Ongoing Search | docs.d3security

Last updated: Aug 15, 2024

Creates an ongoing fetchEvent job based on the parameters.

READER NOTE

This command is only applicable within an incident Playbook.

Implementation	System
Command Category	Cyber Utility
Tags	event event search

Inputs

Parameter Name	Required/Optional	Description	Sample Data
Connection Name	Required	The connection for fetching event(s).	Splunk
Start Time	Required	The beginning of the time range for fetching events (format: yyyy-MM-dd HH:mm).	2020-01-01 06:00:00
End Time	Required	The end point in the time range for fetching events (format: yyyy-MM-dd HH:mm.	2020-01-01 18:00:00
Top Recent Event Number	Optional	The number of the most recent Event(s) to fetch.	20
Search Condition	Optional	Queries to filter results.	search sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="1"
Techniques	Optional	The Tactics and Techniques to be applied to the Event(s) retrieved by the Ongoing Surveillance Task.	JSON `[ { "tactic": "Initial Access", "technique": "Spearphishing Attachment" }, { "tactic": "Execution", "technique": "Signed Script Proxy Execution" } ]`
Risk Level	Optional	The Risk Level for the Event(s) retrieved by the Ongoing Surveillance Task.	4
Interval (Minutes)	Optional	The execution interval (minutes) of an Ongoing Surveillance job to fetch Event(s).	3
Event Playbook	Optional	The event playbook to process the event data.	demoPlaybook
Run MITRE TTP Search	Optional	Whether the system automatically maps tactic & techniques on newly ingested events. The default value is True.	True
Run Event Automation Rules	Optional	Whether the system executes Event Automation Rules for dismissal and escalation. The default value is True.	True

Remote Command API

The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.

Request

POST

https:/{base_url}/{api_namespace}/api/Command/OngoingSearch

Headers

Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.

Request Body

JSON

{
  "Username": <Username here>,
  "Site": <Site here>,
  "CommandParams": {
    "Connection Name": <Connection Name here>,
    "Start Time": <Start Time here>,
    "End Time": <End Time here>,
    "Top Recent Event Number": <Top Recent Event Number here>,
    "Search Condition": <Search Condition here>,
    "Techniques": [
      {
        "tactic": <Tactic 1 here>,
        "technique": <Technique 1 here>
      },
      {
        "tactic": <Tactic 2 here>,
        "technique": <Technique 2 here>
      }
    ],
    "Risk Level": <Risk Level here>,
    "Interval (Minutes)": <Interval (Minutes) here>,
    "Event Playbook": <Event Playbook here>,
    "Run MITRE TTP Search": <Run MITRE TTP Search here>,
    "Run Event Automation Rules": <Run Event Automation Rules here>
  }
}

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`string`	Required	The username of your D3 SOAR account.
Site	`string`	Required	The D3 SOAR site to run the remote command.
Connection Name	`string`	Required	The connection for fetching event(s).
Start Time	`string`	Required	The beginning of the time range for fetching events (format: yyyy-MM-dd HH:mm).
End Time	`string`	Required	The end point in the time range for fetching events (format: yyyy-MM-dd HH:mm.
Top Recent Event Number	`integer`	Optional	The number of the most recent Event(s) to fetch.
Search Condition	`string`	Optional	Queries to filter results.
Techniques	`array<JSON Object>`	Optional	The Tactics and Techniques to be applied to the Event(s) retrieved by the Ongoing Surveillance Task.
Risk Level	`integer`	Optional	The Risk Level for the Event(s) retrieved by the Ongoing Surveillance Task.
Interval (Minutes)	`integer`	Optional	The execution interval (minutes) of an Ongoing Surveillance job to fetch Event(s).
Event Playbook	`string`	Optional	The event playbook to process the event data.
Run MITRE TTP Search	`string`	Optional	Whether the system automatically maps tactic & techniques on newly ingested events. The default value is True.
Run Event Automation Rules	`string`	Optional	Whether the system executes Event Automation Rules for dismissal and escalation. The default value is True.

Sample Request

Sample Data

JSON

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Connection Name": "Splunk",
    "Start Time": "2020-01-01 06:00:00",
    "End Time": "2020-01-01 18:00:00",
    "Top Recent Event Number": 20,
    "Search Condition": "search sourcetype=\"WinEventLog:Microsoft-Windows-Sysmon/Operational\" EventCode=\"1\"",
    "Techniques": [
      {
        "tactic": "Initial Access",
        "technique": "Spearphishing Attachment"
      },
      {
        "tactic": "Execution",
        "technique": "Signed Script Proxy Execution"
      }
    ],
    "Risk Level": 4,
    "Interval (Minutes)": 3,
    "Event Playbook": null,
    "Run MITRE TTP Search": null,
    "Run Event Automation Rules": null
  }
}

Response

Response Fields

Field Name	Type	Description
error	`string`	The error message if the API request has failed.

Sample Response

JSON

{
    "error": ""
}