Endace Search Archive and Download

Deprecated

DEPRECATED - This playbook has been deprecated. This playbook uses Endace APIs to search, archive and download PCAP file from either a single EndaceProbe or many via the InvestigationManager and enables integration of full historical packet capture into security automation workflows.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

  • Endace

Scripts

  • IsGreaterThan
  • AreValuesEqual
  • AddEvidence

Commands

  • endace-create-archive
  • endace-get-search-status
  • endace-download-pcap
  • endace-get-archive-status
  • endace-delete-search-task
  • endace-create-search

Playbook Inputs


NameDescriptionDefault ValueRequired
startEvent Start Time in ISO 8601 formatOptional
endEvent End Time in ISO 8601 formatOptional
src_host_listList of Source IP addresses to searchOptional
dest_host_listList of Destination IP addresses to searchOptional
src_port_listList of Source Port addresses to searchOptional
dest_port_listList of Destination Port addresses to searchOptional
protocolTCP or UDPTCPOptional
timeframeEvent timeframe to search - in seconds. Timeframe works as search for last "n" seconds if start and end time is not provided. For example, by specifying 3600 seconds as the timeframe, analyst can schedule a search for last 1 hour. If both start and end time is provided, timeframe value is ignored. If either start or end time is provided along with timeframe, the respective start or end time is calculated accordingly.Optional

Playbook Outputs


PathDescriptionType
Endace.Search.Query.JobIDSearch Job IDstring
Endace.Search.Response.JobIDThis is the job ID of search query which we polled to get search statusstring
Endace.Search.Response.Statusjob statusstring
Endace.Search.Response.JobProgressProgress of this search Jobstring
Endace.Search.Response.TotalBytesTotal data matching this search across all datasourcesstring
Endace.Search.Delete.JobIDJobID of the task that needs to be deletedstring
Endace.Search.Delete.ErrorError messagestring
Endace.Search.Delete.Statusdelete status, queryNotFound indicates that the search query has already expired before this operation, which is expected as EndaceProbes purges inactive tasks after their timer expires. queryDeleted indicates an active search query is now deleted.string
Endace.Archive.Query.JobIDJobID of the Archive Taskstring
Endace.Archive.Query.FileNameName of the archived Filestring
Endace.Archive.Query.P2VurlEndace Pivot to Vision URL that links to an Investigation Dashboard on EndaceProbe. This enables user to further drill down on packets of interests on EndaceProbe without even downloading a pcapstring
Endace.Download.FileNameName of the File to download from EndaceProbestring
Endace.Download.FileSizeFile size in MegaBytesstring
Endace.Download.FileTypeThe file downloaded from EndaceProbes is either a rotationfile or archivefile.string
Endace.Download.FileURLURL to PCAP file on EndaceProbe.string
Endace.Download.FileUserUsername of the person associated with the Endace instance who downloads this PCAPstring
Endace.Download.StatusDownload status of the file.string
Endace.Download.Errorerror occured during downloading of this filestring

Playbook Image


Endace Search Archive and Download