Investigation. Get child process tree events and link them

Expand all | Collapse all

The "Investigation. Get child process tree events and link them" predefined playbook allows you to view the child process tree for a suspicious process by querying KUMA and linking the resulting events to the alert. As a result of the playbook execution, additional information is added to the alert comments, helping you decide whether to close the alert, perform additional investigation, or create an incident for further response.

Before using the playbook, you must download the scripts and dependencies list, which are required for playbook to work correctly.

Click here to see how to download and prepare the scripts

To create a playbook, refer to the "Creating playbooks" article.

Click here to see the full expression that the playbook trigger contains

Functions used by the playbook: executeCustomScript, addCommentToAlert.

During execution, this playbook launches the following response actions:

  1. Performing a KUMA query to get child process tree events, using DestinationProcessID for Linux and DeviceCustomString5 for Windows. The time window for the query is defined in the playbook input parameters by the timewindow property.
  2. Adding a comment to the alert with brief information about the child process tree. The comment includes the process level, user name, process ID, and process name for each node in the tree, which allows you to quickly assess the context of the suspicious process.
  3. Linking the child process tree events back to the alert by using the xdr_link_events.py script, which takes the alert internal ID and the collected child process events as input.

Click here to see the sequence of response actions that the playbook algorithm contains

Page top