Google Rapid Response (GRR)

Integration version: 5.0

Use Cases

Joe saw something weird, check his machine
Forensically acquire 25 machines for analysis
Tell me if this machine is compromised

Configure Google Rapid Response (GRR) integration in Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Integration parameters

Use the following parameters to configure the integration:

Parameter Display Name	Type	Default Value	Is Mandatory	Description
API Root	String	https://<IP>:8000	Yes	Server URL including port.
Username	String	N/A	Yes	The username of the GRR server.
Password	Password	N/A	Yes	The password for GRR connection.
Verify SSL	Checkbox	unchecked	No	If enabled, verify the SSL certificate for the connection to the GRR server.

Actions

Ping

Description

Test connectivity to the GRR with parameters provided at the integration configuration page in the Google Security Operations Marketplace tab.

Parameters

N/A

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options
is_success	is_success=False
is_success	is_success=True

Case Wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: if successful: print "Successfully connected to the GRR server with the provided connection parameters!" The action should fail and stop a playbook execution: (wrong creds, no internet connection, etc) if not successful: print "Failed to connect to the GRR server! Error is {0}".format(exception.stacktrace)	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:
if successful: print "Successfully connected to the GRR server with the provided connection parameters!"

The action should fail and stop a playbook execution: (wrong creds, no internet connection, etc)
if not successful: print "Failed to connect to the GRR server! Error is {0}".format(exception.stacktrace)

General

List Clients

Description

Search Clients in order to start interacting with them.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Offset	String	N/A	No	Specify Found clients starting offset.
Max Results To Return	String	5	No	Specify how many clients to return in the response.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options
is_success	is_success=False
is_success	is_success=True

JSON Result

[{
    "Client_ID": "C.d5d864717e679364",
    "Agent_Info":{
       "Client_Name": "grr",
       "Client_Version": 3420}
    "OS_Info":{
       "System": "Linux",
       "Release": "Ubuntu",
       "Architecture": "x86_64",
       "Installation_Time": "2020-04-09 13:44:17 UTC",
       "Kernel": "4.15.0-96-generic",
       "Version": "18.04"}
    "Client_Last_Booted_At": "",
    "Client_First_Seen_At": "2020-09-25 14:26:38 UTC",
    "Client_Last_Seen": "2020-11-19 10:12:52 UTC",
    "Client_Last_Clock": "2020-11-19 10:12:52 UTC",
    "Memory_Size": "985.6MiB",
    "Client_Labels": []
   }]

Case Wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: if successful: print "Successfully listed available clients in GRR" If nothing found (no clients available): Print: "No clients are available in GRR" The action should fail and stop a playbook execution: if fatal error, like wrong credentials, no connection to server, other: print "Error executing action "List Clients". Reason: {0}''.format(error.Stacktrace)	General
CSV	Table Name: GRR Clients Table columns: Client ID Host OS Version First Seen Client Version Labels Last Check In OS Install Date	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:

if successful: print "Successfully listed available clients in GRR"

If nothing found (no clients available): Print: "No clients are available in GRR"

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other: print "Error executing action "List Clients". Reason: {0}''.format(error.Stacktrace)

General

CSV

Table Name: GRR Clients

Table columns:

Client ID

Host

OS Version

First Seen

Client Version

Labels

Last Check In

OS Install Date

General

Get Client Details

Description

Get client full details.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Client ID	String	N/A	Yes	ID of the client. Comma separated.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options
is_success	is_success=False
is_success	is_success=True

JSON Result

[
        {
            "HardwareInfo": {
                "system_product_name": "HVM domU",
                "bios_rom_size": "64 kB",
                "bios_vendor": "Xen",
                "system_sku_number": "Not Specified",
                "system_family": "Not Specified",
                "system_uuid": "EC2EDE26-BB13-B80C-1915-DC53118B923F",
                "system_manufacturer": "Xen",
                "bios_release_date": "08/24/2006",
                "bios_version": "4.2.amazon",
                "serial_number": "ec2ede26-bb13-b80c-1915-dc53118b923f",
                "bios_revision": "4.2"
            },
            "LastClock": 1535907460060247,
            "Interfaces": [
                {
                    "ifname": "lo",
                    "addresses": [
                        {
                            "packed_bytes": "fwAAAQ==",
                            "address_type": "INET"
                        },
                        {
                            "packed_bytes": "AAAAAAAAAAAAAAAAAAAAAQ==",
                            "address_type": "INET6"
                        }
                    ],
                    "mac_address": "AAAAAAAA"
                },
                {
                    "ifname": "eth0",
                    "addresses": [
                        {
                            "packed_bytes": "rB8sWw==",
                            "address_type": "INET"
                        },
                        {
                            "packed_bytes": "/oAAAAAAAAAE1kv//h5yfg==",
                            "address_type": "INET6"
                        }
                    ],
                    "mac_address": "BtZLHnJ+"
                }
            ],
            "OS": {
                "kernel": "4.4.0-1065-aws",
                "install_date": 1534280169000000,
                "system": "Linux",
                "fqdn": "ip-172-31-44-91.eu-central-1.compute.internal",
                "machine": "x86_64",
                "version": "16.4",
                "release": "Ubuntu"
            },
            "AgentInfo": {
                "client_name": "grr",
                "client_description": "grr linux amd64",
                "client_version": 3232,
                "build_time": "2018-06-28 09:37:57"
            },
            "Labels": [],
            "LastBootedAt": 1535292604000000,
            "FirstSeenAt": 1535293827970976,
            "User": [],
            "Volumes": [
                {
                    "total_allocation_units": 50808745,
                    "bytes_per_sector": 4096,
                    "sectors_per_allocation_unit": 1,
                    "unixvolume": {
                        "mount_point": "/"
                    },
                    "actual_available_allocation_units": 50027766
                }
            ],
            "LastCrashAt": null,
            "LastSeenAt": 1535907460075229,
            "ID": "C.d824a5afc0ee6a46"
        }
]

Case Wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: if successful: print (f"Successfully fetched details for the following clients: {client_ids_list}") if one/some client ids are invalid: print (f"Could not fetch details for the specified clients. {client_ids list} does not exist") The action should fail and stop a playbook execution: if fatal error, like wrong credentials, no connection to server, other: print "Error executing action "Get Client Details". Reason: {1}''.format( error.Stacktrace)	General
CSV	Table Name: GRR Clients Details Table columns: Client ID Host OS Version Labels Memory Size Client Version First Seen Last Seen OS Install Date	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:

if successful: print (f"Successfully fetched details for the following clients: {client_ids_list}")
if one/some client ids are invalid: print (f"Could not fetch details for the specified clients. {client_ids list} does not exist")

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other:
print "Error executing action "Get Client Details". Reason: {1}''.format( error.Stacktrace)

General

CSV

Table Name: GRR Clients Details

Table columns:

Client ID

Host

OS Version

Labels

Memory Size

Client Version

First Seen

Last Seen

OS Install Date

General

List Launched Flows

Description

List flows launched on a specified client.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Offset	String	N/A	No	Specify Found flows starting offset
Max Results To Return	String	5	No	Specify how many flows to return in the response.

Run On

This action runs on the following entities:

IP Address
Hostname

Action Results

Script Result

Script Result Name	Value Options
is_success	is_success=False
is_success	is_success=True

JSON Result

 {
            "Creator": "admin",
            "NestedFlow": [],
            "LastActiveAt": 1535900632278975,
            "Args": {
               Flat dict of runner_args - only values
            },
            "State": "TERMINATED",
            "StartedAt": 1535900542745106,
            "Flow_ID": "B4E564CC",
            "Flow_Name": "AnalyzeClientMemory"
        }

Case Wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: if successful: print (f"Successfully listed flows launched on {client_id} client") if no entities: print (f"Could not list flows. No entities were found.") if one successfully and one not - is_sucess=True msg: "Successfully listed flows launched on the following entities: {entity identifier} " "Could not list flows on the following entities: {entity identifier}" If no entities (IPs& Hostnames): Print(f"Could not list flows. IPs or Hosts entities were not found in current scope") The action should fail and stop a playbook execution: if fatal error, like wrong credentials, no connection to server, other: print "Error executing action "List Launched Flows" for {0} client. Reason: {1}''.format(client_id, error.Stacktrace)	General
CSV	Table Name: GRR Launched Flows Table columns: Flow Name Flow ID State Creation Time Last Active Creator	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:

if successful: print (f"Successfully listed flows launched on {client_id} client")
if no entities: print (f"Could not list flows. No entities were found.")
if one successfully and one not - is_sucess=True msg: "Successfully listed flows launched on the following entities: {entity identifier} " "Could not list flows on the following entities: {entity identifier}"
If no entities (IPs& Hostnames): Print(f"Could not list flows. IPs or Hosts entities were not found in current scope")

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other: print "Error executing action "List Launched Flows" for {0} client. Reason: {1}''.format(client_id, error.Stacktrace)

General

CSV

Table Name: GRR Launched Flows

Table columns:

Flow Name
Flow ID
State
Creation Time
Last Active
Creator

General

List Hunts

Description

Get all available hunts.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Creator	String	N/A	No	Return hunts created by a specified user.
Offset	String	N/A	No	Specify Found hunts starting offset
Max Results To Return	String	5	No	Specify how many hunts to return in the response.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options
is_success	is_success=False
is_success	is_success=True

JSON Result

[
        {
            "Hunt_Description": "Interrogate run by cron to keep host info fresh.",
            "Creator": "GRRCron",
            "Is_Robot": false,
            "State": "STARTED",
            "Creation Time": "1605690387510082",
            "Start Time (initial)": "1605690387678448",
            "Start Time (last)": "1605690387678448",
            "Duration": " ",
            "Client Limit": 0,
            "Expiration Time": " ",
            "Hunt_ID": "86C0ADF9",
         }
]

Case Wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: if successful: print (f"Successfully listed hunts") if creator is invalid: print (f"Could not list hunts for the specified creator. {creator} does not exist") is_success=false If creator is valid, but offset is high so there are no results: print (f"Could not list hunts for the specified creator. Please check the Offset value." The action should fail and stop a playbook execution: if fatal error, like wrong credentials, no connection to server, other: print "Error executing action "List Hunts. Reason: {0}''.format(error.Stacktrace)	General
CSV	Table Name: Hunts Table columns: Hunt ID Status Creation Time Start Time Duration Client Limit Expiration time Creator Description	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:

if successful: print (f"Successfully listed hunts")
if creator is invalid: print (f"Could not list hunts for the specified creator. {creator} does not exist") is_success=false
If creator is valid, but offset is high so there are no results: print (f"Could not list hunts for the specified creator. Please check the Offset value."

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other: print "Error executing action "List Hunts. Reason: {0}''.format(error.Stacktrace)

General

CSV

Table Name: Hunts

Table columns:

Hunt ID

Status

Creation Time

Start Time

Duration

Client Limit

Expiration time

Creator

Description

General

Get Hunt Details

Description

Get Hunt details.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Hunt ID	String	N/A	Yes	ID of the hunt to fetch. Comma separated.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options
is_success	is_success=False
is_success	is_success=True

JSON Result

[
        {
            "Name": "GenericHunt",
            "Expires": 1537063517000000,
            "Description": "ziv test",
            "Creator": "admin",
            "IsRobot": false,
            "Status": "PAUSED",
            "Hunt_ID": "3E9D4606",
            "Created": 1535853917657925,
            "Start_Time": 1535853917657925,
            "Duration": "2w",
            "Expiration time": " ",
            "Crash_limit": 100,
            "Client_limit": 100,
            "Client_rate (clients/min)": "20.5",
            "Client_Queued": "20.5",
            "Client_Scheduled": "20.5",
            "Client_Outstanding": "20.5",
            "Client_Completed": "20.5",
            "Client_with Results": "20.5",
            "Results": "20.5",
            "Total_CPU_Time_Used": "20.5",
            "Total_Network_Traffic": "20.5",
            "Flow_Name": "KeepAlive",
            "Flow_Arguments": "20.5",
            "Client_Rule_Set": " "
        }
]

Case Wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: if successful: print (f"Successfully fetched details for {hunt_id} hunt") if one/some hunt ids are invalid: print (f"Could not fetch details for the specified hunts. {hunt_ids list} does not exist") The action should fail and stop a playbook execution: if fatal error, like wrong credentials, no connection to server, other: print "Error executing action "Get Hunt Details" for {0} hunt. Reason: {1}''.format(hunt_ids, error.Stacktrace)	General
Link	The structure of the link is the following: {api_root}/#/hunts/{hunt_id}	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:

if successful: print (f"Successfully fetched details for {hunt_id} hunt")
if one/some hunt ids are invalid: print (f"Could not fetch details for the specified hunts. {hunt_ids list} does not exist")

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other:
print "Error executing action "Get Hunt Details" for {0} hunt. Reason: {1}''.format(hunt_ids, error.Stacktrace)

General

Link

The structure of the link is the following:

{api_root}/#/hunts/{hunt_id}

General

Stop a Hunt

Description

Stopping a hunt will prevent new clients from being scheduled and interrupt in-progress flows the next time they change state. This is a hard stop, so in-progress results will be lost, but results already reported are unaffected. Once a hunt is stopped, there is no way to start it again.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Hunt ID	String	N/A	Yes	ID of the hunt to stop. Comma separated.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options
is_success	is_success=False
is_success	is_success=True

JSON Result

[{ "Hunt_ID": "5C1D041C", "State": STOPPED}]

Case Wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: if successful: (valid hunt ID and hunt current state is STARTED or PAUSED) - print (f"Successfully stopped the following hunts: {hunt_id list}") if one/some hunt ids is invalid: print (f"Could not stop the following hunts. {hunt_ids list} could not be found in GRR") If one/some of the hunts is not in STARTED or PAUSED states - print(f"Could not stop the following hunts: {hunt_ids list}. Hunt can only be stopped from STARTED or PAUSED states.") NOTE: IS_SUCCESS should be set to true if at least one of the hunts stopped. The action should fail and stop a playbook execution: if fatal error, like wrong credentials, no connection to server, other: print - "Error executing action "Stop a Hunt" for {0} hunt. Reason: {1}''.format(hunt_ids, error.Stacktrace)	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:

if successful: (valid hunt ID and hunt current state is STARTED or PAUSED) - print (f"Successfully stopped the following hunts: {hunt_id list}")
if one/some hunt ids is invalid: print (f"Could not stop the following hunts. {hunt_ids list} could not be found in GRR")
If one/some of the hunts is not in STARTED or PAUSED states - print(f"Could not stop the following hunts: {hunt_ids list}. Hunt can only be stopped from STARTED or PAUSED states.")
NOTE: IS_SUCCESS should be set to true if at least one of the hunts stopped.

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other: print - "Error executing action "Stop a Hunt" for {0} hunt. Reason: {1}''.format(hunt_ids, error.Stacktrace)

General

Start a Hunt

Description

Use this to start a newly created hunt. New hunts are created in the PAUSED state, so you'll need to do this to run them. Hunts that reach their client limit will also be set to PAUSED, use this to restart them after you have removed the client limit.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Hunt ID	String	N/A	Yes	ID of the hunt to start. Comma separated.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options
is_success	is_success=False
is_success	is_success=True

JSON Result

[{ "Hunt_ID": "5C1D041C", "State": STARTED}]

Case Wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: if successful: (valid hunt ID and hunt current state is PAUSED) - print (f"Successfully started the following hunts: {hunt_id list}") if one/some hunt ids is invalid: print (f"Could not start the following hunts. {hunt_ids list} could not be found in GRR") If one/some of the hunts is not in PAUSED state - print(f"Could not stop the following hunts: {hunt_ids list}. Hunt can only be started from PAUSED state.") NOTE: IS_SUCCESS should be set to true if at least one of the hunts started. The action should fail and stop a playbook execution: if fatal error, like wrong credentials, no connection to server, other: print "Error executing action "Start a Hunt" for {0} hunt. Reason: {1}''.format(hunt_ids, error.Stacktrace)	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:

if successful: (valid hunt ID and hunt current state is PAUSED) - print (f"Successfully started the following hunts: {hunt_id list}")
if one/some hunt ids is invalid: print (f"Could not start the following hunts. {hunt_ids list} could not be found in GRR")
If one/some of the hunts is not in PAUSED state - print(f"Could not stop the following hunts: {hunt_ids list}. Hunt can only be started from PAUSED state.")
NOTE: IS_SUCCESS should be set to true if at least one of the hunts started.

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other: print "Error executing action "Start a Hunt" for {0} hunt. Reason: {1}''.format(hunt_ids, error.Stacktrace)

General