Workbench - view, filter, search
To learn more, visit the Trend Vision One documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| End Time | The end time that indicates the end of the data retrieval time range. |
| Filter | Filter for retrieving a subset of the alert list.For example: indicatorValue eq '8.8.8.8'.For further information, please refer to Trend Vision One Documentation. |
| Return All Pages | Automatically fetch all resources, page by page. |
| Start Time | The start time that indicates the start of the data retrieval time range. |
| Time Target | The time range to be used for retrieving Workbench alert data. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Order By | Specifies the fields by which the results are sorted. |
| Skip Token | The pagination token that’s used for retrieving the next page of results.It is returned in nextLink, as a query parameter named skipToken. |
Example Output
{ "totalCount": 1, "count": 1, "items": [ { "schemaVersion": "1.12", "id": "WB-9002-20220906-00022", "investigationStatus": "New", "status": "Open", "investigationResult": "No Findings", "workbenchLink": "https://THE_WORKBENCH_URL", "alertProvider": "SAE", "modelId": "1ebd4f91-4b28-40b4-87f5-8defee4791d8", "model": "Privilege Escalation via UAC Bypass", "modelType": "preset", "score": 64, "severity": "high", "firstInvestigatedDateTime": "2022-10-06T02:30:31Z", "createdDateTime": "2022-09-06T02:49:31Z", "updatedDateTime": "2022-09-06T02:49:48Z", "incidentId": "IC-1-20230706-00001", "caseId": "CL-1-20230706-00001", "ownerIds": [ "12345678-1234-1234-1234-123456789012" ], "impactScope": { "desktopCount": 1, "serverCount": 0, "accountCount": 1, "emailAddressCount": 1, "containerCount": 1, "cloudIdentityCount": 1, "entities": [ { "entityType": "account", "entityValue": "shockwave\\sam", "entityId": "shockwave\\sam", "relatedEntities": [ "35FA11DA-A24E-40CF-8B56-BAF8828CC15E" ], "relatedIndicatorIds": [], "provenance": [ "Alert" ] }, { "entityType": "host", "entityValue": { "guid": "35FA11DA-A24E-40CF-8B56-BAF8828CC15E", "name": "nimda", "ips": [ "10.10.58.51" ] }, "entityId": "35FA11DA-A24E-40CF-8B56-BAF8828CC15E", "managementScopeGroupId": "deadbeef-292e-42ae-86be-d2fef483a248", "managementScopeInstanceId": "1babc299-52de-44f4-a1d2-8a224f391eee", "managementScopePartitionKey": "4c1850c0-8a2a-4637-9f88-6afbab54dd79", "relatedEntities": [ "shockwave\\sam" ], "relatedIndicatorIds": [ 1, 2, 3, 4, 5, 6, 7, 8 ], "provenance": [ "Alert" ] }, { "entityType": "emailAddress", "entityValue": "support@pctutordetroit.com", "entityId": "SUPPORT@PCTUTORDETROIT.COM", "relatedEntities": [], "relatedIndicatorIds": [], "provenance": [ "Alert" ] }, { "entityType": "container", "entityValue": "k8s_democon_longrunl_default_09451f51-7124-4aa5-a5c4-ada24efe9da9_0", "entityId": "7d1e00176d78b2b1db0744a187314bf2ce39f3a7d43137c366ae6785e8a4f496", "relatedEntities": [], "relatedIndicatorIds": [], "provenance": [ "Alert" ] }, { "entityType": "cloudIdentity", "entityValue": "arn:aws:sts::985266316733:assumed-role/aad-admin/steven_hung", "entityId": "arn:aws:sts::985266316733:assumed-role/aad-admin/steven_hung", "relatedEntities": [], "relatedIndicatorIds": [], "provenance": [ "Alert" ] } ] }, "description": "A user bypassed User Account Control (UAC) to gain higher-level permissions.", "matchedRules": [ { "id": "25d96e5d-cb69-4935-ae27-43cc0cdca1cc", "name": "(T1088) Bypass UAC via shell open registry", "matchedFilters": [ { "id": "ac200e74-8309-463e-ad6b-a4c16a3a377f", "name": "Bypass UAC Via Shell Open Default Registry", "matchedDateTime": "2022-09-05T03:53:49.802Z", "mitreTechniqueIds": [ "T1112", "V9.T1112", "V9.T1548.002" ], "matchedEvents": [ { "uuid": "a32599b7-c0c9-45ed-97bf-f2be7679fb00", "matchedDateTime": "2022-09-05T03:53:49.802Z", "type": "TELEMETRY_REGISTRY" } ] }, { "id": "857b6396-da29-44a8-bc11-25298e646795", "name": "Bypass UAC Via Shell Open Registry", "matchedDateTime": "2022-09-05T03:53:49.802Z", "mitreTechniqueIds": [ "T1112", "T1088", "V9.T1112", "V9.T1548.002" ], "matchedEvents": [ { "uuid": "4c456bbb-2dfc-40a5-b298-799a0ccefc01", "matchedDateTime": "2022-09-05T03:53:49.802Z", "type": "TELEMETRY_REGISTRY" } ] } ] } ], "indicators": [ { "id": 1, "type": "command_line", "field": "processCmd", "value": "c:\\windows\\system32\\rundll32.exe c:\\users\\sam\\appdata\\local\\cyzfc.dat entrypoint", "relatedEntities": [ "35FA11DA-A24E-40CF-8B56-BAF8828CC15E" ], "filterIds": [ "ac200e74-8309-463e-ad6b-a4c16a3a377f" ], "provenance": [ "Alert" ] }, { "id": 2, "type": "command_line", "field": "parentCmd", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -noni -win hidden -Ep ByPass $r = [Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('....XggJHNjQjs=')); iex $r; ", "relatedEntities": [ "35FA11DA-A24E-40CF-8B56-BAF8828CC15E" ], "filterIds": [ "ac200e74-8309-463e-ad6b-a4c16a3a377f" ], "provenance": [ "Alert" ] }, { "id": 3, "type": "command_line", "field": "processCmd", "value": "c:\\windows\\system32\\rundll32.exe c:\\users\\sam\\appdata\\local\\cyzfc.dat entrypoint", "relatedEntities": [ "35FA11DA-A24E-40CF-8B56-BAF8828CC15E" ], "filterIds": [ "857b6396-da29-44a8-bc11-25298e646795" ], "provenance": [ "Alert" ] }, { "id": 4, "type": "command_line", "field": "parentCmd", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -noni -win hidden -Ep ByPass $r = [Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('....jY0KTtpZXggJHNjQjs=')); iex $r; ", "relatedEntities": [ "35FA11DA-A24E-40CF-8B56-BAF8828CC15E" ], "filterIds": [ "857b6396-da29-44a8-bc11-25298e646795" ], "provenance": [ "Alert" ] }, { "id": 5, "type": "registry_key", "field": "objectRegistryKeyHandle", "value": "hkcr\\ms-settings\\shell\\open\\command", "relatedEntities": [ "35FA11DA-A24E-40CF-8B56-BAF8828CC15E" ], "filterIds": [ "ac200e74-8309-463e-ad6b-a4c16a3a377f" ], "provenance": [ "Alert" ] }, { "id": 6, "type": "registry_key", "field": "objectRegistryKeyHandle", "value": "hkcr\\ms-settings\\shell\\open\\command", "relatedEntities": [ "35FA11DA-A24E-40CF-8B56-BAF8828CC15E" ], "filterIds": [ "857b6396-da29-44a8-bc11-25298e646795" ], "provenance": [ "Alert" ] }, { "id": 7, "type": "registry_value", "field": "objectRegistryValue", "value": "delegateexecute", "relatedEntities": [ "35FA11DA-A24E-40CF-8B56-BAF8828CC15E" ], "filterIds": [ "857b6396-da29-44a8-bc11-25298e646795" ], "provenance": [ "Alert" ] }, { "id": 8, "type": "registry_value_data", "field": "objectRegistryData", "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -NonI -W Hidden -c $x=$((gp HKCU:Software\\Microsoft\\Windows Update).Update); powershell -NoP -NonI -W Hidden -enc $x", "relatedEntities": [ "35FA11DA-A24E-40CF-8B56-BAF8828CC15E" ], "filterIds": [ "ac200e74-8309-463e-ad6b-a4c16a3a377f" ], "provenance": [ "Alert" ] } ] } ]}
Workflow Library Example
List Alerts with Trend Vision One and Send Results Via Email
Preview this Workflow on desktop