Scripts

Use the Investigate page to construct and execute ad hoc scripts on identified endpoints in order to perform threat counteraction measures or gather additional information on them.

Choose the Script Target

  1. In the Endpoints field, enter the ID of one or more endpoints in your organization that will have the script run against them.

    2. To remove an endpoint from the field, click the X at the right end of the endpoint label.

    1. You can add multiple endpoints. Click Random Endpoints () at the right end of the field.

      2. The Add Multiple Endpoints dialog opens.

      Note: The default value for the Endpoints field is 10, it is not the maximum number of endpoints you can include in a script run. This value can be changed by either typing in a new number into the field or using the up and down arrows to specify another number.

    2. Type the number of random endpoints you wish to run the script against into the Number field, if you wish to include more or less than ten endpoints.

    3. Click Add. The endpoints are then added to the Endpoints field.

Enter a Script

You can type in or paste a Python script into the Custom Script field, or select one from the Catalog.

  1. Click Browse. The Script Catalog dialog opens.

    2. This catalog contains a rich collection of pre-defined scripts that have been created by the Orbital engineering team and TRE (Threat Research for Endpoint) to help you get started. This information should help you quickly learn how powerful Orbital is for threat hunting.

    A Search field appears at the top of the dialog. The script list will automatically adjust to display only those catalog script that contain the search term(s).

  2. Click on a script name to view detailed information.

  3. Choose a script from the list.

    4. The script detail dialog includes a detailed script description, plus the ID, OS, Categories, ATT&CK™ Techniques and Tactics, information and warning messages, and the Python script.

    Note: Some catalog scripts will require additional parameters once they have been added. These scripts will display one or more Parameters fields describing the required information after they've been added.
    Note: The Python code added from the Catalog will be hidden by default. To display the code, click on the name of the catalog script.

    Note: Any values or parameters you enter into the Investigate page fields will be retained if you move to another page or tab, then return to the Investigate page. However, if you click Clear, refresh your browser, or your Orbital session expires, any values entered into the Investigate page fields will not be retained.

Save to the Catalog

To save a custom script to the Orbital catalog:

  1. Navigate to Orbital's Investigate page.

  2. Place your cursor in the Custom Script field.

  3. Type your Python code into the Custom Script field. You will notice that as you type your Python code, the Save Script button is displayed.

  4. Click Save Script. This will display the Save Script dialog.

  5. Type the name that the script will be saved under in the catalog in the Script Name field.

  6. Type a description of the script into the Description field.

  7. Select the operating system or operating systems that the script will be run against, using the OS checkboxes. This defaults to no operating systems selected. Once you have selected one or more operating systems, the Save button will be displayed.

  8. Click Save. This will remove the Save Script dialog from the screen and return to the Investigate page. The newly saved script is listed at the bottom of the page.

More Info