Investigation. Get parent process chain events and link them

Expand all | Collapse all

The "Investigation. Get parent process chain events and link them" predefined playbook allows you to view the parent process chain for a suspicious process by querying KUMA and linking the resulting events to the alert. As a result of the playbook execution, additional information is added to the alert comments, helping you decide whether to close the alert, perform additional investigation, or create an incident for further response.

Before using the playbook, you must download the scripts and dependencies list, which are required for playbook to work correctly.

Click here to see how to download and prepare the scripts

To create a playbook, refer to the "Creating playbooks" article.

Click here to see the full expression that the playbook trigger contains

Functions used by the playbook: executeCustomScript, addCommentToAlert.

During execution, this playbook launches the following response actions:

  1. Performing a KUMA query to get parent process chain events, using SourceProcessID for Linux and DeviceCustomString3 for Windows as pivot points, together with the host name and timestamp taken from the alert. The time window for the query is defined in the playbook input parameters by the timewindow property.
  2. Adding a comment to the alert with brief information about the parent process chain. The comment is built from the collected events in reverse order (from the root parent to the current proccess) and includes the process level, user name, process ID, and process name taken from the parent process chain data.
  3. Linking the parent process chain events back to the alert by using the xdr_link_events.py script, which takes the alert internal ID and the collected parent process chain events as input.

Click here to see the sequence of response actions that the playbook algorithm contains

Page top