The "Search Observables by Grouped UDM Fields in Chronicle" workflow template is designed for threat hunting by efficiently querying Google Chronicle using various observables such as hash, IP address, email, username, and domain. This workflow builds a Unified Data Model (UDM) query by appending observables with an AND operator, allowing security teams to identify potential threats across multiple data points. It outputs comprehensive results, including CSV format, for streamlined analysis and reporting.
Optional Triggers
["It can be used as a nested workflow as it outputs all items found by Chronicle."]
Use Cases
Threat Hunting
Workflow Breakdown
Receives hash, ip, email, username and domain observables. All fields are optional.
Builds an UDM query appending all items with an AND operator.
Vendors
Utils, Google Chronicle
Workflow Output
Output provides the time range, all items output from Chronicle in JSON format and a CSV formatted extraction of main values to be tabulated.
Tips
Show the CSV output in an Slack Snippet using the filetype CSV.