topic Re: How to get the process id from crowdstrike (CS) integration in Cortex XSOAR Discussions

How to get the process id from crowdstrike (CS) integration

sunipanda660 — Wed, 30 Aug 2023 07:41:29 GMT

Hi Folks,
In my context I do have the malware process path and malware filename too, I need to find out the local process id in the host.
Please suggest what is best way to do it.

case 1: When I try to use the cs-falcon-process-details it simply gives me the same input paramter in different fields, I was expecting to use the process_id_local, but it is the 2 part of the string split on ":". PFA result.case1
case 2: Try to remote fetch list of all running process but result is a big file and I can not process or use it in my playbook to filter
case2

case 3: Try to remote run the ps but the result is too big and I can not pass grep like sub commands to filter.
case3

Re: How to get the process id from crowdstrike (CS) integration

bhmurali — Thu, 31 Aug 2023 22:52:42 GMT

Hi,

You can use the Set automation, in the context key, name it with the key you want to save it as. For example, process_id. In the value, you can set the value where you’ve process ID in 2 parts. Use a split transformer and split it at : and call last array element transformer which will get and return the second element (which is last in this case). This will essentially transform and store the process ID in the process_id key.

You can refer to https://youtu.be/795E42gz8M8?feature=shared for video on using transformers.

Re: How to get the process id from crowdstrike (CS) integration

sunipanda660 — Mon, 04 Sep 2023 05:31:49 GMT

hi,
I was not looking at transformation.
Q- "In my context I do have the malware process path and malware filename too, I need to find out the local process id in the host.
Please suggest what is best way to do it."

Did some research and got some help from colleagues used powershell and runscript integrations to get the result; And used extend context to add it context data.

!cs-falcon-run-script host_ids="1bbxxxxxxxxxxxxxxxx7f856e" raw="$t=Get-Process ${incident.malwarename} | Format-List Id,ProcessName;Write-Output $t|Out-String -Stream" timeout="30" queue_offline="false" extend-context=true

Thanks