloudEnterpriseProtectionEnrichment nexttasks: '#none#': - "5" scriptarguments: infected_machine_id: simple: ${inputs.Infected Machine Id} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 265, "y": 195 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 21deb50f-d4ac-4edf-88f4-528bf09f77d7 type: condition task: id: 21deb50f-d4ac-4edf-88f4-528bf09f77d7 version: -1 name: Check if compass data exist type: condition iscommand: false brand: "" description: "" nexttasks: '#default#': - "6" "yes": - "2" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: SpyCloud.CompassDeviceData iscontext: true continueonerrortype: "" view: |- { "position": { "x": 265, "y": 370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 977509ea-e6a1-46b3-88e5-4105a2bc889b type: regular task: id: 977509ea-e6a1-46b3-88e5-4105a2bc889b version: -1 name: Add comment to the incident description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "7" scriptarguments: comment: simple: 'Do not have compass data for this Infected Machine ID: ${inputs.Infected Machine Id}.' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 545 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: 317ab2e7-d665-4fa0-8208-f4bc77b699d6 type: title task: id: 317ab2e7-d665-4fa0-8208-f4bc77b699d6 version: -1 name: Done type: title iscommand: false brand: "" description: "" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 735, "width": 810, "x": 50, "y": 50 } } } inputs: - key: Infected Machine Id value: simple: ${incident.spycloudinfectedmachineid} required: false description: "" playbookInputQuery: outputs: - contextPath: SpyCloud.CompassDeviceData.username description: Username. type: String - contextPath: SpyCloud.CompassDeviceData.password description: Account password. type: String - contextPath: SpyCloud.CompassDeviceData.password_plaintext description: The cracked, plaintext version of the password (where the password is crackable). type: String - contextPath: SpyCloud.CompassDeviceData.password_type description: Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc). type: String - contextPath: SpyCloud.CompassDeviceData.target_url description: URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user's system. type: String - contextPath: SpyCloud.CompassDeviceData.user_browser description: Browser name. type: String - contextPath: SpyCloud.CompassDeviceData.ip_addresses description: List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported. type: String - contextPath: SpyCloud.CompassDeviceData.infected_machine_id description: A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID's in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud. type: String - contextPath: SpyCloud.CompassDeviceData.infected_path description: The local path to the malicious software installed on the infected user's system. type: String - contextPath: SpyCloud.CompassDeviceData.infected_time description: The time at which the user's system was infected with malicious software. type: Date - contextPath: SpyCloud.CompassDeviceData.user_sys_domain description: System domain. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDeviceData.user_hostname description: System hostname. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDeviceData.user_os description: System OS name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDeviceData.user_sys_registered_owner description: System registered owner name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDeviceData.source_id description: Numerical breach ID. This correlates directly with the id field in Breach Catalog objects. type: Number - contextPath: SpyCloud.CompassDeviceData.spycloud_publish_date description: The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers. type: Date - contextPath: SpyCloud.CompassDeviceData.target_domain description: SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.CompassDeviceData.target_subdomain description: Subdomain and SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.CompassDeviceData.severity description: 'Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.' type: Number - contextPath: SpyCloud.CompassDeviceData.document_id description: UUID v4 string which uniquely identifies this breach record in our data set. type: String - contextPath: SpyCloud.CompassDeviceData.email description: Email address. type: String - contextPath: SpyCloud.CompassDeviceData.email_domain description: Domain extracted from 'email_address' field. This is not a SLD, but everything after the '@' symbol. type: String - contextPath: SpyCloud.CompassDeviceData.email_username description: Username extracted from 'email' field. This is everything before the '@' symbol. type: String - contextPath: SpyCloud.CompassDeviceData.domain description: Domain name. type: String quiet: true tests: - No tests (auto formatted) fromversion: 6.10.0