Accessdata Deprecated

Deprecated. Use Exterro FTK instead.

Forensics & Malware Analysis · Accessdata (Deprecated)

Details

IDAccessdata
ProviderExterro
CategoryForensics & Malware Analysis
From Version5.0.0
Docker Imagedemisto/python3:3.10.5.31928
Supported ModulesAgentix

README

Use the Quin-C AccessData integration to protect against and provide additional visibility into phishing and other malicious email attacks. This integration was integrated and tested with version 20190926 of Quin-C Accessdata.

Documentation for the integration was provided by Quin-C.

AccessData Playbook

For example, you can look at “Accessdata: Dump memory for malicious process” playbook to understand how to use this integration.

Configure AccessData in Cortex

Parameter Description Example
Name A meaningful name for the integration instance. Quin-C Instance Alpha
Server URL The URL to the AccessData server, including the scheme. FQDN or IP address in X.X.X.X format with scheme specified.
Token A piece of data that servers use to verify for authenticity eea810f5-a6f6
Trust any certificate (not secure) When selected, certificates are not checked. N/A
Use system proxy settings Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration. https://proxyserver.com

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get a process list

Returns a list of processes from the legacy agent.

Base Command

accessdata-legacyagent-get-processlist

Input
Argument Name Description Required
caseid The ID of the case. Optional
target_ip The IP address of the agent. Required
Context Output
Path Type Description
Accessdata.Job.ID string The ID of the job.
Accessdata.Job.CaseID string The ID of the case.
Accessdata.Job.CaseJobID string The concatenated CaseID and JobID, for example, like “1_800”.
Accessdata.Job.Type string The job type.
Accessdata.Job.State string The execution state of the job.
Command Example
accessdata-legacyagent-get-processlist caseid=2 target_ip=X.X.X.X
Context Example
{
    "Accessdata.Job": {
        "ID": 157, 
        "Type": "Volatile", 
        "CaseID": "2", 
        "State": "Unknown", 
        "CaseJobID": "2_157"
    }
}
Human Readable Output

JobID: 157

Create a legacy agent memory dump

Creates a legacy agent memory dump.

Base Command

accessdata-legacyagent-get-memorydump

Input
Argument Name Description Required
caseid The ID of the case. Optional
target_ip The IP address of the agent. Required
Context Output
Path Type Description
Accessdata.Job.ID string The ID of the job.
Accessdata.Job.CaseID string The ID of the case.
Accessdata.Job.CaseJobID string The concatenated CaseID and JobID, for example, like “1_800”.
Accessdata.Job.Type string The job type.
Accessdata.Job.State string The execution state of the job.
Command Example
accessdata-legacyagent-get-memorydump caseid=2 target_ip=X.X.X.X
Context Example
{
    "Accessdata.Job": {
        "ID": 158, 
        "Type": "LegacyMemoryDump", 
        "CaseID": "2", 
        "State": "Unknown", 
        "CaseJobID": "2_158"
    }
}
Human Readable Output

JobID: 158

Read a file from a case folder

Reads a file from a case folder and puts the contents into the context output.

Base Command

accessdata-read-casefile

Input
Argument Name Description Required
filepath The path to the case file. Required
Context Output
Path Type Description
Accessdata.File.Contents string The contents of the file.
Command Example
accessdata-read-casefile filepath="\\X.X.X.X\D$\paths\cases\ProcessingHelperCase\b389a8e9-4ce4-473d-8d2e-9026f53f925c\Jobs\job_153\fa9787a3-49a1-4d73-a194-7c944eb9a3bf\1\snapshot.xml"
Context Example
{
    "Accessdata.File.Contents": "<?xml version=\"1.0\"?>\r\n<root>\r\n<Process resultitemtype=\"15\"><Name>addm.exe</Name><Path/><StartTi ... ress>0</baseAddress><ImageSize>0</ImageSize><ProcessName/><FromAgent/></DLL>\r\n</root>\r\n"
}
Human Readable Output
<?xml version="1.0"?>
<root>
<Process resultitemtype="15">\<Name>addm.exe</Name>\<Path/>\<StartTi ... ress>0</baseAddress>\<ImageSize>0</ImageSize>\<ProcessName/>\<FromAgent/>\</DLL>
</root>

Check the status of a job

Checks the status of a job.

Base Command

accessdata-jobstatus-scan

Input
Argument Name Description Required
caseJobID The concatenated CaseID and JobID, for example, “1_800”. Required
Context Output
Path Type Description
Accessdata.Job.CaseID string The ID of the case.
Accessdata.Job.ID string The ID of the job.
Accessdata.Job.CaseJobID string The concatenated CaseID and JobID, for example, like “1_800”.
Accessdata.Job.State string The execution state of the job.
Command Example
accessdata-jobstatus-scan caseJobID=2_153
Context Example
{
    "Accessdata.Job": {
        "ID": "153", 
        "CaseID": "2", 
        "State": "Success", 
        "CaseJobID": "2_153"
    }
}
Human Readable Output

Current job state: Success

Get a snapshot of a path

Gets a snapshot of the path from the results of the process list job.

Base Command

accessdata-get-jobstatus-processlist

Input
Argument Name Description Required
caseID The ID of the case. Required
jobID The ID of the job. Required
Context Output
Path Type Description
Accessdata.Job.State string The state of the job.
Accessdata.Job.Result string The snapshot of the path with the processes list.
Accessdata.Job.ID number The ID of the job.
Accessdata.Job.CaseID number The case ID of the job.
Accessdata.Job.CaseJobID string The concatenated CaseID and JobID, for example, like “1_800”.
Command Example
accessdata-get-jobstatus-processlist caseID=2 jobID=153
Context Example
{
    "Accessdata.Job": {
        "ID": "153", 
        "Result": "\\\\X.X.X.X\\D$\\paths\\cases\\ProcessingHelperCase\\b389a8e9-4ce4-473d-8d2e-9026f53f925c\\Jobs\\job_153\\fa9787a3-49a1-4d73-a194-7c944eb9a3bf\\1\\snapshot.xml", 
        "CaseID": "2", 
        "State": "Success", 
        "CaseJobID": "2_153"
    }
}
Human Readable Output

\X.X.X.X\D$\paths\cases\ProcessingHelperCase\b389a8e9-4ce4-473d-8d2e-9026f53f925c\Jobs\job_153\fa9787a3-49a1-4d73-a194-7c944eb9a3bf\1\snapshot.xml

Get a memory dump

Gets a memory dump path from the results of a memory dump job.

Base Command

accessdata-get-jobstatus-memorydump

Input
Argument Name Description Required
caseID The ID of the case. Required
jobID The ID of the job. Required
Context Output
Path Type Description
Accessdata.Job.State string The state of the job.
Accessdata.Job.Result string The path of the memory dump.
Accessdata.Job.ID number The ID of the job.
Accessdata.Job.CaseID number The case ID of the job.
Accessdata.Job.CaseJobID string The concatenated CaseID and JobID, for example, like “1_800”.
Command Example
accessdata-get-jobstatus-memorydump caseID=2 jobID=154
Context Example
{
    "Accessdata.Job": {
        "ID": "154", 
        "Result": "\\\\X.X.X.X\\data\\SiteServer\\storage\\60564598-ca55-475c-9f27-ab4992e8ff46\\1\\memdump.mem", 
        "CaseID": "2", 
        "State": "Success", 
        "CaseJobID": "2_154"
    }
}
Human Readable Output

\X.X.X.X\data\SiteServer\storage\60564598-ca55-475c-9f27-ab4992e8ff46\1\memdump.mem

Get an ID

Returns the ID of the processing case.

Base Command

accessdata-get-processing-case-id

Input

There are no input arguments for this command.

Context Output
Path Type Description
Accessdata.ProcessingCaseId string The ID of the processing case.
Command Example
accessdata-get-processing-case-id
Context Example
{
    "Accessdata.ProcessingCaseId": 2
}
Human Readable Output

2

Configuration parameters

  • server_name — Server URL with scheme (FQDN or IP address in X.X.X.X format with scheme specified) (required)
  • Token — The token is required to connect to Quinc. (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (7)

  • accessdata-get-jobstatus-memorydump

    Returns the memory dump path from the result of the memory dump job.

  • accessdata-get-jobstatus-processlist

    Returns a snapshot path from the results of the process list job.

  • accessdata-get-processing-case-id

    Returns the ID of the Quin-C processing case.

  • accessdata-jobstatus-scan

    Checks status of the job.

  • accessdata-legacyagent-get-memorydump

    Creates a legacy agent memory dump.

  • accessdata-legacyagent-get-processlist

    Returns a list of processes from the legacy agent.

  • accessdata-read-casefile

    Reads the file from a case folder and returns the contents to the current context.

Source

Accessdata.py Accessdata_test.py Accessdata.yml Accessdata_description.md
Download History Raw 
commonfields:
  id: Accessdata
  version: -1
name: Accessdata
display: Accessdata (Deprecated)
category: Forensics & Malware Analysis
provider: Exterro
description: Deprecated. Use Exterro FTK instead.
deprecated: true
configuration:
- display: Server URL with scheme (FQDN or IP address in X.X.X.X format with scheme specified)
  name: server_name
  defaultvalue: server_url
  type: 0
  required: true
- display: The token is required to connect to Quinc.
  name: Token
  defaultvalue: 1861a70a-3287-4289-938b-bbab1446e2d2
  type: 0
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  commands:
  - name: accessdata-legacyagent-get-processlist
    arguments:
    - name: caseid
      description: The ID of the case.
    - name: target_ip
      required: true
      description: The IP address of the agent.
      defaultValue: locallhost
    outputs:
    - contextPath: Accessdata.Job.ID
      description: The ID of the job.
      type: string
    - contextPath: Accessdata.Job.CaseID
      description: The Case ID.
      type: string
    - contextPath: Accessdata.Job.CaseJobID
      description: The concatenated CaseID and JobID (such as "1_800").
      type: string
    - contextPath: Accessdata.Job.Type
      description: The job type.
      type: string
    - contextPath: Accessdata.Job.State
      description: The execution state of the job.
      type: string
    description: Returns a list of processes from the legacy agent.
  - name: accessdata-legacyagent-get-memorydump
    arguments:
    - name: caseid
      description: The ID of the case.
    - name: target_ip
      required: true
      description: The IP address of the agent.
      defaultValue: locallhost
    outputs:
    - contextPath: Accessdata.Job.ID
      description: The ID of the job.
      type: string
    - contextPath: Accessdata.Job.CaseID
      description: The ID of the case.
      type: string
    - contextPath: Accessdata.Job.CaseJobID
      description: The concatenated CaseID and JobID (such as "1_800").
      type: string
    - contextPath: Accessdata.Job.Type
      description: The job type.
      type: string
    - contextPath: Accessdata.Job.State
      description: The execution state of the job.
      type: string
    description: Creates a legacy agent memory dump.
  - name: accessdata-read-casefile
    arguments:
    - name: filepath
      required: true
      description: The path of the case file.
      defaultValue: localhost
    outputs:
    - contextPath: Accessdata.File.Contents
      description: The contents of the file.
      type: string
    description: Reads the file from a case folder and returns the contents to the current context.
  - name: accessdata-jobstatus-scan
    arguments:
    - name: caseJobID
      required: true
      description: The concatenated CaseID and JobID (such as "1_800").
      isArray: true
    outputs:
    - contextPath: Accessdata.Job.CaseID
      description: The case ID.
      type: string
    - contextPath: Accessdata.Job.ID
      description: The job ID.
      type: string
    - contextPath: Accessdata.Job.CaseJobID
      description: The concatenated CaseID and JobID (such as "1_800").
      type: string
    - contextPath: Accessdata.Job.State
      description: The state of the job's execution.
      type: string
    description: Checks status of the job.
  - name: accessdata-get-jobstatus-processlist
    arguments:
    - name: caseID
      required: true
      description: The ID of the case.
      defaultValue: "1"
    - name: jobID
      required: true
      description: The ID of the job.
      defaultValue: "1"
    outputs:
    - contextPath: Accessdata.Job.State
      description: The state of the job.
      type: string
    - contextPath: Accessdata.Job.Result
      description: The path to the snapshot with the processes list.
      type: string
    - contextPath: Accessdata.Job.ID
      description: The ID of the job.
      type: number
    - contextPath: Accessdata.Job.CaseID
      description: The case ID of the job.
      type: number
    - contextPath: Accessdata.Job.CaseJobID
      description: The concatenated CaseID and JobID (such as "1_800").
      type: string
    description: Returns a snapshot path from the results of the process list job.
  - name: accessdata-get-jobstatus-memorydump
    arguments:
    - name: caseID
      required: true
      description: The ID of the case.
      defaultValue: "1"
    - name: jobID
      required: true
      description: The ID of the job.
      defaultValue: "1"
    outputs:
    - contextPath: Accessdata.Job.State
      description: The state of the job.
      type: string
    - contextPath: Accessdata.Job.Result
      description: The path to the memory dump.
      type: string
    - contextPath: Accessdata.Job.ID
      description: The ID of the job.
      type: number
    - contextPath: Accessdata.Job.CaseID
      description: The case ID of the job.
      type: number
    - contextPath: Accessdata.Job.CaseJobID
      description: The concatenated CaseID and JobID (such as "1_800").
      type: string
    description: Returns the memory dump path from the result of the memory dump job.
  - name: accessdata-get-processing-case-id
    arguments: []
    outputs:
    - contextPath: Accessdata.ProcessingCaseId
      description: The ID of Quin-C processing case.
      type: string
    description: Returns the ID of the Quin-C processing case.
  dockerimage: demisto/python3:3.10.5.31928
  script: '-'
  type: python
  subtype: python3
tests:
- No test
fromversion: 5.0.0