CimTrak

The CimTrak integration helps you detect unexpected system/device/config modifications and automatically respond/react to threats.

Forensics & Malware Analysis · CimTrak - System Integrity Assurance

Configuration parameters

  • url — App Server URL (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • apikey — API Key (required)
  • insecure — Trust any certificate (not secure)
  • Repository URL — Repository URL (required)
  • Repository Port — Repository Port (required)
  • incidentFetchInterval — Incidents Fetch Interval
  • proxy — Use system proxy settings
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — Maximum number of incidents to fetch every time

Commands (37)

  • add-hash-allow-list

    Add Hash to allow list.

  • add-hash-deny-list

    Add Hash to deny list.

  • add-ticket

    Creates a ticket.

  • add-ticket-comment

    Adds a comment to a ticket or task.

  • check-file-against-trusted-file-registry-by-hash

    Description Issues a request to check a list of files (specified by hashes) against the trusted file registry.

  • compliance-scan-children

    Launch compliance scan for all children of object.

  • compliance-scan-with-summary

    Launch compliance scan for object and return results.

  • delete-hash-allow-list

    Add Hash to allow list.

  • delete-hash-deny-list

    Add Hash to deny list.

  • demote-authoritative-baseline-files

    This function removes a file (or list of files) from being the authoritative baseline.

  • deploy

    Deploys a specific version of an object group. All existing files will be overwritten with the specified set.

  • deploy-by-date

    Deploy By Date.

  • file-analysis-by-hash

    Submits a file's hash for analysis and returns the results.

  • file-analysis-by-objectdetail-id

    Submits a file's objectDetailId for analysis and returns the results.

  • force-sync

    Sends a request to the server to synchronize an object group.

  • get-agent-info

    Returns an array of agent information given an object ID.

  • get-agent-object-by-alternate-id

    Get agent object from alternate id.

  • get-agent-object-by-ip

    Get agent object from ip address.

  • get-agent-object-by-name

    Get agent object from agent name.

  • get-agent-object-id-by-alternate-system-id

    Get agent object id from alternate system id.

  • get-compliance-archive-details

    Returns compliance scans details.

  • get-compliance-archive-summary

    Returns compliance scans summary.

  • get-current-compliance-items

    This function returns the benchmarks and/or compliance mappings for the compliance policy specified by the object ID.

  • get-events

    Returns Events from the event log.

  • get-object

    Retrieves information for an object.

  • get-object-group

    This function returns an entire data structure describing an object group.

  • get-objects

    Retrieves a list of objects.

  • get-sub-generations

    Returns the subGenerations for an object group (specified by object ID.

  • get-ticket-tasks

    This function gets ticket task information from a CimTrak Master Repository. This function returns an array of ticket task objects.

  • get-tickets

    This function gets ticket information from a CimTrak Master Repository. This function returns an array of ticket objects.

  • lock

    Locks an object group.

  • promote-authoritative-baseline-files

    This function sets a file (or list of files) as the authoritative baseline.

  • run-report-by-name

    This function runs the report specified by the report name. The report name can be obtained from the getReportHeaders API. The report's parameters can be obtained from the getReportArguments API.

  • unlock

    Unlocks an object group.

  • update-task-disposition

    Updates the tasks specified in taskIdArray to the disposition specified in the disposition parameter.

  • update-ticket

    Update Ticket.

  • view-file

    This function returns the contents of the requested file encoded in base64.