<commit_before>id: IOC Hunt - TIE - Test
version: -1
name: IOC Hunt - TIE - Test
description: A test playbook for "IOC Hunt - TIE"
starttaskid: "0"
fromversion: 3.5.0
tasks:
  "0":
    id: "0"
    taskid: 1875f506-1599-4613-8a51-e221b71c9d96
    type: start
    task:
      id: 1875f506-1599-4613-8a51-e221b71c9d96
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
  "2":
    id: "2"
    taskid: 8e217bcd-0c4b-4716-809f-206d26ad7fec
    type: regular
    task:
      id: 8e217bcd-0c4b-4716-809f-206d26ad7fec
      version: -1
      name: Clear context
      description: Clear the context before starting
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      all:
        simple: "yes"
      key: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
  "3":
    id: "3"
    taskid: f52675a0-36f5-4cc3-827a-1e78553ef613
    type: regular
    task:
      id: f52675a0-36f5-4cc3-827a-1e78553ef613
      version: -1
      name: Create testFile1
      description: Create a file with a known hash
      scriptName: FileCreateAndUpload
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      data:
        simple: ' '
      entryId: {}
      filename:
        simple: testFile1.txt
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -160,
          "y": 371
        }
      }
  "4":
    id: "4"
    taskid: 8380ad12-c856-439b-85a2-8d1cca0bd45f
    type: regular
    task:
      id: 8380ad12-c856-439b-85a2-8d1cca0bd45f
      version: -1
      name: Create testFile2
      description: Create another file with a known hash
      scriptName: FileCreateAndUpload
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      data:
        simple: a
      entryId: {}
      filename:
        simple: testFile2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 259,
          "y": 371
        }
      }
  "7":
    id: "7"
    taskid: a8604972-e68e-48e4-8042-c20d9bd51970
    type: regular
    task:
      id: a8604972-e68e-48e4-8042-c20d9bd51970
      version: -1
      name: Verify AgentGuid
      description: Verify AgentGuid exists
      scriptName: VerifyContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      expectedValue: {}
      fields: {}
      path:
        complex:
          root: File
          filters:
          - - operator: general.isExists
              left:
                value:
                  simple: References
                iscontext: true
          - - operator: general.isNotEmpty
              left:
                value:
                  simple: References.AgentGuid
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 737
        }
      }
  "9":
    id: "9"
    taskid: <PASSWORD>-d<PASSWORD>83c31686
    type: playbook
    task:
      id: <PASSWORD>
      playbookId: TIE - IOC Hunt
      version: -1
      name: IOC Hunt - TIE
      description: |-
        Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well).

        Input:
        * Hash (default, takes all deferent hashes from context)

        Output:
        * All agents that files with "Hash" has been executed on (TIE)
        * Enrich Agents info from ePO
      playbookName: IOC Hunt - TIE
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      Hash:
        simple: ${.=val.File.map(function(f) {return [f.MD5, f.SHA1, f.SHA256];}).reduce(function(a,
          b){return a.concat(b);}, []).filter(function (val1) {return val1;})}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 50,
          "y": 561
        }
      }
  "10":
    id: "10"
    taskid: fb84c63a-c4b9-4e90-83bc-9eae0caf6328
    type: title
    task:
      id: fb84c63a-c4b9-4e90-83bc-9eae0caf6328
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 919
        }
      }
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 934,
        "width": 799,
        "x": -160,
        "y": 50
      }
    }<commit_msg>rearranged tasks<commit_after>id: IOC Hunt - TIE - Test
version: -1
name: IOC Hunt - TIE - Test
description: A test playbook for "IOC Hunt - TIE"
starttaskid: "0"
fromversion: 3.5.0
tasks:
  "0":
    id: "0"
    taskid: 28a2ee6d-d057-4a36-8cb0-901d9a26b9c8
    type: start
    task:
      id: 28a2ee6d-d057-4a36-8cb0-901d9a26b9c8
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
  "2":
    id: "2"
    taskid: f283649d-be9c-41cc-8f96-c0a659f1d7e7
    type: regular
    task:
      id: f283649d-be9c-41cc-8f96-c0a659f1d7e7
      version: -1
      name: Clear context
      description: Clear the context before starting
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      all:
        simple: "yes"
      key: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
  "3":
    id: "3"
    taskid: 1fb33469-1914-4085-8029-decf65f976aa
    type: regular
    task:
      id: 1fb33469-1914-4085-8029-decf65f976aa
      version: -1
      name: Create testFile1
      description: Create a file with a known hash
      scriptName: FileCreateAndUpload
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      data:
        simple: ' '
      entryId: {}
      filename:
        simple: testFile1.txt
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
  "4":
    id: "4"
    taskid: 70df3c12-bb5f-47ae-834e-7fb67fb8cfe7
    type: regular
    task:
      id: 70df3c12-bb5f-47ae-834e-7fb67fb8cfe7
      version: -1
      name: Create testFile2
      description: Create another file with a known hash
      scriptName: FileCreateAndUpload
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      data:
        simple: a
      entryId: {}
      filename:
        simple: testFile2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
  "7":
    id: "7"
    taskid: 13449e36-be66-4d89-8f42-2953412e7ca8
    type: regular
    task:
      id: 13449e36-be66-4d89-8f42-2953412e7ca8
      version: -1
      name: Verify AgentGuid
      description: Verify AgentGuid exists
      scriptName: VerifyContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      expectedValue: {}
      fields: {}
      path:
        complex:
          root: File
          filters:
          - - operator: general.isExists
              left:
                value:
                  simple: References
                iscontext: true
          - - operator: general.isNotEmpty
              left:
                value:
                  simple: References.AgentGuid
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
  "9":
    id: "9"
    taskid: f9032833-f06e-4194-808f-d3a48f04da9f
    type: playbook
    task:
      id: f9032833-f06e-4194-808f-d3a48f04da9f
      version: -1
      name: IOC Hunt - TIE
      description: |-
        Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well).

        Input:
        * Hash (default, takes all deferent hashes from context)

        Output:
        * All agents that files with "Hash" has been executed on (TIE)
        * Enrich Agents info from ePO
      playbookName: IOC Hunt - TIE
      playbookId: TIE - IOC Hunt
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      Hash:
        simple: ${.=val.File.map(function(f) {return [f.MD5, f.SHA1, f.SHA256];}).reduce(function(a,
          b){return a.concat(b);}, []).filter(function (val1) {return val1;})}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
  "10":
    id: "10"
    taskid: 7f55ab10-c0c7-4a51-86f3-8324067b47d4
    type: title
    task:
      id: 7f55ab10-c0c7-4a51-86f3-8324067b47d4
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1085,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
{'fraction_non_alphanumeric': 0.1133615477629988, 'fraction_numerical': 0.0761789600967352, 'mean_word_length': 1.5248028491477996, 'pattern_counts': {'":': 70, '<': 6, '<?xml version=': 0, '>': 6, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6639438', 'n_tokens_mistral': 3843, 'n_tokens_neox': 3475, 'n_words': 797}