Skip to main content

Get prevalence for IOCs

This Playbook is part of the Common Playbooks Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.6.0 and later.

The playbook queries the analytics module to receive the prevalence of an IOC.

Supported IOCs:

  • Process by SHA256
  • Process by file name
  • IP
  • Domain
  • CMD
  • Registry (require key and value)

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

This playbook does not use any sub-playbooks.

Integrations#

This playbook does not use any integrations.

Scripts#

This playbook does not use any scripts.

Commands#

  • core-get-domain-analytics-prevalence
  • core-get-IP-analytics-prevalence
  • core-get-hash-analytics-prevalence
  • core-get-registry-analytics-prevalence
  • core-get-cmd-analytics-prevalence
  • core-get-process-analytics-prevalence

Playbook Inputs#


NameDescriptionDefault ValueRequired
IPIP address to run the prevalence check.Optional
HashHash to run the prevalence check.Optional
CommandlineThe CMD to run the prevalence check.Optional
ProcessThe process name to run the prevalence check.Optional
RegistryKeyThe registry key to run the prevalence check. The input registry value must be provided as well.Optional
RegistryValueThe registry value to run the prevalence check. The input registry key must be provided as well.Optional
DomainThe domain to run the prevalence check.Optional

Playbook Outputs#


PathDescriptionType
Core.AnalyticsPrevalence.IpWhether the IP address is prevalent or not.unknown
Core.AnalyticsPrevalence.Ip.valueWhether the IP address is prevalent or not.unknown
Core.AnalyticsPrevalence.Ip.data.global_prevalenceThe global prevalence of the IP address.unknown
Core.AnalyticsPrevalence.Ip.data.global_prevalence.valueThe global prevalence of the IP address.unknown
Core.AnalyticsPrevalence.Ip.data.local_prevalenceThe local prevalence of the IP address.unknown
Core.AnalyticsPrevalence.Ip.data.local_prevalence.valueThe local prevalence of the IP address.unknown
Core.AnalyticsPrevalence.Ip.data.prevalenceThe prevalence of the IP address.unknown
Core.AnalyticsPrevalence.Ip.data.prevalence.valueThe prevalence of the IP address.unknown
Core.AnalyticsPrevalence.HashThe prevalence of the hash.unknown
Core.AnalyticsPrevalence.Hash.valueWhether the hash is prevalent or not.unknown
Core.AnalyticsPrevalence.Hash.data.global_prevalenceThe prevalence of the hash.unknown
Core.AnalyticsPrevalence.Hash.data.global_prevalence.valueThe global prevalence of the hash.unknown
Core.AnalyticsPrevalence.Hash.data.local_prevalenceThe local prevalence of the hash.unknown
Core.AnalyticsPrevalence.Hash.data.local_prevalence.valueThe local prevalence of the hash.unknown
Core.AnalyticsPrevalence.Hash.data.prevalenceThe prevalence of the hash.unknown
Core.AnalyticsPrevalence.Hash.data.prevalence.valueThe prevalence of the hash.unknown
Core.AnalyticsPrevalence.DomainThe prevalence of the domain.unknown
Core.AnalyticsPrevalence.Domain.valueWhether the domain is prevalent or not.unknown
Core.AnalyticsPrevalence.Domain.data.global_prevalenceThe global prevalence of the domain.unknown
Core.AnalyticsPrevalence.Domain.data.global_prevalence.valueThe global prevalence of the domain.unknown
Core.AnalyticsPrevalence.Domain.data.local_prevalenceThe local prevalence of the domain.unknown
Core.AnalyticsPrevalence.Domain.data.local_prevalence.valueThe local prevalence of the domain.unknown
Core.AnalyticsPrevalence.Domain.data.prevalenceThe prevalence of the domain.unknown
Core.AnalyticsPrevalence.Domain.data.prevalence.valueThe prevalence of the domain.unknown
Core.AnalyticsPrevalence.ProcessThe prevalence of the process.unknown
Core.AnalyticsPrevalence.Process.valueWhether the process is prevalent or not.unknown
Core.AnalyticsPrevalence.Process.data.global_prevalenceThe global prevalence of the process.unknown
Core.AnalyticsPrevalence.Process.data.global_prevalence.valueThe global prevalence of the process.unknown
Core.AnalyticsPrevalence.Process.data.local_prevalenceThe local prevalence of the process.unknown
Core.AnalyticsPrevalence.Process.data.local_prevalence.valueThe local prevalence of the process.unknown
Core.AnalyticsPrevalence.Process.data.prevalenceThe prevalence of the process.unknown
Core.AnalyticsPrevalence.Process.data.prevalence.valueThe prevalence of the process.unknown
Core.AnalyticsPrevalence.RegistryThe prevalence of the registry.unknown
Core.AnalyticsPrevalence.Registry.valueWhether the registry is prevalent or not.unknown
Core.AnalyticsPrevalence.Registry.data.global_prevalenceThe global prevalence of the registry.unknown
Core.AnalyticsPrevalence.Registry.data.global_prevalence.valueThe global prevalence of the registry.unknown
Core.AnalyticsPrevalence.Registry.data.local_prevalenceThe local prevalence of the registry.unknown
Core.AnalyticsPrevalence.Registry.data.local_prevalence.valueThe local prevalence of the registry.unknown
Core.AnalyticsPrevalence.Registry.data.prevalenceThe prevalence of the registry.unknown
Core.AnalyticsPrevalence.Registry.data.prevalence.valueThe prevalence of the registry.unknown
Core.AnalyticsPrevalence.CmdThe prevalence of the CMD.unknown
Core.AnalyticsPrevalence.Cmd.valueWhether the CMD is prevalent or not.unknown
Core.AnalyticsPrevalence.Cmd.data.global_prevalenceThe global prevalence of the CMD.unknown
Core.AnalyticsPrevalence.Cmd.data.global_prevalence.valueThe global prevalence of the CMD.unknown
Core.AnalyticsPrevalence.Cmd.data.local_prevalenceThe local prevalence of the CMD.unknown
Core.AnalyticsPrevalence.Cmd.data.local_prevalence.valueThe local prevalence of the CMD.unknown
Core.AnalyticsPrevalence.Cmd.data.prevalenceThe prevalence of the CMD.unknown
Core.AnalyticsPrevalence.Cmd.data.prevalence.valueThe prevalence of the Cmd.unknown

Playbook Image#


Get prevalence for IOCs