Skip to content

Task AR

SOAR Calling Active Response Task

Supplementing SOAR Task, adding new Active Response: kill process, delete file, run command, run custom active response

Purpose:
SOAR task runs active response on any agent, to handle incidents directly on affected machines quickly and automatically

Requirements: Install new agent with onexar

1. Processing Flow

SOAR Observer Trigger -> Run Task Active Response -> POST API sends command to sensor to run AR, wait for result (subscribe mqtt, timeout 5s) -> Response API -> SOAR set data output

1.1. POST API to sensor

Add category "run-active-response" for /service-api
Laravel sends request body with payload:

1.2. Sensor receives request, sends run Active Response command to agent

Parse alert data, add mqtt information

Agent will receive AR command, execute command, when done mqtt will publish result to topic reply_to

The processArResponse() function listens and processes returned message
Timeout: 5s

Return result to API
(No execution result on agent, sensor will return whether AR API call was successful)

2. Use Case

2.1. Run command on agent

Setting command:
Select manager name, agent name, enter command and output to save result as illustrated

After run command execution, data will be saved to output, pass this value to next node as needed, example send result to telegram

Output telegram:

2.2. Kill Process

Input: executable binary path

  • Kill process: check if process is running, if running then kill process
  • Return logs (Successful / Fail)

Setting Kill Process as follows:

  • Pass executable file path (program will auto-check and kill process)

Result after execution will be saved to output variable, take this variable value to pass to next node in SOAR

Illustrated output displayed on Telegram:
1 case file not executed and 1 case file executed and successfully killed

2.3. Remove file

Input: file path

  • Delete file: Check existence and proceed to delete file. Check 2 more times to see if new file is auto-generated.
  • Return logs (Successful / Fail)

Setting Delete file as follows:

  • Pass file path to delete

Illustrated output displayed on Telegram:

Logs will also be saved in Workflow logs

2.4. Run custom AR

Example original active response API:
# Get MD5

curl -k -X PUT "https://localhost:55000/active-response?agents_list=056&wait_for_complete=true" -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{`  
`"command":"onexar-linux0",`  
`"arguments":["get-md5"],`  
  `"alert": {`  
    `"data": {`  
        **`"file_path": "/usr/bin/anydesk"`**  
    **`}`**  
  `}`  
`}'

Then setting to call AR get md5 file as follows:
Args: get-md5
Alert data: json string needed when calling that AR

Output telegram: