id: Threat Hunting - Generic version: -1 contentitemexportablefields: contentitemfields: {} name: Threat Hunting - Generic description: "This playbook enables threat hunting for IOCs in your enterprise. It currently supports the following integrations: \n- Splunk\n- Qradar\n- Pan-os \n- Cortex Data Lake \n- Autofocus\n- Microsoft 365 Defender" starttaskid: "0" tasks: "0": id: "0" taskid: f7b21d57-eb4c-4233-8725-51010d27db08 type: start task: id: f7b21d57-eb4c-4233-8725-51010d27db08 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" - "3" - "5" - "6" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 230, "y": 60 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: faee0e93-b767-4148-8d8f-b1762d1e1039 type: playbook task: id: faee0e93-b767-4148-8d8f-b1762d1e1039 version: -1 name: Splunk Indicator Hunting description: This playbook queries Splunk for indicators such as file hashes, IP addresses, domains, or URLs. It returns detected users, IP addresses, and hostnames related to the indicators. playbookName: Splunk Indicator Hunting type: playbook iscommand: false brand: "" nexttasks: '#none#': - "4" scriptarguments: IPAddress: complex: root: inputs.IPAddress IndexName: simple: '*' InternalDomainName: complex: root: inputs.InternalDomainName InternalHostRegex: complex: root: inputs.InternalHostRegex InternalIPRange: complex: root: inputs.InternalRange MD5: complex: root: inputs.MD5 SHA1: complex: root: inputs.SHA1 SHA256: complex: root: inputs.SHA256 SelectFields: simple: source,timestamp URLDomain: complex: root: inputs.URLDomain earliest_time: complex: root: inputs.SplunkEarliestTime event_limit: simple: "100" latest_time: complex: root: inputs.SplunkLatestTime separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 860, "y": 230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: 41273c47-6b21-49dd-869a-35e115202d0a type: playbook task: id: 41273c47-6b21-49dd-869a-35e115202d0a version: -1 name: Palo Alto Networks - Hunting And Threat Detection description: "This is a multipurpose playbook used for hunting and threat detection. The playbook receives inputs based on hashes, IP addresses, or domain names provided manually or from outputs from other playbooks. \nWith the received indicators, the playbook leverages data received by PANW products including Cortex Data Lake, Autofocus, and Pan-OS to search for IP addresses, host names and users related to the provided indicators.\nThe output provided by the playbook facilitates pivoting searches for possibly affected IP addresses or users." playbookName: Palo Alto Networks - Hunting And Threat Detection type: playbook iscommand: false brand: "" nexttasks: '#none#': - "4" scriptarguments: IPAddresses: complex: root: inputs.IPAddress InternalDomainName: complex: root: inputs.InternalDomainName InternalHostRegex: complex: root: inputs.InternalHostRegex InternalRange: complex: root: inputs.InternalRange MD5: complex: root: inputs.MD5 SHA1: complex: root: inputs.SHA1 SHA256: complex: root: inputs.SHA256 URLDomain: complex: root: inputs.URLDomain separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 20, "y": 230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: 68569c89-2090-4873-8dbc-aede46966200 type: title task: id: 68569c89-2090-4873-8dbc-aede46966200 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 230, "y": 440 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 6f545ba4-aeb9-4c82-87d0-4e3a1f0b5826 type: playbook task: id: 6f545ba4-aeb9-4c82-87d0-4e3a1f0b5826 version: -1 name: QRadar Indicator Hunting V2 description: 'This playbook queries the QRadar SIEM for indicators such as file hashes, IP addresses, domains, or URLs. ' playbookName: QRadar Indicator Hunting V2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "4" scriptarguments: IPAddress: complex: root: inputs.IPAddress InternalRange: complex: root: inputs.InternalRange InvestigationIPFields: simple: sourceip,destinationip InvestigationUserFields: simple: username MD5: complex: root: inputs.MD5 QradarIPfield: simple: sourceip,destinationip SHA1: complex: root: inputs.SHA1 SHA256: complex: root: inputs.SHA256 TimeFrame: complex: root: inputs.QRadarTimeFrame URLDomain: complex: root: inputs.URLDomain separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 440, "y": 230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 7bf5bd95-cefc-4259-81aa-e5f187e015c8 type: playbook task: id: 7bf5bd95-cefc-4259-81aa-e5f187e015c8 version: -1 name: Microsoft 365 Defender - Threat Hunting Generic description: | This playbook retrieves email data based on the `URLDomain`, `SHA256`, `IPAddress` and `MessageID` inputs. The output will be a unified object with all of the retrieved emails based on the sub-playbooks outputs: - **Microsoft 365 Defender - Get Email URL clicks**: Retrieves data based on URL click events. - **Microsoft 365 Defender - Emails Indicators Hunt**: Retrieves data based on several different email events. Please read the playbooks descriptions in order to get the full details. playbookName: Microsoft 365 Defender - Threat Hunting Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "4" scriptarguments: IPAddress: complex: root: inputs.IPAddress MessageID: complex: root: inputs.MessageID ResultsLimit: simple: "50" SHA256: complex: root: inputs.SHA256 SearchTimeframe: simple: "7" Timeout: simple: "180" URLDomain: complex: root: inputs.URLDomain separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -400, "y": 230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false system: true view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 445, "width": 1640, "x": -400, "y": 60 } } } inputs: - key: MD5 value: {} required: false description: The MD5 hash file or an array of hashes to search. playbookInputQuery: - key: SHA256 value: {} required: false description: The SHA256 hash file or an array of hashes to search. playbookInputQuery: - key: SHA1 value: {} required: false description: The SHA1 hash file or an array of hashes to search. playbookInputQuery: - key: IPAddress value: {} required: false description: | The source or destination IP address to search. Can be a single address or an array of list of addresses. playbookInputQuery: - key: URLDomain value: {} required: false description: Domain or URL to search. Can be a single domain or URL or an array of domains or URLs to search. By default, the LIKE clause is used. playbookInputQuery: - key: InternalRange value: complex: root: lists accessor: PrivateIPs transformers: - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2}) unpack_matches: {} - operator: join args: separator: value: simple: ',' required: false description: 'A comma-separated list of internal IP ranges to check IP addresses against. The list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).' playbookInputQuery: - key: InternalDomainName value: {} required: false description: The organization's internal domain name. This is provided for the script IsInternalHostName that checks if the detected hostnames are internal or external, if the hosts contain the internal domains suffix. For example, paloaltonetworks.com. If there is more than one domain, use the | character to separate values such as (paloaltonetworks.com|test.com). playbookInputQuery: - key: InternalHostRegex value: {} required: false description: Provided for the script IsInternalHostName that checks if the detected host names are internal or external, if the hosts match the organization's naming convention. For example, the host testpc1 will have the following regex \w{6}\d{1} playbookInputQuery: - key: QRadarTimeFrame value: simple: LAST 7 DAYS required: false description: The time frame to search in QRadar. playbookInputQuery: - key: SplunkEarliestTime value: simple: -7d@d required: false description: The earliest time to search in Splunk. playbookInputQuery: - key: SplunkLatestTime value: simple: now required: false description: The latest time to search in Splunk. playbookInputQuery: - key: MessageID value: {} required: false description: "This input will be used in the \"Microsoft 365 Defender - Get Email URL clicks\" playbook. MessageID of the email from which the URL was clicked. Please note that this can be either of the following 2 values:\n- The value of the header \"Message-ID\".\n- The internal ID of the message within Microsoft's products (e.g. \n NetworkMessageId).\n\nCan be a single MessageID or an array of MessageIDs to search." playbookInputQuery: outputs: - contextPath: Splunk.DetectedUsers description: Users detected based on the username field in your search. type: string - contextPath: Splunk.DetectedInternalIPs description: Internal IP addresses detected by your search. type: string - contextPath: Splunk.DetectedExternalIPs description: External IP addresses detected by your search. type: string - contextPath: Splunk.DetectedInternalHosts description: Internal hostnames detected based on the fields in your search. type: string - contextPath: Splunk.DetectedExternalHosts description: External hostnames detected based on the fields in your search. type: string - contextPath: PANWHunting.DetectedUsers description: User or array of users that were detected during hunting. type: string - contextPath: PANWHunting.DetectedInternalIPs description: Internal IP addresses detected based on fields and inputs in your search. type: string - contextPath: PANWHunting.DetectedExternalIPs description: External IP addresses detected based on fields and inputs in your search. type: string - contextPath: PANWHunting.DetectedInternalHosts description: Internal hostnames detected based on fields and inputs in your search. type: string - contextPath: PANWHunting.DetectedExternalHosts description: External hostnames detected based on fields and inputs in your search. type: string - contextPath: QRadar.DetectedUsers description: Users detected based on the username field in your search. type: string - contextPath: QRadar.DetectedInternalIPs description: Internal IP addresses detected based on fields and inputs in your search. type: string - contextPath: QRadar.DetectedExternalIPs description: External IP addresses detected based on fields and inputs in your search. type: string - contextPath: QRadar.DetectedInternalHosts description: Internal host names detected based on hosts in your assets table. Note that the data accuracy depends on how the asset mapping is configured in QRadar. type: string - contextPath: QRadar.DetectedExternalHosts description: External host names detected based on hosts in your assets table. Note that the data accuracy depends on how the asset mapping is configured in QRadar. type: string - contextPath: Microsoft365Defender.RetrievedEmails description: Email objects containing relevant fields. type: string - contextPath: Microsoft365Defender.RetrievedEmails.InternetMessageId description: Internet Message ID of the email. type: string - contextPath: Microsoft365Defender.RetrievedEmails.SenderFromDomain description: Sender domain. type: string - contextPath: Microsoft365Defender.RetrievedEmails.EmailDirection description: Email direction (inbound/outbound). type: string - contextPath: Microsoft365Defender.RetrievedEmails.DeliveryLocation description: Delivery location. type: string - contextPath: Microsoft365Defender.RetrievedEmails.AuthenticationDetails description: Authentication details (SPF, DKIM, DMARC, CompAuth). type: string - contextPath: Microsoft365Defender.RetrievedEmails.DeliveryAction description: Email subject. type: string - contextPath: Microsoft365Defender.RetrievedEmails.AttachmentCount description: Number of attachments. type: string - contextPath: Microsoft365Defender.RetrievedEmails.ThreatNames description: Threat names. type: string - contextPath: Microsoft365Defender.RetrievedEmails.RecipientEmailAddress description: Recipient email address. type: string - contextPath: Microsoft365Defender.RetrievedEmails.EmailAction description: Email action. type: string - contextPath: Microsoft365Defender.RetrievedEmails.EmailLanguage description: Email language. type: string - contextPath: Microsoft365Defender.RetrievedEmails.SenderFromAddress description: Sender address. type: string - contextPath: Microsoft365Defender.RetrievedEmails.Timestamp description: Timestamp. type: string - contextPath: Microsoft365Defender.RetrievedEmails.SenderDisplayName description: Sender display name. type: string - contextPath: Microsoft365Defender.RetrievedEmails.SenderIPv4 description: Sender IPv4. type: string - contextPath: Microsoft365Defender.RetrievedEmails.ConfidenceLevel description: Threat types. type: string - contextPath: Microsoft365Defender.RetrievedEmails.SHA256 description: SHA256 of the attachments (if exist in the email). type: string - contextPath: Microsoft365Defender.RetrievedEmails.Url description: URLs found in the email's body. type: string - contextPath: Microsoft365Defender.RetrievedEmails.UrlCount description: Number of URLs found in the email's body. type: string - contextPath: Microsoft365Defender.RetrievedEmails.SenderIPv6 description: Sender IPv6. type: string - contextPath: Microsoft365Defender.RetrievedEmails.AccountUpn description: User principal name (UPN) of the account. type: string - contextPath: Microsoft365Defender.RetrievedEmails.IsClickedThrough description: Indicates whether the user was able to click through to the original URL or not. type: number - contextPath: Microsoft365Defender.RetrievedEmails.BulkComplaintLevel description: Threshold assigned to email from bulk mailers, a high bulk complain level (BCL) means the email is more likely to generate complaints, and thus more likely to be spam. type: string - contextPath: Microsoft365Defender.RetrievedEmails.IPAddress description: IP address assigned to the device during communication. type: string - contextPath: Microsoft365Defender.RetrievedEmails.DetectionMethods description: Methods used to detect whether the URL contains or leads to malware, phishing, or other threats. type: string - contextPath: Microsoft365Defender.RetrievedEmails.ActionType description: Type of activity that triggered the event. type: string - contextPath: Microsoft365Defender.RetrievedEmails.UrlChain description: List of URLs in the redirection chain. type: string - contextPath: Microsoft365Defender.RetrievedEmails.NetworkMessageId description: Unique identifier for the email, generated by Office 365. type: string - contextPath: Microsoft365Defender.RetrievedEmails.DisplayName description: Name of the sender displayed in the address book, typically a combination of a given or first name, a middle initial, and a last name or surname. type: string - contextPath: Microsoft365Defender.RetrievedEmails.SenderMailFromDomain description: Sender domain in the MAIL FROM header, also known as the envelope sender or the Return-Path address. type: string - contextPath: Microsoft365Defender.RetrievedEmails.SenderMailFromAddress description: Sender email address in the MAIL FROM header, also known as the envelope sender or the Return-Path address. type: string - contextPath: Microsoft365Defender.RetrievedEmails.Subject description: Subject of the email. type: string - contextPath: Microsoft365Defender.RetrievedEmails.ThreatTypes description: Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats. type: unknown tests: - No tests (auto formatted) fromversion: 6.5.0