Details
| ID | CiscoAMP |
|---|---|
| Provider | Cisco Systems |
| Category | Endpoint |
| From Version | 6.5.0 |
| Docker Image | demisto/python3:3.10.9.42476 |
| Supported Modules | Agentix |
README
Cisco Advanced Malware Protection software is designed to prevent, detect, and help remove threats in an efficient manner from computer systems. Threats can take the form of software viruses and other malware such as ransomware, worms, Trojans, spyware, adware, and fileless malware.
This integration was integrated and tested with version 1 of CiscoAMP.
Configure Cisco AMP Secure Endpoint in Cortex
| Parameter | Description | Required |
|---|---|---|
| Server URL | True | |
| 3rd Party API Client ID | True | |
| API Key | True | |
| Trust any certificate (unsecure) | False | |
| Use system proxy | False | |
| Maximum incidents to fetch. | Maximum number of incidents per fetch. The maximum is 200. | False |
| Incident severity to fetch. | False | |
| First fetch time | First alert created date to fetch. e.g., “1 min ago”,”2 weeks ago”,”3 months ago” | False |
| Event types | Comma-separated list of Event Type IDs. | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
cisco-amp-computer-list
Fetch computers to shows information about them. Can be filtered by a variety of criteria.
Base Command
cisco-amp-computer-list
Input
| Argument Name | Description | Required |
|---|---|---|
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 500. | Optional |
| limit | Number of total results to return. | Optional |
| connector_guid | The connector GUID for a specific computer. | Optional |
| hostname | Comma-separated list of host names to filter by (has auto complete capabilities). | Optional |
| internal_ip | Internal IP to filter by. | Optional |
| external_ip | External IP to filter by. | Optional |
| group_guid | Comma-separated list of group GUIDs to filter by. | Optional |
| last_seen_within | Time range to filter by. | Optional |
| last_seen_over | Time range to filter over by. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.Computer.connector_guid | String | GUID of the connector. |
| CiscoAMP.Computer.hostname | String | Host’s name. |
| CiscoAMP.Computer.windows_processor_id | String | Windows processor ID. |
| CiscoAMP.Computer.active | Boolean | Whether the computer is active. |
| CiscoAMP.Computer.connector_version | String | Version of the connector. |
| CiscoAMP.Computer.operating_system | String | Operating system of the computer. |
| CiscoAMP.Computer.os_version | String | Operating system version. |
| CiscoAMP.Computer.internal_ips | String | List of internal IPs. |
| CiscoAMP.Computer.external_ip | String | External IP. |
| CiscoAMP.Computer.group_guid | String | GUID of the group. |
| CiscoAMP.Computer.install_date | Date | Installation date. |
| CiscoAMP.Computer.is_compromised | Boolean | Whether the computer is compromised. |
| CiscoAMP.Computer.demo | Boolean | Whether the computer is a demo. |
| CiscoAMP.Computer.network_addresses.mac | String | List of MAC addresses. |
| CiscoAMP.Computer.network_addresses.ip | String | List of IP addresses. |
| CiscoAMP.Computer.policy.guid | String | GUID of the policy. |
| CiscoAMP.Computer.policy.name | String | Name of the policy. |
| CiscoAMP.Computer.groups.guid | String | GUID of the group. |
| CiscoAMP.Computer.groups.name | String | Name of the group. |
| CiscoAMP.Computer.last_seen | Date | Last date seen. |
| CiscoAMP.Computer.faults | String | Faults. |
| CiscoAMP.Computer.isolation.available | Boolean | Whether the isolation is available. |
| CiscoAMP.Computer.isolation.status | String | Status of the isolation. |
| CiscoAMP.Computer.orbital.status | String | Status of the orbital. |
| Endpoint.Hostname | String | The hostname of the endpoint. |
| Endpoint.ID | String | The endpoint’s identifier. |
| Endpoint.IPAddress | String | The endpoint’s IP address. |
| Endpoint.OS | String | The endpoint’s operating system. |
| Endpoint.OSVersion | String | The endpoint’s operating system’s version. |
| Endpoint.Status | String | The status of the endpoint (online/offline). |
| Endpoint.MACAddress | String | The endpoint’s MAC address. |
| Endpoint.Vendor | String | The integration name of the endpoint vendor. |
Command example
!cisco-amp-computer-list limit=5
Context Example
{
"CiscoAMP": {
"Computer": [
{
"active": "CiscoAMP_Computer[0]_active",
"connector_guid": "CiscoAMP_Computer[0]_connector_guid",
"connector_version": "CiscoAMP_Computer[0]_connector_version",
"demo": "CiscoAMP_Computer[0]_demo",
"external_ip": "CiscoAMP_Computer[0]_external_ip",
"faults": [],
"group_guid": "CiscoAMP_Computer[0]_group_guid",
"groups": [
{
"guid": "CiscoAMP_Computer[0]_groups[0]_guid",
"name": "CiscoAMP_Computer[0]_groups[0]_name"
}
],
"hostname": "CiscoAMP_Computer[0]_hostname",
"install_date": "CiscoAMP_Computer[0]_install_date",
"internal_ips": [
"CiscoAMP_Computer[0]_internal_ips_0"
],
"is_compromised": "CiscoAMP_Computer[0]_is_compromised",
"isolation": {
"available": "CiscoAMP_Computer[0]_isolation_available",
"status": "CiscoAMP_Computer[0]_isolation_status"
},
"last_seen": "CiscoAMP_Computer[0]_last_seen",
"network_addresses": [
{
"ip": "CiscoAMP_Computer[0]_network_addresses[0]_ip",
"mac": "CiscoAMP_Computer[0]_network_addresses[0]_mac"
}
],
"operating_system": "CiscoAMP_Computer[0]_operating_system",
"os_version": "CiscoAMP_Computer[0]_os_version",
"policy": {
"guid": "CiscoAMP_Computer[0]_policy_guid",
"name": "CiscoAMP_Computer[0]_policy_name"
},
"windows_processor_id": "CiscoAMP_Computer[0]_windows_processor_id"
},
{
"active": "CiscoAMP_Computer[1]_active",
"connector_guid": "CiscoAMP_Computer[1]_connector_guid",
"connector_version": "CiscoAMP_Computer[1]_connector_version",
"demo": "CiscoAMP_Computer[1]_demo",
"external_ip": "CiscoAMP_Computer[1]_external_ip",
"faults": [],
"group_guid": "CiscoAMP_Computer[1]_group_guid",
"groups": [
{
"guid": "CiscoAMP_Computer[1]_groups[0]_guid",
"name": "CiscoAMP_Computer[1]_groups[0]_name"
}
],
"hostname": "CiscoAMP_Computer[1]_hostname",
"install_date": "CiscoAMP_Computer[1]_install_date",
"internal_ips": [
"CiscoAMP_Computer[1]_internal_ips_0"
],
"is_compromised": "CiscoAMP_Computer[1]_is_compromised",
"isolation": {
"available": "CiscoAMP_Computer[1]_isolation_available",
"status": "CiscoAMP_Computer[1]_isolation_status"
},
"last_seen": "CiscoAMP_Computer[1]_last_seen",
"network_addresses": [
{
"ip": "CiscoAMP_Computer[1]_network_addresses[0]_ip",
"mac": "CiscoAMP_Computer[1]_network_addresses[0]_mac"
}
],
"operating_system": "CiscoAMP_Computer[1]_operating_system",
"os_version": "CiscoAMP_Computer[1]_os_version",
"policy": {
"guid": "CiscoAMP_Computer[1]_policy_guid",
"name": "CiscoAMP_Computer[1]_policy_name"
},
"windows_processor_id": "CiscoAMP_Computer[1]_windows_processor_id"
},
{
"active": "CiscoAMP_Computer[2]_active",
"connector_guid": "CiscoAMP_Computer[2]_connector_guid",
"connector_version": "CiscoAMP_Computer[2]_connector_version",
"demo": "CiscoAMP_Computer[2]_demo",
"external_ip": "CiscoAMP_Computer[2]_external_ip",
"faults": [],
"group_guid": "CiscoAMP_Computer[2]_group_guid",
"groups": [
{
"guid": "CiscoAMP_Computer[2]_groups[0]_guid",
"name": "CiscoAMP_Computer[2]_groups[0]_name"
}
],
"hostname": "CiscoAMP_Computer[2]_hostname",
"install_date": "CiscoAMP_Computer[2]_install_date",
"internal_ips": [
"CiscoAMP_Computer[2]_internal_ips_0"
],
"is_compromised": "CiscoAMP_Computer[2]_is_compromised",
"isolation": {
"available": "CiscoAMP_Computer[2]_isolation_available",
"status": "CiscoAMP_Computer[2]_isolation_status"
},
"last_seen": "CiscoAMP_Computer[2]_last_seen",
"network_addresses": [
{
"ip": "CiscoAMP_Computer[2]_network_addresses[0]_ip",
"mac": "CiscoAMP_Computer[2]_network_addresses[0]_mac"
}
],
"operating_system": "CiscoAMP_Computer[2]_operating_system",
"os_version": "CiscoAMP_Computer[2]_os_version",
"policy": {
"guid": "CiscoAMP_Computer[2]_policy_guid",
"name": "CiscoAMP_Computer[2]_policy_name"
},
"windows_processor_id": "CiscoAMP_Computer[2]_windows_processor_id"
},
{
"active": "CiscoAMP_Computer[3]_active",
"connector_guid": "CiscoAMP_Computer[3]_connector_guid",
"connector_version": "CiscoAMP_Computer[3]_connector_version",
"demo": "CiscoAMP_Computer[3]_demo",
"external_ip": "CiscoAMP_Computer[3]_external_ip",
"faults": [],
"group_guid": "CiscoAMP_Computer[3]_group_guid",
"groups": [
{
"guid": "CiscoAMP_Computer[3]_groups[0]_guid",
"name": "CiscoAMP_Computer[3]_groups[0]_name"
}
],
"hostname": "CiscoAMP_Computer[3]_hostname",
"install_date": "CiscoAMP_Computer[3]_install_date",
"internal_ips": [
"CiscoAMP_Computer[3]_internal_ips_0"
],
"is_compromised": "CiscoAMP_Computer[3]_is_compromised",
"isolation": {
"available": "CiscoAMP_Computer[3]_isolation_available",
"status": "CiscoAMP_Computer[3]_isolation_status"
},
"last_seen": "CiscoAMP_Computer[3]_last_seen",
"network_addresses": [
{
"ip": "CiscoAMP_Computer[3]_network_addresses[0]_ip",
"mac": "CiscoAMP_Computer[3]_network_addresses[0]_mac"
}
],
"operating_system": "CiscoAMP_Computer[3]_operating_system",
"os_version": "CiscoAMP_Computer[3]_os_version",
"policy": {
"guid": "CiscoAMP_Computer[3]_policy_guid",
"name": "CiscoAMP_Computer[3]_policy_name"
},
"windows_processor_id": "CiscoAMP_Computer[3]_windows_processor_id"
},
{
"active": "CiscoAMP_Computer[4]_active",
"connector_guid": "CiscoAMP_Computer[4]_connector_guid",
"connector_version": "CiscoAMP_Computer[4]_connector_version",
"demo": "CiscoAMP_Computer[4]_demo",
"external_ip": "CiscoAMP_Computer[4]_external_ip",
"faults": [],
"group_guid": "CiscoAMP_Computer[4]_group_guid",
"groups": [
{
"guid": "CiscoAMP_Computer[4]_groups[0]_guid",
"name": "CiscoAMP_Computer[4]_groups[0]_name"
}
],
"hostname": "CiscoAMP_Computer[4]_hostname",
"install_date": "CiscoAMP_Computer[4]_install_date",
"internal_ips": [
"CiscoAMP_Computer[4]_internal_ips_0"
],
"is_compromised": "CiscoAMP_Computer[4]_is_compromised",
"isolation": {
"available": "CiscoAMP_Computer[4]_isolation_available",
"status": "CiscoAMP_Computer[4]_isolation_status"
},
"last_seen": "CiscoAMP_Computer[4]_last_seen",
"network_addresses": [
{
"ip": "CiscoAMP_Computer[4]_network_addresses[0]_ip",
"mac": "CiscoAMP_Computer[4]_network_addresses[0]_mac"
}
],
"operating_system": "CiscoAMP_Computer[4]_operating_system",
"os_version": "CiscoAMP_Computer[4]_os_version",
"policy": {
"guid": "CiscoAMP_Computer[4]_policy_guid",
"name": "CiscoAMP_Computer[4]_policy_name"
},
"windows_processor_id": "CiscoAMP_Computer[4]_windows_processor_id"
}
]
},
"Endpoint": [
{
"Hostname": "Endpoint[0]_Hostname",
"ID": "Endpoint[0]_ID",
"IPAddress": "Endpoint[0]_IPAddress",
"MACAddress": "Endpoint[0]_MACAddress",
"OS": "Endpoint[0]_OS",
"OSVersion": "Endpoint[0]_OSVersion",
"Status": "Endpoint[0]_Status",
"Vendor": "Endpoint[0]_Vendor"
},
{
"Hostname": "Endpoint[1]_Hostname",
"ID": "Endpoint[1]_ID",
"IPAddress": "Endpoint[1]_IPAddress",
"MACAddress": "Endpoint[1]_MACAddress",
"OS": "Endpoint[1]_OS",
"OSVersion": "Endpoint[1]_OSVersion",
"Status": "Endpoint[1]_Status",
"Vendor": "Endpoint[1]_Vendor"
},
{
"Hostname": "Endpoint[2]_Hostname",
"ID": "Endpoint[2]_ID",
"IPAddress": "Endpoint[2]_IPAddress",
"MACAddress": "Endpoint[2]_MACAddress",
"OS": "Endpoint[2]_OS",
"OSVersion": "Endpoint[2]_OSVersion",
"Status": "Endpoint[2]_Status",
"Vendor": "Endpoint[2]_Vendor"
},
{
"Hostname": "Endpoint[3]_Hostname",
"ID": "Endpoint[3]_ID",
"IPAddress": "Endpoint[3]_IPAddress",
"MACAddress": "Endpoint[3]_MACAddress",
"OS": "Endpoint[3]_OS",
"OSVersion": "Endpoint[3]_OSVersion",
"Status": "Endpoint[3]_Status",
"Vendor": "Endpoint[3]_Vendor"
},
{
"Hostname": "Endpoint[4]_Hostname",
"ID": "Endpoint[4]_ID",
"IPAddress": "Endpoint[4]_IPAddress",
"MACAddress": "Endpoint[4]_MACAddress",
"OS": "Endpoint[4]_OS",
"OSVersion": "Endpoint[4]_OSVersion",
"Status": "Endpoint[4]_Status",
"Vendor": "Endpoint[4]_Vendor"
}
]
}
Human Readable Output
Results
Current Item Count Index Items Per Page Total 5 0 5 32 Computer Information
Host Name Connector GUID Operating System External IP Group GUID Policy GUID Demo_AMP 22d4a486-1732-4f8b-9a6f-18f172fe7af0 Windows 10 (Build 10.0.19044.1466) IP bb5a9f90-d6fa-4fe7-99c8-e91060b49a98 91c7894d-dd69-4a21-8cf6-5ebfc57ef4df Demo_AMP_Exploit_Prevention 113c1a8e-8e66-409e-92a8-41b7d586be5d Windows 10 (Build 10.0.19044.1466) IP 6ed80412-0739-42c1-8f6d-32fb51b3f894 1a352c59-793b-44f3-b8f9-0ddd354057bc Demo_AMP_Exploit_Prevention_Audit 93f395a2-e31f-4022-b1dd-afb16e093b8d Windows 10 (Build 10.0.19044.1466) IP 5b1857e3-ba49-46cf-9bf1-0cad6b5ecd18 a599bf5b-2cb7-4a5b-90bd-d0199e2ccd67 Demo_AMP_Intel d6f49c17-9721-4c5b-a04f-32ba30be36a0 Windows 10 (Build 10.0.19043.1202) IP fedd82f8-c74f-49f4-a463-e576d3beee92 be84e169-0830-4b95-915b-1e203a82ed58 Demo_AMP_MAP_FriedEx 9a2abee8-b988-473b-9e99-a7abe6d068a5 Windows 10 (Build 10.0.19044.1466) IP 6ed80412-0739-42c1-8f6d-32fb51b3f894 1a352c59-793b-44f3-b8f9-0ddd354057bc
cisco-amp-computer-trajectory-list
Provides a list of all activities associated with a particular computer. This is analogous to the Device Trajectory on the FireAMP console.
Base Command
cisco-amp-computer-trajectory-list
Input
| Argument Name | Description | Required |
|---|---|---|
| connector_guid | The connector GUID for a specific computer. | Required |
| query_string | Freeform query string which currently accepts an: IP address, SHA-256, or URL. | Optional |
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 5000. | Optional |
| limit | Number of total results to return. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.ComputerTrajectory.connector_guid | String | GUID of the connector. |
| CiscoAMP.ComputerTrajectory.id | String | Event’s ID. |
| CiscoAMP.ComputerTrajectory.timestamp | Number | Event’s timestamp. |
| CiscoAMP.ComputerTrajectory.timestamp_nanoseconds | Number | Event’s timestamp in nano seconds. |
| CiscoAMP.ComputerTrajectory.date | Date | Event’s date. |
| CiscoAMP.ComputerTrajectory.event_type | String | Event’s type. |
| CiscoAMP.ComputerTrajectory.event_type_id | Number | Event’s type ID. |
| CiscoAMP.ComputerTrajectory.group_guids | String | Group GUID. |
| CiscoAMP.ComputerTrajectory.severity | String | Event’s severity. |
| CiscoAMP.ComputerTrajectory.detection | String | Event’s detection. |
| CiscoAMP.ComputerTrajectory.detection_id | String | Event’s detection ID. |
| CiscoAMP.ComputerTrajectory.file.disposition | String | Disposition of the file. |
| CiscoAMP.ComputerTrajectory.file.file_name | String | Name of the file. |
| CiscoAMP.ComputerTrajectory.file.file_path | String | Path to the file. |
| CiscoAMP.ComputerTrajectory.file.file_type | String | Type of the file. |
| CiscoAMP.ComputerTrajectory.file.identity.sha256 | String | File’s SHA-256. |
| CiscoAMP.ComputerTrajectory.file.identity.sha1 | String | File’s SHA-1. |
| CiscoAMP.ComputerTrajectory.file.identity.md5 | String | File’s MD5. |
| CiscoAMP.ComputerTrajectory.file.parent.disposition | String | Disposition of parent. |
| CiscoAMP.ComputerTrajectory.file.parent.identity.sha256 | String | SHA-256 of parent. |
| CiscoAMP.ComputerTrajectory.scan.description | String | Description of the scan. |
| CiscoAMP.ComputerTrajectory.scan.clean | Boolean | Whether the scan is clean. |
| CiscoAMP.ComputerTrajectory.scan.scanned_files | Number | Number of scanned files. |
| CiscoAMP.ComputerTrajectory.scan.scanned_processes | Number | Number of scanned processes. |
| CiscoAMP.ComputerTrajectory.scan.scanned_paths | Number | Number of scanned paths. |
| CiscoAMP.ComputerTrajectory.scan.malicious_detections | Number | Number of malicious detections. |
Command example
!cisco-amp-computer-trajectory-list connector_guid=22d4a486-1732-4f8b-9a6f-18f172fe7af0 limit=5
Context Example
{
"CiscoAMP": {
"ComputerTrajectory": [
{
"connector_guid": "CiscoAMP_ComputerTrajectory[0]_connector_guid",
"date": "CiscoAMP_ComputerTrajectory[0]_date",
"event_type": "CiscoAMP_ComputerTrajectory[0]_event_type",
"event_type_id": "CiscoAMP_ComputerTrajectory[0]_event_type_id",
"group_guids": [
"CiscoAMP_ComputerTrajectory[0]_group_guids_0"
],
"id": "CiscoAMP_ComputerTrajectory[0]_id",
"isolation": {
"duration": "CiscoAMP_ComputerTrajectory[0]_isolation_duration"
},
"timestamp": "CiscoAMP_ComputerTrajectory[0]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_ComputerTrajectory[0]_timestamp_nanoseconds"
},
{
"connector_guid": "CiscoAMP_ComputerTrajectory[1]_connector_guid",
"date": "CiscoAMP_ComputerTrajectory[1]_date",
"event_type": "CiscoAMP_ComputerTrajectory[1]_event_type",
"event_type_id": "CiscoAMP_ComputerTrajectory[1]_event_type_id",
"group_guids": [
"CiscoAMP_ComputerTrajectory[1]_group_guids_0"
],
"id": "CiscoAMP_ComputerTrajectory[1]_id",
"timestamp": "CiscoAMP_ComputerTrajectory[1]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_ComputerTrajectory[1]_timestamp_nanoseconds"
},
{
"connector_guid": "CiscoAMP_ComputerTrajectory[2]_connector_guid",
"date": "CiscoAMP_ComputerTrajectory[2]_date",
"event_type": "CiscoAMP_ComputerTrajectory[2]_event_type",
"event_type_id": "CiscoAMP_ComputerTrajectory[2]_event_type_id",
"group_guids": [
"CiscoAMP_ComputerTrajectory[2]_group_guids_0"
],
"id": "CiscoAMP_ComputerTrajectory[2]_id",
"isolation": {
"duration": "CiscoAMP_ComputerTrajectory[2]_isolation_duration"
},
"timestamp": "CiscoAMP_ComputerTrajectory[2]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_ComputerTrajectory[2]_timestamp_nanoseconds"
},
{
"connector_guid": "CiscoAMP_ComputerTrajectory[3]_connector_guid",
"date": "CiscoAMP_ComputerTrajectory[3]_date",
"event_type": "CiscoAMP_ComputerTrajectory[3]_event_type",
"event_type_id": "CiscoAMP_ComputerTrajectory[3]_event_type_id",
"group_guids": [
"CiscoAMP_ComputerTrajectory[3]_group_guids_0"
],
"id": "CiscoAMP_ComputerTrajectory[3]_id",
"timestamp": "CiscoAMP_ComputerTrajectory[3]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_ComputerTrajectory[3]_timestamp_nanoseconds"
},
{
"connector_guid": "CiscoAMP_ComputerTrajectory[4]_connector_guid",
"date": "CiscoAMP_ComputerTrajectory[4]_date",
"event_type": "CiscoAMP_ComputerTrajectory[4]_event_type",
"event_type_id": "CiscoAMP_ComputerTrajectory[4]_event_type_id",
"group_guids": [
"CiscoAMP_ComputerTrajectory[4]_group_guids_0"
],
"id": "CiscoAMP_ComputerTrajectory[4]_id",
"isolation": {
"duration": "CiscoAMP_ComputerTrajectory[4]_isolation_duration"
},
"timestamp": "CiscoAMP_ComputerTrajectory[4]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_ComputerTrajectory[4]_timestamp_nanoseconds"
}
]
}
}
Human Readable Output
Computer Information
Host Name Connector GUID Operating System External IP Group GUID Policy GUID Demo_AMP 22d4a486-1732-4f8b-9a6f-18f172fe7af0 Windows 10 (Build 10.0.19044.1466) IP bb5a9f90-d6fa-4fe7-99c8-e91060b49a98 91c7894d-dd69-4a21-8cf6-5ebfc57ef4df Event Information
ID Date Event Type Group GUIDs 1667217305855411965 2022-10-31T11:55:05+00:00 Endpoint Isolation Stop Success bb5a9f90-d6fa-4fe7-99c8-e91060b49a98 1667217298837175263 2022-10-31T11:54:58+00:00 Endpoint Isolation Start Success bb5a9f90-d6fa-4fe7-99c8-e91060b49a98 1667216545769121964 2022-10-31T11:42:25+00:00 Endpoint Isolation Stop Success bb5a9f90-d6fa-4fe7-99c8-e91060b49a98 1667216538974189121 2022-10-31T11:42:18+00:00 Endpoint Isolation Start Success bb5a9f90-d6fa-4fe7-99c8-e91060b49a98 1667214907330813011 2022-10-31T11:15:07+00:00 Endpoint Isolation Stop Success bb5a9f90-d6fa-4fe7-99c8-e91060b49a98
cisco-amp-computer-user-activity-list
Fetch a list of computers that have observed activity by given username.
Base Command
cisco-amp-computer-user-activity-list
Input
| Argument Name | Description | Required |
|---|---|---|
| username | Username to filter by. | Required |
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 500. | Optional |
| limit | Number of total results to return. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.ComputerUserActivity.connector_guid | String | GUID of the connector. |
| CiscoAMP.ComputerUserActivity.hostname | String | Host’s name. |
| CiscoAMP.ComputerUserActivity.active | Boolean | Whether the computer is active. |
Command example
!cisco-amp-computer-user-activity-list username=johndoe
Context Example
{
"CiscoAMP": {
"ComputerUserActivity": [
{
"active": "CiscoAMP_ComputerUserActivity[0]_active",
"connector_guid": "CiscoAMP_ComputerUserActivity[0]_connector_guid",
"hostname": "CiscoAMP_ComputerUserActivity[0]_hostname"
},
{
"active": "CiscoAMP_ComputerUserActivity[1]_active",
"connector_guid": "CiscoAMP_ComputerUserActivity[1]_connector_guid",
"hostname": "CiscoAMP_ComputerUserActivity[1]_hostname"
},
{
"active": "CiscoAMP_ComputerUserActivity[2]_active",
"connector_guid": "CiscoAMP_ComputerUserActivity[2]_connector_guid",
"hostname": "CiscoAMP_ComputerUserActivity[2]_hostname"
},
{
"active": "CiscoAMP_ComputerUserActivity[3]_active",
"connector_guid": "CiscoAMP_ComputerUserActivity[3]_connector_guid",
"hostname": "CiscoAMP_ComputerUserActivity[3]_hostname"
},
{
"active": "CiscoAMP_ComputerUserActivity[4]_active",
"connector_guid": "CiscoAMP_ComputerUserActivity[4]_connector_guid",
"hostname": "CiscoAMP_ComputerUserActivity[4]_hostname"
},
{
"active": "CiscoAMP_ComputerUserActivity[5]_active",
"connector_guid": "CiscoAMP_ComputerUserActivity[5]_connector_guid",
"hostname": "CiscoAMP_ComputerUserActivity[5]_hostname"
},
{
"active": "CiscoAMP_ComputerUserActivity[6]_active",
"connector_guid": "CiscoAMP_ComputerUserActivity[6]_connector_guid",
"hostname": "CiscoAMP_ComputerUserActivity[6]_hostname"
},
{
"active": "CiscoAMP_ComputerUserActivity[7]_active",
"connector_guid": "CiscoAMP_ComputerUserActivity[7]_connector_guid",
"hostname": "CiscoAMP_ComputerUserActivity[7]_hostname"
}
]
}
}
Human Readable Output
Results
Current Item Count Index Items Per Page Total 8 0 100 8 Activity Information
Connector GUID Host Name Active 113c1a8e-8e66-409e-92a8-41b7d586be5d Demo_AMP_Exploit_Prevention true 307ada77-5776-4de6-ab3b-9c42fe723c9c Demo_WannaCry_Ransomware true 32ac3d60-4038-4cac-8df8-7588cd959926 Demo_AMP_Threat_Audit true 7704bf95-5343-4825-8d68-2ecea81feda4 Demo_Qakbot_3 true 790e9bd4-99b5-433c-b027-9a9a5b9d426f Demo_Qakbot_2 true cd9ae0b3-b566-47f4-811b-980dcb7988d6 Demo_Qakbot_1 true d42cab73-c142-4c25-85d3-4bdefacb6b5b Demo_AMP_Threat_Quarantined true d6f49c17-9721-4c5b-a04f-32ba30be36a0 Demo_AMP_Intel true
cisco-amp-computer-user-trajectory-list
Fetch a specific computer’s trajectory with a given connector_guid and filter for events with user name activity.
Base Command
cisco-amp-computer-user-trajectory-list
Input
| Argument Name | Description | Required |
|---|---|---|
| connector_guid | The connector GUID for a specific computer. | Required |
| username | Username to filter by. | Optional |
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 5000. | Optional |
| limit | Number of total results to return. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.ComputerUserTrajectory.connector_guid | String | GUID of the connector. |
| CiscoAMP.ComputerUserTrajectory.id | String | Event’s ID. |
| CiscoAMP.ComputerUserTrajectory.timestamp | Number | Event’s timestamp. |
| CiscoAMP.ComputerUserTrajectory.timestamp_nanoseconds | Number | Event’s timestamp in nano seconds. |
| CiscoAMP.ComputerUserTrajectory.date | Date | Event’s date. |
| CiscoAMP.ComputerUserTrajectory.event_type | String | Event’s type. |
| CiscoAMP.ComputerUserTrajectory.event_type_id | Number | Event’s type ID. |
| CiscoAMP.ComputerUserTrajectory.group_guids | String | Group GUID. |
| CiscoAMP.ComputerUserTrajectory.severity | String | Event’s severity. |
| CiscoAMP.ComputerUserTrajectory.detection | String | Event’s detection. |
| CiscoAMP.ComputerUserTrajectory.detection_id | String | Event’s detection ID. |
| CiscoAMP.ComputerUserTrajectory.file.disposition | String | Disposition of the file. |
| CiscoAMP.ComputerUserTrajectory.file.file_name | String | Name of the file. |
| CiscoAMP.ComputerUserTrajectory.file.file_path | String | Path to the file. |
| CiscoAMP.ComputerUserTrajectory.file.file_type | String | Type of the file. |
| CiscoAMP.ComputerUserTrajectory.file.identity.sha256 | String | File’s SHA-256. |
| CiscoAMP.ComputerUserTrajectory.file.identity.sha1 | String | File’s SHA-1. |
| CiscoAMP.ComputerUserTrajectory.file.identity.md5 | String | File’s MD5. |
| CiscoAMP.ComputerUserTrajectory.file.parent.disposition | String | Disposition of parent. |
| CiscoAMP.ComputerUserTrajectory.file.parent.identity.sha256 | String | SHA-256 of parent. |
| CiscoAMP.ComputerUserTrajectory.scan.description | String | Description. |
| CiscoAMP.ComputerUserTrajectory.scan.clean | Boolean | Whether the scan is clean. |
| CiscoAMP.ComputerUserTrajectory.scan.scanned_files | Number | Number of scanned files. |
| CiscoAMP.ComputerUserTrajectory.scan.scanned_processes | Number | Number of scanned processes. |
| CiscoAMP.ComputerUserTrajectory.scan.scanned_paths | Number | Number of scanned paths. |
| CiscoAMP.ComputerUserTrajectory.scan.malicious_detections | Number | Number of malicious detections. |
Command example
!cisco-amp-computer-user-trajectory-list connector_guid=22d4a486-1732-4f8b-9a6f-18f172fe7af0 limit=5
Context Example
{
"CiscoAMP": {
"ComputerUserTrajectory": [
{
"connector_guid": "CiscoAMP_ComputerUserTrajectory[0]_connector_guid",
"date": "CiscoAMP_ComputerUserTrajectory[0]_date",
"event_type": "CiscoAMP_ComputerUserTrajectory[0]_event_type",
"event_type_id": "CiscoAMP_ComputerUserTrajectory[0]_event_type_id",
"group_guids": [
"CiscoAMP_ComputerUserTrajectory[0]_group_guids_0"
],
"id": "CiscoAMP_ComputerUserTrajectory[0]_id",
"isolation": {
"duration": "CiscoAMP_ComputerUserTrajectory[0]_isolation_duration"
},
"timestamp": "CiscoAMP_ComputerUserTrajectory[0]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_ComputerUserTrajectory[0]_timestamp_nanoseconds"
},
{
"connector_guid": "CiscoAMP_ComputerUserTrajectory[1]_connector_guid",
"date": "CiscoAMP_ComputerUserTrajectory[1]_date",
"event_type": "CiscoAMP_ComputerUserTrajectory[1]_event_type",
"event_type_id": "CiscoAMP_ComputerUserTrajectory[1]_event_type_id",
"group_guids": [
"CiscoAMP_ComputerUserTrajectory[1]_group_guids_0"
],
"id": "CiscoAMP_ComputerUserTrajectory[1]_id",
"timestamp": "CiscoAMP_ComputerUserTrajectory[1]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_ComputerUserTrajectory[1]_timestamp_nanoseconds"
},
{
"connector_guid": "CiscoAMP_ComputerUserTrajectory[2]_connector_guid",
"date": "CiscoAMP_ComputerUserTrajectory[2]_date",
"event_type": "CiscoAMP_ComputerUserTrajectory[2]_event_type",
"event_type_id": "CiscoAMP_ComputerUserTrajectory[2]_event_type_id",
"group_guids": [
"CiscoAMP_ComputerUserTrajectory[2]_group_guids_0"
],
"id": "CiscoAMP_ComputerUserTrajectory[2]_id",
"isolation": {
"duration": "CiscoAMP_ComputerUserTrajectory[2]_isolation_duration"
},
"timestamp": "CiscoAMP_ComputerUserTrajectory[2]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_ComputerUserTrajectory[2]_timestamp_nanoseconds"
},
{
"connector_guid": "CiscoAMP_ComputerUserTrajectory[3]_connector_guid",
"date": "CiscoAMP_ComputerUserTrajectory[3]_date",
"event_type": "CiscoAMP_ComputerUserTrajectory[3]_event_type",
"event_type_id": "CiscoAMP_ComputerUserTrajectory[3]_event_type_id",
"group_guids": [
"CiscoAMP_ComputerUserTrajectory[3]_group_guids_0"
],
"id": "CiscoAMP_ComputerUserTrajectory[3]_id",
"timestamp": "CiscoAMP_ComputerUserTrajectory[3]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_ComputerUserTrajectory[3]_timestamp_nanoseconds"
},
{
"connector_guid": "CiscoAMP_ComputerUserTrajectory[4]_connector_guid",
"date": "CiscoAMP_ComputerUserTrajectory[4]_date",
"event_type": "CiscoAMP_ComputerUserTrajectory[4]_event_type",
"event_type_id": "CiscoAMP_ComputerUserTrajectory[4]_event_type_id",
"group_guids": [
"CiscoAMP_ComputerUserTrajectory[4]_group_guids_0"
],
"id": "CiscoAMP_ComputerUserTrajectory[4]_id",
"isolation": {
"duration": "CiscoAMP_ComputerUserTrajectory[4]_isolation_duration"
},
"timestamp": "CiscoAMP_ComputerUserTrajectory[4]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_ComputerUserTrajectory[4]_timestamp_nanoseconds"
}
]
}
}
Human Readable Output
Computer Information
Host Name Connector GUID Operating System Demo_AMP 22d4a486-1732-4f8b-9a6f-18f172fe7af0 None (Build None) Event Information
ID Date Event Type Group GUIDs 1667217305855411965 2022-10-31T11:55:05+00:00 Endpoint Isolation Stop Success bb5a9f90-d6fa-4fe7-99c8-e91060b49a98 1667217298837175263 2022-10-31T11:54:58+00:00 Endpoint Isolation Start Success bb5a9f90-d6fa-4fe7-99c8-e91060b49a98 1667216545769121964 2022-10-31T11:42:25+00:00 Endpoint Isolation Stop Success bb5a9f90-d6fa-4fe7-99c8-e91060b49a98 1667216538974189121 2022-10-31T11:42:18+00:00 Endpoint Isolation Start Success bb5a9f90-d6fa-4fe7-99c8-e91060b49a98 1667214907330813011 2022-10-31T11:15:07+00:00 Endpoint Isolation Stop Success bb5a9f90-d6fa-4fe7-99c8-e91060b49a98
cisco-amp-computer-vulnerabilities-list
Provides a list of vulnerabilities observed on a specific computer. The vulnerabilities can be filtered to show only vulnerable applications observed for a specific time range.
Base Command
cisco-amp-computer-vulnerabilities-list
Input
| Argument Name | Description | Required |
|---|---|---|
| connector_guid | The connector GUID for a specific computer. | Required |
| start_time | The start date and time expressed according to ISO 8601. The retrieved list will include vulnerable programs detected at start_time. | Optional |
| end_time | The end date and/or time expressed according to ISO 8601. Exclusive - if end_time is a time, the list will only include vulnerable programs detected before end_time). Inclusive - if end_time is a date, the list will include vulnerable programs detected on the date. | Optional |
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 500. | Optional |
| limit | Number of total results to return. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.ComputerVulnerability.connector_guid | String | GUID of the connector. |
| CiscoAMP.ComputerVulnerability.application | String | Name of the application. |
| CiscoAMP.ComputerVulnerability.version | String | Version of the application. |
| CiscoAMP.ComputerVulnerability.file.filename | String | Name of the file. |
| CiscoAMP.ComputerVulnerability.file.identity.sha256 | String | File’s SHA-256. |
| CiscoAMP.ComputerVulnerability.file.identity.sha1 | String | File’s SHA-1. |
| CiscoAMP.ComputerVulnerability.file.identity.md5 | String | File’s MD5. |
| CiscoAMP.ComputerVulnerability.cves.id | String | Common vulnerability exposure ID. |
| CiscoAMP.ComputerVulnerability.cves.link | String | Common vulnerability exposure link. |
| CiscoAMP.ComputerVulnerability.cves.cvss | Number | Common vulnerability scoring system. |
| CiscoAMP.ComputerVulnerability.latest_timestamp | Number | Vulnerability latest timestamp. |
| CiscoAMP.ComputerVulnerability.latest_date | Date | Vulnerability latest date. |
Command example
!cisco-amp-computer-vulnerabilities-list connector_guid=22d4a486-1732-4f8b-9a6f-18f172fe7af0
Context Example
{
"CiscoAMP": {
"ComputerVulnerability": {
"application": "CiscoAMP_ComputerVulnerability_application",
"connector_guid": "CiscoAMP_ComputerVulnerability_connector_guid",
"cves": [
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[0]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[0]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[0]_link"
},
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[1]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[1]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[1]_link"
},
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[2]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[2]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[2]_link"
},
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[3]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[3]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[3]_link"
},
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[4]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[4]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[4]_link"
},
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[5]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[5]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[5]_link"
},
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[6]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[6]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[6]_link"
},
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[7]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[7]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[7]_link"
},
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[8]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[8]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[8]_link"
},
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[9]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[9]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[9]_link"
},
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[10]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[10]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[10]_link"
},
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[11]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[11]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[11]_link"
},
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[12]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[12]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[12]_link"
},
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[13]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[13]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[13]_link"
},
{
"cvss": "CiscoAMP_ComputerVulnerability_cves[14]_cvss",
"id": "CiscoAMP_ComputerVulnerability_cves[14]_id",
"link": "CiscoAMP_ComputerVulnerability_cves[14]_link"
}
],
"file": {
"filename": "CiscoAMP_ComputerVulnerability_file_filename",
"identity": {
"sha256": "CiscoAMP_ComputerVulnerability_file_identity_sha256"
}
},
"latest_date": "CiscoAMP_ComputerVulnerability_latest_date",
"latest_timestamp": "CiscoAMP_ComputerVulnerability_latest_timestamp",
"version": "CiscoAMP_ComputerVulnerability_version"
}
}
}
Human Readable Output
Results
Current Item Count Index Items Per Page Total 1 0 100 1 Computer Information
Host Name Connector GUID Operating System Group GUID Demo_AMP 22d4a486-1732-4f8b-9a6f-18f172fe7af0 None (Build None) bb5a9f90-d6fa-4fe7-99c8-e91060b49a98 Vulnerabilities Information
Application Version Latest Date File Name SHA-256 Microsoft Office 2013 2022-10-23T12:37:33+00:00 WINWORD.EXE 3D46E95284F93BBB76B3B7E1BF0E1B2D51E8A9411C2B6E649112F22F92DE63C2
cisco-amp-computer-move
Moves a computer to a group with a given connector_guid and group_guid.
Base Command
cisco-amp-computer-move
Input
| Argument Name | Description | Required |
|---|---|---|
| connector_guid | The connector GUID for a specific computer. | Required |
| group_guid | Group GUID to move the computer to. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.Computer.connector_guid | String | GUID of the connector. |
| CiscoAMP.Computer.hostname | String | Host’s name. |
| CiscoAMP.Computer.windows_processor_id | String | Windows processor ID. |
| CiscoAMP.Computer.active | Boolean | Whether the computer is active. |
| CiscoAMP.Computer.connector_version | String | Version of the connector. |
| CiscoAMP.Computer.operating_system | String | Operating system of the computer. |
| CiscoAMP.Computer.os_version | String | Operating system version. |
| CiscoAMP.Computer.internal_ips | String | List of internal IPs. |
| CiscoAMP.Computer.external_ip | String | External IP. |
| CiscoAMP.Computer.group_guid | String | GUID of the group. |
| CiscoAMP.Computer.install_date | Date | Installation date. |
| CiscoAMP.Computer.is_compromised | Boolean | Whether the computer is compromised. |
| CiscoAMP.Computer.demo | Boolean | Whether the computer is a demo. |
| CiscoAMP.Computer.network_addresses.mac | String | List of MAC addresses. |
| CiscoAMP.Computer.network_addresses.ip | String | List of IP addresses. |
| CiscoAMP.Computer.policy.guid | String | GUID of the policy. |
| CiscoAMP.Computer.policy.name | String | Name of the policy. |
| CiscoAMP.Computer.groups.guid | String | GUID of the group. |
| CiscoAMP.Computer.groups.name | String | Name of the group. |
| CiscoAMP.Computer.last_seen | Date | Last date seen. |
| CiscoAMP.Computer.faults | String | Faults. |
| CiscoAMP.Computer.isolation.available | Boolean | Whether the isolation is available. |
| CiscoAMP.Computer.isolation.status | String | Status of the isolation. |
| CiscoAMP.Computer.orbital.status | String | Status of the orbital. |
Command example
!cisco-amp-computer-move connector_guid=22d4a486-1732-4f8b-9a6f-18f172fe7af0 group_guid=bb5a9f90-d6fa-4fe7-99c8-e91060b49a98
Context Example
{
"CiscoAMP": {
"Computer": {
"active": "CiscoAMP_Computer_active",
"connector_guid": "CiscoAMP_Computer_connector_guid",
"connector_version": "CiscoAMP_Computer_connector_version",
"demo": "CiscoAMP_Computer_demo",
"external_ip": "CiscoAMP_Computer_external_ip",
"faults": [],
"group_guid": "CiscoAMP_Computer_group_guid",
"groups": [
{
"guid": "CiscoAMP_Computer_groups[0]_guid",
"name": "CiscoAMP_Computer_groups[0]_name"
}
],
"hostname": "CiscoAMP_Computer_hostname",
"install_date": "CiscoAMP_Computer_install_date",
"internal_ips": [
"CiscoAMP_Computer_internal_ips_0"
],
"is_compromised": "CiscoAMP_Computer_is_compromised",
"isolation": {
"available": "CiscoAMP_Computer_isolation_available",
"status": "CiscoAMP_Computer_isolation_status"
},
"network_addresses": [
{
"ip": "CiscoAMP_Computer_network_addresses[0]_ip",
"mac": "CiscoAMP_Computer_network_addresses[0]_mac"
}
],
"operating_system": "CiscoAMP_Computer_operating_system",
"os_version": "CiscoAMP_Computer_os_version",
"policy": {
"guid": "CiscoAMP_Computer_policy_guid",
"name": "CiscoAMP_Computer_policy_name"
},
"windows_processor_id": "CiscoAMP_Computer_windows_processor_id"
}
}
}
Human Readable Output
Computer Information
Host Name Connector GUID Operating System External IP Group GUID Policy GUID Demo_AMP 22d4a486-1732-4f8b-9a6f-18f172fe7af0 Windows 10 (Build 10.0.19044.1466) IP bb5a9f90-d6fa-4fe7-99c8-e91060b49a98 91c7894d-dd69-4a21-8cf6-5ebfc57ef4df
cisco-amp-computer-delete
Deletes a specific computer with given connector GUID.
Base Command
cisco-amp-computer-delete
Input
| Argument Name | Description | Required |
|---|---|---|
| connector_guid | The connector GUID for a specific computer. | Required |
Context Output
There is no context output for this command.
Command example
!cisco-amp-computer-delete connector_guid=dddd4ceb-4ce1-4f81-a7a7-04d13cc1df43
Human Readable Output
Connector GUID: “dddd4ceb-4ce1-4f81-a7a7-04d13cc1df43”
Successfully deleted.
cisco-amp-computer-activity-list
Fetch a list of computers that have observed files with a given file name. Provides the ability to search all computers across an organization for any events or activities associated with a file or network operation, and returns computers matching those criteria. There is a hard limit of 5000 historical entries searched.
Base Command
cisco-amp-computer-activity-list
Input
| Argument Name | Description | Required |
|---|---|---|
| query_string | Freeform query string which currently accepts: IPv4 address (CIDR not supported), SHA-256, file name, and a URL Fragment. | Required |
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 500. | Optional |
| limit | Number of total results to return. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.ComputerActivity.connector_guid | String | GUID of the connector. |
| CiscoAMP.ComputerActivity.hostname | String | Host’s name. |
| CiscoAMP.ComputerActivity.windows_processor_id | String | Windows processor ID. |
| CiscoAMP.ComputerActivity.active | Boolean | Whether the computer is active. |
Command example
!cisco-amp-computer-activity-list query_string=8.8.8.8
Context Example
{
"CiscoAMP": {
"ComputerActivity": [
{
"active": "CiscoAMP_ComputerActivity[0]_active",
"connector_guid": "CiscoAMP_ComputerActivity[0]_connector_guid",
"hostname": "CiscoAMP_ComputerActivity[0]_hostname",
"windows_processor_id": "CiscoAMP_ComputerActivity[0]_windows_processor_id"
},
{
"active": "CiscoAMP_ComputerActivity[1]_active",
"connector_guid": "CiscoAMP_ComputerActivity[1]_connector_guid",
"hostname": "CiscoAMP_ComputerActivity[1]_hostname",
"windows_processor_id": "CiscoAMP_ComputerActivity[1]_windows_processor_id"
},
{
"active": "CiscoAMP_ComputerActivity[2]_active",
"connector_guid": "CiscoAMP_ComputerActivity[2]_connector_guid",
"hostname": "CiscoAMP_ComputerActivity[2]_hostname",
"windows_processor_id": "CiscoAMP_ComputerActivity[2]_windows_processor_id"
},
{
"active": "CiscoAMP_ComputerActivity[3]_active",
"connector_guid": "CiscoAMP_ComputerActivity[3]_connector_guid",
"hostname": "CiscoAMP_ComputerActivity[3]_hostname",
"windows_processor_id": "CiscoAMP_ComputerActivity[3]_windows_processor_id"
},
{
"active": "CiscoAMP_ComputerActivity[4]_active",
"connector_guid": "CiscoAMP_ComputerActivity[4]_connector_guid",
"hostname": "CiscoAMP_ComputerActivity[4]_hostname",
"windows_processor_id": "CiscoAMP_ComputerActivity[4]_windows_processor_id"
}
]
}
}
Human Readable Output
Results
Current Item Count Index Items Per Page Total 5 0 100 5 Activity Information
Connector GUID Host Name Windows Processor ID Active 1e104704-0b8f-4703-a49f-ec3d13e1e079 Demo_Dyre 346b8f2ad9e5107 true 22b1d33c-b875-445f-8a98-d7fd05616ff0 Demo_Upatre b2a9e0f43861d75 true 33c101dd-4f50-4fd3-bce5-d3bd9d94e1a2 Demo_ZAccess b047d5268e9a13f true 4d91c4ea-4f4d-4b87-b5d7-d34cc2c678a5 Demo_Global_Threat_Alerts 9af0463d1852be7 true ab22d66b-3443-4653-99ec-1fdeb680f30b Demo_TDSS 0ad79f21856e34b true
cisco-amp-computer-isolation-feature-availability-get
Performs a feature availability request on a computer. Isolation must be enabled within the computer’s policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation.
Base Command
cisco-amp-computer-isolation-feature-availability-get
Input
| Argument Name | Description | Required |
|---|---|---|
| connector_guid | The connector GUID for a specific computer. | Required |
Context Output
There is no context output for this command.
Command example
!cisco-amp-computer-isolation-feature-availability-get connector_guid=22d4a486-1732-4f8b-9a6f-18f172fe7af0
Human Readable Output
Can get information about an isolation with computer-isolation-get
Can request to create a new isolation with computer-isolation-create
cisco-amp-computer-isolation-get
Returns a fine-grained isolation status for a computer. The available flag is set to true if isolation can be performed on the computer. Status will be set to one of - not_isolated, pending_start, isolated and pending_stop. Isolation must be enabled within the computer’s policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation.
Base Command
cisco-amp-computer-isolation-get
Input
| Argument Name | Description | Required |
|---|---|---|
| connector_guid | The connector GUID for a specific computer. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.ComputerIsolation.connector_guid | String | ID of the connector. |
| CiscoAMP.ComputerIsolation.available | Boolean | Set to true if isolation can be performed on the computer. |
| CiscoAMP.ComputerIsolation.status | String | Will be set to one of: not_isolated, pending_start, isolated and pending_stop. |
| CiscoAMP.ComputerIsolation.unlock_code | String | Isolation unlock code. |
| CiscoAMP.ComputerIsolation.comment | String | Isolation comment. |
| CiscoAMP.ComputerIsolation.ccms_message_guid | String | Cisco Cluster Management Suite message GUID. |
| CiscoAMP.ComputerIsolation.ccms_job_guid | String | Cisco Cluster Management Suite job GUID. |
Command example
!cisco-amp-computer-isolation-get connector_guid=22d4a486-1732-4f8b-9a6f-18f172fe7af0
Context Example
{
"CiscoAMP": {
"ComputerIsolation": {
"available": "CiscoAMP_ComputerIsolation_available",
"comment": "CiscoAMP_ComputerIsolation_comment",
"connector_guid": "CiscoAMP_ComputerIsolation_connector_guid",
"status": "CiscoAMP_ComputerIsolation_status",
"unlock_code": "CiscoAMP_ComputerIsolation_unlock_code"
}
}
}
Human Readable Output
Isolation Information
Available Status Unlock Code Comment true not_isolated unlockme End readme test
cisco-amp-computer-isolation-create
Request isolation for a computer. Supports polling. Isolation must be enabled within the computer’s policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation.
Base Command
cisco-amp-computer-isolation-create
Input
| Argument Name | Description | Required |
|---|---|---|
| interval_in_seconds | The interval in seconds between each poll. Default is 30. | Optional |
| timeout_in_seconds | The timeout in seconds until polling ends. Default is 600. | Optional |
| connector_guid | The connector GUID for a specific computer. | Required |
| comment | Comment for isolation. | Required |
| unlock_code | Isolation unlock code. | Required |
| status | Status of the current run. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.ComputerIsolation.connector_guid | String | ID of the connector. |
| CiscoAMP.ComputerIsolation.available | Boolean | Set to true if isolation can be performed on the computer. |
| CiscoAMP.ComputerIsolation.status | String | Will be set to one of: not_isolated, pending_start, isolated and pending_stop. |
| CiscoAMP.ComputerIsolation.unlock_code | String | Isolation unlock code. |
| CiscoAMP.ComputerIsolation.comment | String | Isolation comment. |
| CiscoAMP.ComputerIsolation.isolated_by | String | Isolation initiator. |
Command example
!cisco-amp-computer-isolation-create connector_guid=22d4a486-1732-4f8b-9a6f-18f172fe7af0 comment="readme generate test" unlock_code=unlockme interval_in_seconds=5 timeout_in_seconds=20
Context Example
{
"CiscoAMP": {
"ComputerIsolation": {
"available": "CiscoAMP_ComputerIsolation_available",
"comment": "CiscoAMP_ComputerIsolation_comment",
"connector_guid": "CiscoAMP_ComputerIsolation_connector_guid",
"isolated_by": "CiscoAMP_ComputerIsolation_isolated_by",
"status": "CiscoAMP_ComputerIsolation_status",
"unlock_code": "CiscoAMP_ComputerIsolation_unlock_code"
}
}
}
Human Readable Output
Isolation Information
Available Status Unlock Code Comment Isolated By true isolated unlockme readme generate test Lior Sabri
cisco-amp-computer-isolation-delete
Request isolation stop for a computer. Supports polling. Isolation must be enabled within the computer’s policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation.
Base Command
cisco-amp-computer-isolation-delete
Input
| Argument Name | Description | Required |
|---|---|---|
| interval_in_seconds | The interval in seconds between each poll. Default is 30. | Optional |
| timeout_in_seconds | The timeout in seconds until polling ends. Default is 600. | Optional |
| connector_guid | The connector GUID for a specific computer. | Required |
| comment | Comment for isolation deletion. | Optional |
| status | Status of the current run. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.ComputerIsolation.available | Boolean | Set to true if isolation can be performed on the computer. |
| CiscoAMP.ComputerIsolation.status | String | Will be set to one of: not_isolated, pending_start, isolated and pending_stop. |
| CiscoAMP.ComputerIsolation.unlock_code | String | Isolation unlock code. |
| CiscoAMP.ComputerIsolation.comment | String | Isolation comment. |
| CiscoAMP.ComputerIsolation.isolated_by | String | Isolation initiator. |
Command example
!cisco-amp-computer-isolation-delete connector_guid=22d4a486-1732-4f8b-9a6f-18f172fe7af0 comment="End readme test" interval_in_seconds=5 timeout_in_seconds=20
Human Readable Output
Fetching Results:
cisco-amp-event-list
Fetch a list of events that can be filtered by a variety of criteria. Each criteria type is logically ANDed with the other criteria, each selection of a criteria is logically ORed. This is analogous to the Events view on the FireAMP Console.
Base Command
cisco-amp-event-list
Input
| Argument Name | Description | Required |
|---|---|---|
| detection_sha256 | Detection SHA-256 to filter by. | Optional |
| application_sha256 | Application SHA-256 to filter by. | Optional |
| connector_guid | Comma-separated list for connector GUIDs to filter by. | Optional |
| group_guid | Comma-separated list for group GUIDs to filter by. | Optional |
| start_date | Fetch events that are newer than the given time. | Optional |
| event_type | Comma-separated list for event types to filter by. | Optional |
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 500. | Optional |
| limit | Number of total results to return. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.Event.id | Number | Event’s ID. |
| CiscoAMP.Event.timestamp | Number | Event’s timestamp. |
| CiscoAMP.Event.timestamp_nanoseconds | Number | Event’s timestamp in nano seconds. |
| CiscoAMP.Event.date | Date | Event’s date. |
| CiscoAMP.Event.event_type | String | Event’s type. |
| CiscoAMP.Event.event_type_id | Number | Event’s type ID. |
| CiscoAMP.Event.detection | String | Event’s detection. |
| CiscoAMP.Event.detection_id | String | Event’s detection ID. |
| CiscoAMP.Event.connector_guid | String | GUID of the connector. |
| CiscoAMP.Event.group_guids | String | Event’s group GUID. |
| CiscoAMP.Event.severity | String | Event’s severity. |
| CiscoAMP.Event.computer.connector_guid | String | GUID of the connector. |
| CiscoAMP.Event.computer.hostname | String | Host’s name. |
| CiscoAMP.Event.computer.external_ip | String | External IP. |
| CiscoAMP.Event.computer.active | Boolean | Whether the computer is active. |
| CiscoAMP.Event.computer.user | String | Computer user. |
| CiscoAMP.Event.computer.network_addresses.ip | String | List of IP addresses. |
| CiscoAMP.Event.computer.network_addresses.mac | String | List of MAC addresses. |
| CiscoAMP.Event.file.disposition | String | Disposition of the file. |
| CiscoAMP.Event.file.file_name | String | Name of the file. |
| CiscoAMP.Event.file.file_path | String | Path to the file. |
| CiscoAMP.Event.file.identity.sha256 | String | File’s SHA-256. |
| CiscoAMP.Event.file.identity.sha1 | String | File’s SHA-1. |
| CiscoAMP.Event.file.identity.md5 | String | File’s MD5 |
| CiscoAMP.Event.file.parent.process_id | Number | Parent’s process ID. |
| CiscoAMP.Event.file.parent.file_name | String | Parent’s file name. |
| CiscoAMP.Event.file.parent.disposition | String | Parent’s disposition. |
| CiscoAMP.Event.file.parent.identity.sha256 | String | Parent’s SHA-256. |
| CiscoAMP.Event.file.parent.identity.sha1 | String | Parent’s SHA-1. |
| CiscoAMP.Event.file.parent.identity.md5 | String | Parent’s MD5. |
| CiscoAMP.Event.scan.description | String | Description of the scan. |
| CiscoAMP.Event.scan.clean | Boolean | Whether the scam is clean. |
| CiscoAMP.Event.scan.scanned_files | Number | Number of scanned files. |
| CiscoAMP.Event.scan.scanned_processes | Number | Number of scanned processes. |
| CiscoAMP.Event.scan.scanned_paths | Number | Number of scanned paths. |
| CiscoAMP.Event.scan.malicious_detections | Number | Number of malicious detections. |
| File.MD5 | String | The MD5 hash of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.Name | String | The full file name (including file extension). |
| File.Path | String | The path where the file is located. |
| File.Hostname | String | The name of the host where the file was found. |
| File.Malicious.Vendor | String | The vendor that reported the file as malicious. |
| File.Malicious.Description | String | A description of why the file was determined to be malicious. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Reliability | String | Reliability of the source providing the intelligence data. |
| DBotScore.Score | Number | The actual score. |
Command example
!cisco-amp-event-list limit=5
Context Example
{
"CiscoAMP": {
"Event": [
{
"computer": {
"active": "CiscoAMP_Event[0]_computer_active",
"connector_guid": "CiscoAMP_Event[0]_computer_connector_guid",
"external_ip": "CiscoAMP_Event[0]_computer_external_ip",
"hostname": "CiscoAMP_Event[0]_computer_hostname",
"network_addresses": [
{
"ip": "CiscoAMP_Event[0]_computer_network_addresses[0]_ip",
"mac": "CiscoAMP_Event[0]_computer_network_addresses[0]_mac"
}
]
},
"connector_guid": "CiscoAMP_Event[0]_connector_guid",
"date": "CiscoAMP_Event[0]_date",
"event_type": "CiscoAMP_Event[0]_event_type",
"event_type_id": "CiscoAMP_Event[0]_event_type_id",
"group_guids": [
"CiscoAMP_Event[0]_group_guids_0"
],
"id": "CiscoAMP_Event[0]_id",
"isolation": {
"duration": "CiscoAMP_Event[0]_isolation_duration"
},
"timestamp": "CiscoAMP_Event[0]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_Event[0]_timestamp_nanoseconds"
},
{
"computer": {
"active": "CiscoAMP_Event[1]_computer_active",
"connector_guid": "CiscoAMP_Event[1]_computer_connector_guid",
"external_ip": "CiscoAMP_Event[1]_computer_external_ip",
"hostname": "CiscoAMP_Event[1]_computer_hostname",
"network_addresses": [
{
"ip": "CiscoAMP_Event[1]_computer_network_addresses[0]_ip",
"mac": "CiscoAMP_Event[1]_computer_network_addresses[0]_mac"
}
]
},
"connector_guid": "CiscoAMP_Event[1]_connector_guid",
"date": "CiscoAMP_Event[1]_date",
"event_type": "CiscoAMP_Event[1]_event_type",
"event_type_id": "CiscoAMP_Event[1]_event_type_id",
"group_guids": [
"CiscoAMP_Event[1]_group_guids_0"
],
"id": "CiscoAMP_Event[1]_id",
"timestamp": "CiscoAMP_Event[1]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_Event[1]_timestamp_nanoseconds"
},
{
"computer": {
"active": "CiscoAMP_Event[2]_computer_active",
"connector_guid": "CiscoAMP_Event[2]_computer_connector_guid",
"external_ip": "CiscoAMP_Event[2]_computer_external_ip",
"hostname": "CiscoAMP_Event[2]_computer_hostname",
"network_addresses": [
{
"ip": "CiscoAMP_Event[2]_computer_network_addresses[0]_ip",
"mac": "CiscoAMP_Event[2]_computer_network_addresses[0]_mac"
}
]
},
"connector_guid": "CiscoAMP_Event[2]_connector_guid",
"date": "CiscoAMP_Event[2]_date",
"event_type": "CiscoAMP_Event[2]_event_type",
"event_type_id": "CiscoAMP_Event[2]_event_type_id",
"group_guids": [
"CiscoAMP_Event[2]_group_guids_0"
],
"id": "CiscoAMP_Event[2]_id",
"isolation": {
"duration": "CiscoAMP_Event[2]_isolation_duration"
},
"timestamp": "CiscoAMP_Event[2]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_Event[2]_timestamp_nanoseconds"
},
{
"computer": {
"active": "CiscoAMP_Event[3]_computer_active",
"connector_guid": "CiscoAMP_Event[3]_computer_connector_guid",
"external_ip": "CiscoAMP_Event[3]_computer_external_ip",
"hostname": "CiscoAMP_Event[3]_computer_hostname",
"network_addresses": [
{
"ip": "CiscoAMP_Event[3]_computer_network_addresses[0]_ip",
"mac": "CiscoAMP_Event[3]_computer_network_addresses[0]_mac"
}
]
},
"connector_guid": "CiscoAMP_Event[3]_connector_guid",
"date": "CiscoAMP_Event[3]_date",
"event_type": "CiscoAMP_Event[3]_event_type",
"event_type_id": "CiscoAMP_Event[3]_event_type_id",
"group_guids": [
"CiscoAMP_Event[3]_group_guids_0"
],
"id": "CiscoAMP_Event[3]_id",
"timestamp": "CiscoAMP_Event[3]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_Event[3]_timestamp_nanoseconds"
},
{
"computer": {
"active": "CiscoAMP_Event[4]_computer_active",
"connector_guid": "CiscoAMP_Event[4]_computer_connector_guid",
"external_ip": "CiscoAMP_Event[4]_computer_external_ip",
"hostname": "CiscoAMP_Event[4]_computer_hostname",
"network_addresses": [
{
"ip": "CiscoAMP_Event[4]_computer_network_addresses[0]_ip",
"mac": "CiscoAMP_Event[4]_computer_network_addresses[0]_mac"
}
]
},
"connector_guid": "CiscoAMP_Event[4]_connector_guid",
"date": "CiscoAMP_Event[4]_date",
"event_type": "CiscoAMP_Event[4]_event_type",
"event_type_id": "CiscoAMP_Event[4]_event_type_id",
"group_guids": [
"CiscoAMP_Event[4]_group_guids_0"
],
"id": "CiscoAMP_Event[4]_id",
"isolation": {
"duration": "CiscoAMP_Event[4]_isolation_duration"
},
"timestamp": "CiscoAMP_Event[4]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_Event[4]_timestamp_nanoseconds"
}
]
}
}
Human Readable Output
Results
Current Item Count Index Items Per Page Total 5 0 5 1228 Event Information
ID Date Event Type Connector GUID 1667218513509436397 2022-10-31T12:15:13+00:00 Endpoint Isolation Stop Success 22d4a486-1732-4f8b-9a6f-18f172fe7af0 1667218506680244597 2022-10-31T12:15:06+00:00 Endpoint Isolation Start Success 22d4a486-1732-4f8b-9a6f-18f172fe7af0 1667217305855411965 2022-10-31T11:55:05+00:00 Endpoint Isolation Stop Success 22d4a486-1732-4f8b-9a6f-18f172fe7af0 1667217298837175263 2022-10-31T11:54:58+00:00 Endpoint Isolation Start Success 22d4a486-1732-4f8b-9a6f-18f172fe7af0 1667216545769121964 2022-10-31T11:42:25+00:00 Endpoint Isolation Stop Success 22d4a486-1732-4f8b-9a6f-18f172fe7af0
cisco-amp-event-type-list
Fetches a list of event types. Events are identified and filtered by a unique ID.
Base Command
cisco-amp-event-type-list
Input
| Argument Name | Description | Required |
|---|---|---|
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 500. | Optional |
| limit | Number of total results to return. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.EventType.id | Number | Event type ID. |
| CiscoAMP.EventType.name | String | Event type name. |
| CiscoAMP.EventType.description | String | Event type description. |
Command example
!cisco-amp-event-type-list limit=5
Context Example
{
"CiscoAMP": {
"EventType": [
{
"description": "CiscoAMP_EventType[0]_description",
"id": "CiscoAMP_EventType[0]_id",
"name": "CiscoAMP_EventType[0]_name"
},
{
"description": "CiscoAMP_EventType[1]_description",
"id": "CiscoAMP_EventType[1]_id",
"name": "CiscoAMP_EventType[1]_name"
},
{
"description": "CiscoAMP_EventType[2]_description",
"id": "CiscoAMP_EventType[2]_id",
"name": "CiscoAMP_EventType[2]_name"
},
{
"description": "CiscoAMP_EventType[3]_description",
"id": "CiscoAMP_EventType[3]_id",
"name": "CiscoAMP_EventType[3]_name"
},
{
"description": "CiscoAMP_EventType[4]_description",
"id": "CiscoAMP_EventType[4]_id",
"name": "CiscoAMP_EventType[4]_name"
}
]
}
}
Human Readable Output
Results
Total 106 Event Type Information
ID Name Description 50331649 Initial Agent Registration A new agent has registered with the system. 553648130 Policy Update An agent has been told to fetch policy. 554696714 Scan Started An agent has started scanning. 554696715 Scan Completed, No Detections A scan has completed without detecting anything malicious. 1091567628 Scan Completed With Detections A scan has completed and detected malicious items.
cisco-amp-file-list-list
Returns a particular file list for application blocking or simple custom detection. file_list_guid must be provided to retrieve information about a particular file_list. Can fetch an application_blocking or simple_custom_detection file list. Defaults to application_blocking.
Base Command
cisco-amp-file-list-list
Input
| Argument Name | Description | Required |
|---|---|---|
| file_list_type | Fetch a list type to return. Possible values are: Application Blocking, Simple Custom Detection. Default is Application Blocking. | Optional |
| name | Comma-separated list for name to filter by (has auto complete capabilities). | Optional |
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 500. | Optional |
| limit | Number of total results to return. | Optional |
| file_list_guid | GUID of the file list to return. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.FileList.name | String | Name of blocking. |
| CiscoAMP.FileList.guid | String | File list GUID. |
| CiscoAMP.FileList.type | String | Type of blocking. |
Command example
#### Context Example
```json
{
"CiscoAMP": {
"FileList": {
"guid": "CiscoAMP_FileList_guid",
"name": "CiscoAMP_FileList_name",
"type": "CiscoAMP_FileList_type"
}
}
}
Human Readable Output
Results
Current Item Count Index Items Per Page Total 1 0 100 1 File List Information
GUID Name Type 1bb5a8e3-fb59-4b3d-a106-d90b2a02ac12 Blocked Application List application_blocking
cisco-amp-file-list-item-list
Returns a list of items for a particular file_list. file_list_guid must be provided to retrieve these items. A particular item can be returned by providing a SHA-256.
Base Command
cisco-amp-file-list-item-list
Input
| Argument Name | Description | Required |
|---|---|---|
| file_list_guid | File list to return. | Required |
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 500. | Optional |
| limit | Number of total results to return. | Optional |
| sha256 | File list item SHA-256 to search. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.FileListItem.name | String | Name of file list. |
| CiscoAMP.FileListItem.guid | String | File list GUID. |
| CiscoAMP.FileListItem.policies.name | String | Name of the policy. |
| CiscoAMP.FileListItem.policies.guid | String | Policy GUID. |
| CiscoAMP.FileListItem.items.sha256 | String | Item SHA-256. |
| CiscoAMP.FileListItem.items.source | String | Item source. |
Command example
!cisco-amp-file-list-item-list file_list_guid=1bb5a8e3-fb59-4b3d-a106-d90b2a02ac12
Context Example
{
"CiscoAMP": {
"FileListItem": {
"guid": "CiscoAMP_FileListItem_guid",
"items": [],
"name": "CiscoAMP_FileListItem_name",
"policies": [
{
"guid": "CiscoAMP_FileListItem_policies[0]_guid",
"name": "CiscoAMP_FileListItem_policies[0]_name"
},
{
"guid": "CiscoAMP_FileListItem_policies[1]_guid",
"name": "CiscoAMP_FileListItem_policies[1]_name"
},
{
"guid": "CiscoAMP_FileListItem_policies[2]_guid",
"name": "CiscoAMP_FileListItem_policies[2]_name"
},
{
"guid": "CiscoAMP_FileListItem_policies[3]_guid",
"name": "CiscoAMP_FileListItem_policies[3]_name"
},
{
"guid": "CiscoAMP_FileListItem_policies[4]_guid",
"name": "CiscoAMP_FileListItem_policies[4]_name"
},
{
"guid": "CiscoAMP_FileListItem_policies[5]_guid",
"name": "CiscoAMP_FileListItem_policies[5]_name"
},
{
"guid": "CiscoAMP_FileListItem_policies[6]_guid",
"name": "CiscoAMP_FileListItem_policies[6]_name"
},
{
"guid": "CiscoAMP_FileListItem_policies[7]_guid",
"name": "CiscoAMP_FileListItem_policies[7]_name"
},
{
"guid": "CiscoAMP_FileListItem_policies[8]_guid",
"name": "CiscoAMP_FileListItem_policies[8]_name"
},
{
"guid": "CiscoAMP_FileListItem_policies[9]_guid",
"name": "CiscoAMP_FileListItem_policies[9]_name"
}
]
}
}
}
Human Readable Output
Results
Current Item Count Index Items Per Page Total 0 0 100 0 File List Item Information
No entries.
Related Policy Information
Name Guid Audit be84e169-0830-4b95-915b-1e203a82ed58 Protect a599bf5b-2cb7-4a5b-90bd-d0199e2ccd67 Triage 1a352c59-793b-44f3-b8f9-0ddd354057bc Server dd1da971-926c-42ab-9e5a-154f2695d995 Domain Controller fa0c377e-8f0a-40ab-885a-afc8c08d3732 Audit 9f2fa537-df5d-4c6c-abf3-edc25a893a7a Protect 30fba653-eb4e-4c3d-b1bb-1cef9f0e31e4 Triage cfcf4841-bf00-4030-8ac3-4a607ecf245e Audit b4e266c8-ebd1-4e94-80b6-b04a966cb0d5 Protect 653508ed-28d4-465a-80c4-7ed9c0232b55
cisco-amp-file-list-item-create
Creates a file list item with a given SHA-256 for a specific file list with a given file_list_guid.
Base Command
cisco-amp-file-list-item-create
Input
| Argument Name | Description | Required |
|---|---|---|
| file_list_guid | File list to add to. | Required |
| sha256 | File list item’s SHA-256 to add. | Required |
| description | Description for the created item. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.FileListItem.sha256 | String | Item SHA-256. |
| CiscoAMP.FileListItem.description | String | File’s description. |
| CiscoAMP.FileListItem.source | String | Item source. |
Command example
!cisco-amp-file-list-item-create file_list_guid=1bb5a8e3-fb59-4b3d-a106-d90b2a02ac12 sha256=ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
Context Example
{
"CiscoAMP": {
"FileListItem": {
"sha256": "CiscoAMP_FileListItem_sha256",
"source": "CiscoAMP_FileListItem_source"
}
}
}
Human Readable Output
File List Item Information
SHA-256 Source ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad Created by entering SHA-256 via Public api.
cisco-amp-file-list-item-delete
Deletes a file list item with a given SHA-256 and associated to a file list with a given file_list_guid.
Base Command
cisco-amp-file-list-item-delete
Input
| Argument Name | Description | Required |
|---|---|---|
| file_list_guid | File list to delete from. | Required |
| sha256 | File list item SHA-256 to delete. | Required |
Context Output
There is no context output for this command.
Command example
!cisco-amp-file-list-item-delete file_list_guid=1bb5a8e3-fb59-4b3d-a106-d90b2a02ac12 sha256=ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
Human Readable Output
SHA-256: “ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad” Successfully deleted from File List GUID: “1bb5a8e3-fb59-4b3d-a106-d90b2a02ac12”.
cisco-amp-group-list
Provides information about groups in an organization.
Base Command
cisco-amp-group-list
Input
| Argument Name | Description | Required |
|---|---|---|
| name | Name to filter by (has auto complete capabilities). | Optional |
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 500. | Optional |
| limit | Number of total results to return. | Optional |
| group_guid | Group’s GUID. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.Group.name | String | Name of the group. |
| CiscoAMP.Group.description | String | Group’s description. |
| CiscoAMP.Group.guid | String | Group GUID. |
| CiscoAMP.Group.source | String | Creation source. |
| CiscoAMP.Group.creator | String | Creator of the group. |
| CiscoAMP.Group.created_at | Date | Date of creation. |
| CiscoAMP.Group.computers_count | Number | Number of computers in the group. |
| CiscoAMP.Group.descendant_computers_count | Number | Number of computers from descendant groups. |
| CiscoAMP.Group.ancestry.name | String | Parent group name. |
| CiscoAMP.Group.ancestry.guid | String | Parent group GUID. |
| CiscoAMP.Group.child_groups.name | String | Child group name. |
| CiscoAMP.Group.child_groups.guid | String | Child group GUID. |
| CiscoAMP.Group.policies.name | String | Policy name. |
| CiscoAMP.Group.policies.description | String | Policy description. |
| CiscoAMP.Group.policies.guid | String | Policy GUID. |
| CiscoAMP.Group.policies.product | String | Policy operating system product. |
| CiscoAMP.Group.policies.default | Boolean | Whether the policy is the default policy. |
| CiscoAMP.Group.policies.serial_number | Number | Policy serial number. |
| CiscoAMP.Group.policies.inherited | Boolean | Whether the policy is inherited. |
| CiscoAMP.Group.policies.file_lists.name | String | File list name. |
| CiscoAMP.Group.policies.file_lists.guid | String | File list GUID. |
| CiscoAMP.Group.policies.file_lists.type | String | File list type. |
| CiscoAMP.Group.policies.ip_lists.name | String | IP list name. |
| CiscoAMP.Group.policies.ip_lists.guid | String | IP list GUID. |
| CiscoAMP.Group.policies.ip_lists.type | String | IP list type. |
| CiscoAMP.Group.policies.exclusion_sets.name | String | Exclusion set name. |
| CiscoAMP.Group.policies.exclusion_sets.guid | String | Exclusion set GUID. |
| CiscoAMP.Group.policies.used_in_groups.name | String | Name of the group it is used in. |
| CiscoAMP.Group.policies.used_in_groups.description | String | Description of the group it is used in. |
| CiscoAMP.Group.policies.used_in_groups.guid | String | GUID of the group it is used in. |
| CiscoAMP.Group.policies.used_in_groups.source | String | Creation source of the group it is used in. |
Command example
#### Context Example
```json
{
"CiscoAMP": {
"Group": [
{
"description": "CiscoAMP_Group[0]_description",
"guid": "CiscoAMP_Group[0]_guid",
"name": "CiscoAMP_Group[0]_name",
"source": "CiscoAMP_Group[0]_source"
},
{
"description": "CiscoAMP_Group[1]_description",
"guid": "CiscoAMP_Group[1]_guid",
"name": "CiscoAMP_Group[1]_name",
"source": "CiscoAMP_Group[1]_source"
},
{
"description": "CiscoAMP_Group[2]_description",
"guid": "CiscoAMP_Group[2]_guid",
"name": "CiscoAMP_Group[2]_name",
"source": "CiscoAMP_Group[2]_source"
},
{
"description": "CiscoAMP_Group[3]_description",
"guid": "CiscoAMP_Group[3]_guid",
"name": "CiscoAMP_Group[3]_name",
"source": "CiscoAMP_Group[3]_source"
},
{
"ancestry": [
{
"guid": "CiscoAMP_Group[4]_ancestry[0]_guid",
"name": "CiscoAMP_Group[4]_ancestry[0]_name"
}
],
"description": "CiscoAMP_Group[4]_description",
"guid": "CiscoAMP_Group[4]_guid",
"name": "CiscoAMP_Group[4]_name",
"source": "CiscoAMP_Group[4]_source"
},
{
"description": "CiscoAMP_Group[5]_description",
"guid": "CiscoAMP_Group[5]_guid",
"name": "CiscoAMP_Group[5]_name",
"source": "CiscoAMP_Group[5]_source"
},
{
"description": "CiscoAMP_Group[6]_description",
"guid": "CiscoAMP_Group[6]_guid",
"name": "CiscoAMP_Group[6]_name",
"source": "CiscoAMP_Group[6]_source"
},
{
"description": "CiscoAMP_Group[7]_description",
"guid": "CiscoAMP_Group[7]_guid",
"name": "CiscoAMP_Group[7]_name",
"source": "CiscoAMP_Group[7]_source"
},
{
"description": "CiscoAMP_Group[8]_description",
"guid": "CiscoAMP_Group[8]_guid",
"name": "CiscoAMP_Group[8]_name",
"source": "CiscoAMP_Group[8]_source"
}
]
}
}
Human Readable Output
Results
Current Item Count Index Items Per Page Total 9 0 100 9 Group Information
Name Description GUID Source Audit Audit Group for QMASTERS SECURITY SERVICES LTD fedd82f8-c74f-49f4-a463-e576d3beee92 Domain Controller Domain Controller Group for QMASTERS SECURITY SERVICES LTD 92615a6b-631f-4436-b2da-47e94b349737 group todelete playbook delete e66a0f8a-47f6-4da5-bf95-2834f668d71b Created via API Lior-Group Test group bb5a9f90-d6fa-4fe7-99c8-e91060b49a98 Lior-Group-child Test child group 8b5245b5-993b-4ba9-9fe0-fb0454e815e5 Protect Protect Group for QMASTERS SECURITY SERVICES LTD 5b1857e3-ba49-46cf-9bf1-0cad6b5ecd18 readme group to delete readme test group to be deleted d088adeb-7cb4-48e4-807b-edcb828f4d29 Created via API Server Server Group for QMASTERS SECURITY SERVICES LTD 9b54e512-b5ac-4865-ba1f-8cf2fbfbe052 Triage Triage Group for QMASTERS SECURITY SERVICES LTD 6ed80412-0739-42c1-8f6d-32fb51b3f894
cisco-amp-group-policy-update
Updates a group to a given policy and returns all the policies in that group.
Base Command
cisco-amp-group-policy-update
Input
| Argument Name | Description | Required |
|---|---|---|
| group_guid | Group’s GUID. | Required |
| windows_policy_guid | Policy GUID for Windows. | Optional |
| mac_policy_guid | Policy GUID for MAC. | Optional |
| android_policy_guid | Policy GUID for Android. | Optional |
| linux_policy_guid | Policy GUID for Linux. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.Group.name | String | Name of the group. |
| CiscoAMP.Group.description | String | Group’s description. |
| CiscoAMP.Group.guid | String | Group GUID. |
| CiscoAMP.Group.source | String | Creation source. |
| CiscoAMP.Group.creator | String | Creator of the group. |
| CiscoAMP.Group.created_at | Date | Date of creation. |
| CiscoAMP.Group.computers_count | Number | Number of computers in the group. |
| CiscoAMP.Group.descendant_computers_count | Number | Number of computers from descendant groups. |
| CiscoAMP.Group.ancestry.name | String | Parent group name. |
| CiscoAMP.Group.ancestry.guid | String | Parent group GUID. |
| CiscoAMP.Group.child_groups.name | String | Child group name. |
| CiscoAMP.Group.child_groups.guid | String | Child group GUID. |
| CiscoAMP.Group.policies.name | String | Policy name. |
| CiscoAMP.Group.policies.description | String | Policy description. |
| CiscoAMP.Group.policies.guid | String | Policy GUID. |
| CiscoAMP.Group.policies.product | String | Policy operating system product. |
| CiscoAMP.Group.policies.default | Boolean | Whether the policy is the default policy. |
| CiscoAMP.Group.policies.serial_number | Number | Policy serial number. |
| CiscoAMP.Group.policies.inherited | Boolean | Whether the policy is inherited. |
| CiscoAMP.Group.policies.file_lists.name | String | File list name. |
| CiscoAMP.Group.policies.file_lists.guid | String | File list GUID. |
| CiscoAMP.Group.policies.file_lists.type | String | File list type. |
| CiscoAMP.Group.policies.ip_lists.name | String | IP list name. |
| CiscoAMP.Group.policies.ip_lists.guid | String | IP list GUID. |
| CiscoAMP.Group.policies.ip_lists.type | String | IP list type. |
| CiscoAMP.Group.policies.exclusion_sets.name | String | Exclusion set name. |
| CiscoAMP.Group.policies.exclusion_sets.guid | String | Exclusion set GUID. |
| CiscoAMP.Group.policies.used_in_groups.name | String | Name of the group the policy is used in. |
| CiscoAMP.Group.policies.used_in_groups.description | String | Description of the group the policy is used in. |
| CiscoAMP.Group.policies.used_in_groups.guid | String | GUID of the group the policy is used in. |
| CiscoAMP.Group.policies.used_in_groups.source | String | Creation source of the group the policy is used in. |
Command example
!cisco-amp-group-policy-update group_guid=bb5a9f90-d6fa-4fe7-99c8-e91060b49a98 windows_policy_guid=91c7894d-dd69-4a21-8cf6-5ebfc57ef4df
Context Example
{
"CiscoAMP": {
"Group": {
"child_groups": [
{
"guid": "CiscoAMP_Group_child_groups[0]_guid",
"name": "CiscoAMP_Group_child_groups[0]_name"
}
],
"computers_count": "CiscoAMP_Group_computers_count",
"created_at": "CiscoAMP_Group_created_at",
"creator": "CiscoAMP_Group_creator",
"descendant_computers_count": "CiscoAMP_Group_descendant_computers_count",
"description": "CiscoAMP_Group_description",
"guid": "CiscoAMP_Group_guid",
"name": "CiscoAMP_Group_name",
"policies": [
{
"default": "CiscoAMP_Group_policies[0]_default",
"description": "CiscoAMP_Group_policies[0]_description",
"exclusion_sets": [
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[0]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[0]_name"
}
],
"file_lists": [],
"guid": "CiscoAMP_Group_policies[0]_guid",
"inherited": "CiscoAMP_Group_policies[0]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[0]_name",
"product": "CiscoAMP_Group_policies[0]_product",
"serial_number": "CiscoAMP_Group_policies[0]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[0]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[0]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[0]_used_in_groups[0]_name"
}
]
},
{
"default": "CiscoAMP_Group_policies[1]_default",
"description": "CiscoAMP_Group_policies[1]_description",
"file_lists": [],
"guid": "CiscoAMP_Group_policies[1]_guid",
"inherited": "CiscoAMP_Group_policies[1]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[1]_name",
"product": "CiscoAMP_Group_policies[1]_product",
"serial_number": "CiscoAMP_Group_policies[1]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[1]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[1]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[1]_used_in_groups[0]_name"
},
{
"description": "CiscoAMP_Group_policies[1]_used_in_groups[1]_description",
"guid": "CiscoAMP_Group_policies[1]_used_in_groups[1]_guid",
"name": "CiscoAMP_Group_policies[1]_used_in_groups[1]_name"
}
]
},
{
"default": "CiscoAMP_Group_policies[2]_default",
"description": "CiscoAMP_Group_policies[2]_description",
"exclusion_sets": [
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[0]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[0]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[1]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[1]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[2]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[2]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[3]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[3]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[4]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[4]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[5]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[5]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[6]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[6]_name"
}
],
"file_lists": [
{
"guid": "CiscoAMP_Group_policies[2]_file_lists[0]_guid",
"name": "CiscoAMP_Group_policies[2]_file_lists[0]_name",
"type": "CiscoAMP_Group_policies[2]_file_lists[0]_type"
},
{
"guid": "CiscoAMP_Group_policies[2]_file_lists[1]_guid",
"name": "CiscoAMP_Group_policies[2]_file_lists[1]_name",
"type": "CiscoAMP_Group_policies[2]_file_lists[1]_type"
},
{
"guid": "CiscoAMP_Group_policies[2]_file_lists[2]_guid",
"name": "CiscoAMP_Group_policies[2]_file_lists[2]_name",
"type": "CiscoAMP_Group_policies[2]_file_lists[2]_type"
}
],
"guid": "CiscoAMP_Group_policies[2]_guid",
"inherited": "CiscoAMP_Group_policies[2]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[2]_name",
"product": "CiscoAMP_Group_policies[2]_product",
"serial_number": "CiscoAMP_Group_policies[2]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[2]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[2]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[2]_used_in_groups[0]_name"
},
{
"description": "CiscoAMP_Group_policies[2]_used_in_groups[1]_description",
"guid": "CiscoAMP_Group_policies[2]_used_in_groups[1]_guid",
"name": "CiscoAMP_Group_policies[2]_used_in_groups[1]_name"
}
]
},
{
"default": "CiscoAMP_Group_policies[3]_default",
"description": "CiscoAMP_Group_policies[3]_description",
"file_lists": [
{
"guid": "CiscoAMP_Group_policies[3]_file_lists[0]_guid",
"name": "CiscoAMP_Group_policies[3]_file_lists[0]_name",
"type": "CiscoAMP_Group_policies[3]_file_lists[0]_type"
},
{
"guid": "CiscoAMP_Group_policies[3]_file_lists[1]_guid",
"name": "CiscoAMP_Group_policies[3]_file_lists[1]_name",
"type": "CiscoAMP_Group_policies[3]_file_lists[1]_type"
},
{
"guid": "CiscoAMP_Group_policies[3]_file_lists[2]_guid",
"name": "CiscoAMP_Group_policies[3]_file_lists[2]_name",
"type": "CiscoAMP_Group_policies[3]_file_lists[2]_type"
}
],
"guid": "CiscoAMP_Group_policies[3]_guid",
"inherited": "CiscoAMP_Group_policies[3]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[3]_name",
"product": "CiscoAMP_Group_policies[3]_product",
"serial_number": "CiscoAMP_Group_policies[3]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[3]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[3]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[3]_used_in_groups[0]_name"
},
{
"description": "CiscoAMP_Group_policies[3]_used_in_groups[1]_description",
"guid": "CiscoAMP_Group_policies[3]_used_in_groups[1]_guid",
"name": "CiscoAMP_Group_policies[3]_used_in_groups[1]_name"
}
]
},
{
"default": "CiscoAMP_Group_policies[4]_default",
"description": "CiscoAMP_Group_policies[4]_description",
"file_lists": [],
"guid": "CiscoAMP_Group_policies[4]_guid",
"inherited": "CiscoAMP_Group_policies[4]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[4]_name",
"product": "CiscoAMP_Group_policies[4]_product",
"serial_number": "CiscoAMP_Group_policies[4]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[4]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[4]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[4]_used_in_groups[0]_name"
},
{
"description": "CiscoAMP_Group_policies[4]_used_in_groups[1]_description",
"guid": "CiscoAMP_Group_policies[4]_used_in_groups[1]_guid",
"name": "CiscoAMP_Group_policies[4]_used_in_groups[1]_name"
}
]
}
],
"source": "CiscoAMP_Group_source"
}
}
}
Human Readable Output
Group Information
Name Description Creator Created At Computers Count Descendant Computers Count Lior-Group Test group 2022-10-25 13:42:36 1 0
cisco-amp-group-parent-update
Converts an existing group to a child of another group or an existing child group to a root group (that is, one with no parent groups).
Base Command
cisco-amp-group-parent-update
Input
| Argument Name | Description | Required |
|---|---|---|
| child_guid | Group’s GUID. | Required |
| parent_group_guid | Group parent to set to child group. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.Group.name | String | Name of the group. |
| CiscoAMP.Group.description | String | Group’s description. |
| CiscoAMP.Group.guid | String | Group GUID. |
| CiscoAMP.Group.source | String | Creation source. |
| CiscoAMP.Group.creator | String | Creator of the group. |
| CiscoAMP.Group.created_at | Date | Date of creation. |
| CiscoAMP.Group.computers_count | Number | Number of computers in the group. |
| CiscoAMP.Group.descendant_computers_count | Number | Number of computers from descendant groups. |
| CiscoAMP.Group.ancestry.name | String | Parent group name. |
| CiscoAMP.Group.ancestry.guid | String | Parent group GUID. |
| CiscoAMP.Group.child_groups.name | String | Child group name. |
| CiscoAMP.Group.child_groups.guid | String | Child group GUID. |
| CiscoAMP.Group.policies.name | String | Policy name. |
| CiscoAMP.Group.policies.description | String | Policy description. |
| CiscoAMP.Group.policies.guid | String | Policy GUID. |
| CiscoAMP.Group.policies.product | String | Policy operating system product. |
| CiscoAMP.Group.policies.default | Boolean | Whether the policy is the default policy. |
| CiscoAMP.Group.policies.serial_number | Number | Policy serial number. |
| CiscoAMP.Group.policies.inherited | Boolean | Whether the policy is inherited. |
| CiscoAMP.Group.policies.file_lists.name | String | File list name. |
| CiscoAMP.Group.policies.file_lists.guid | String | File list GUID. |
| CiscoAMP.Group.policies.file_lists.type | String | File list type. |
| CiscoAMP.Group.policies.ip_lists.name | String | IP list name. |
| CiscoAMP.Group.policies.ip_lists.guid | String | IP list GUID. |
| CiscoAMP.Group.policies.ip_lists.type | String | IP list type. |
| CiscoAMP.Group.policies.exclusion_sets.name | String | Exclusion set name. |
| CiscoAMP.Group.policies.exclusion_sets.guid | String | Exclusion set GUID. |
| CiscoAMP.Group.policies.used_in_groups.name | String | Name of the group it is used in. |
| CiscoAMP.Group.policies.used_in_groups.description | String | Description of the group it is used in. |
| CiscoAMP.Group.policies.used_in_groups.guid | String | GUID of the group it is used in. |
| CiscoAMP.Group.policies.used_in_groups.source | String | Creation source of the group it is used in. |
Command example
!cisco-amp-group-parent-update child_guid=bb5a9f90-d6fa-4fe7-99c8-e91060b49a98
Context Example
{
"CiscoAMP": {
"Group": {
"child_groups": [
{
"guid": "CiscoAMP_Group_child_groups[0]_guid",
"name": "CiscoAMP_Group_child_groups[0]_name"
}
],
"computers_count": "CiscoAMP_Group_computers_count",
"created_at": "CiscoAMP_Group_created_at",
"creator": "CiscoAMP_Group_creator",
"descendant_computers_count": "CiscoAMP_Group_descendant_computers_count",
"description": "CiscoAMP_Group_description",
"guid": "CiscoAMP_Group_guid",
"name": "CiscoAMP_Group_name",
"policies": [
{
"default": "CiscoAMP_Group_policies[0]_default",
"description": "CiscoAMP_Group_policies[0]_description",
"exclusion_sets": [
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[0]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[0]_name"
}
],
"file_lists": [],
"guid": "CiscoAMP_Group_policies[0]_guid",
"inherited": "CiscoAMP_Group_policies[0]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[0]_name",
"product": "CiscoAMP_Group_policies[0]_product",
"serial_number": "CiscoAMP_Group_policies[0]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[0]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[0]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[0]_used_in_groups[0]_name"
}
]
},
{
"default": "CiscoAMP_Group_policies[1]_default",
"description": "CiscoAMP_Group_policies[1]_description",
"file_lists": [],
"guid": "CiscoAMP_Group_policies[1]_guid",
"inherited": "CiscoAMP_Group_policies[1]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[1]_name",
"product": "CiscoAMP_Group_policies[1]_product",
"serial_number": "CiscoAMP_Group_policies[1]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[1]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[1]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[1]_used_in_groups[0]_name"
},
{
"description": "CiscoAMP_Group_policies[1]_used_in_groups[1]_description",
"guid": "CiscoAMP_Group_policies[1]_used_in_groups[1]_guid",
"name": "CiscoAMP_Group_policies[1]_used_in_groups[1]_name"
}
]
},
{
"default": "CiscoAMP_Group_policies[2]_default",
"description": "CiscoAMP_Group_policies[2]_description",
"exclusion_sets": [
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[0]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[0]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[1]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[1]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[2]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[2]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[3]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[3]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[4]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[4]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[5]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[5]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[6]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[6]_name"
}
],
"file_lists": [
{
"guid": "CiscoAMP_Group_policies[2]_file_lists[0]_guid",
"name": "CiscoAMP_Group_policies[2]_file_lists[0]_name",
"type": "CiscoAMP_Group_policies[2]_file_lists[0]_type"
},
{
"guid": "CiscoAMP_Group_policies[2]_file_lists[1]_guid",
"name": "CiscoAMP_Group_policies[2]_file_lists[1]_name",
"type": "CiscoAMP_Group_policies[2]_file_lists[1]_type"
},
{
"guid": "CiscoAMP_Group_policies[2]_file_lists[2]_guid",
"name": "CiscoAMP_Group_policies[2]_file_lists[2]_name",
"type": "CiscoAMP_Group_policies[2]_file_lists[2]_type"
}
],
"guid": "CiscoAMP_Group_policies[2]_guid",
"inherited": "CiscoAMP_Group_policies[2]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[2]_name",
"product": "CiscoAMP_Group_policies[2]_product",
"serial_number": "CiscoAMP_Group_policies[2]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[2]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[2]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[2]_used_in_groups[0]_name"
},
{
"description": "CiscoAMP_Group_policies[2]_used_in_groups[1]_description",
"guid": "CiscoAMP_Group_policies[2]_used_in_groups[1]_guid",
"name": "CiscoAMP_Group_policies[2]_used_in_groups[1]_name"
}
]
},
{
"default": "CiscoAMP_Group_policies[3]_default",
"description": "CiscoAMP_Group_policies[3]_description",
"file_lists": [
{
"guid": "CiscoAMP_Group_policies[3]_file_lists[0]_guid",
"name": "CiscoAMP_Group_policies[3]_file_lists[0]_name",
"type": "CiscoAMP_Group_policies[3]_file_lists[0]_type"
},
{
"guid": "CiscoAMP_Group_policies[3]_file_lists[1]_guid",
"name": "CiscoAMP_Group_policies[3]_file_lists[1]_name",
"type": "CiscoAMP_Group_policies[3]_file_lists[1]_type"
},
{
"guid": "CiscoAMP_Group_policies[3]_file_lists[2]_guid",
"name": "CiscoAMP_Group_policies[3]_file_lists[2]_name",
"type": "CiscoAMP_Group_policies[3]_file_lists[2]_type"
}
],
"guid": "CiscoAMP_Group_policies[3]_guid",
"inherited": "CiscoAMP_Group_policies[3]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[3]_name",
"product": "CiscoAMP_Group_policies[3]_product",
"serial_number": "CiscoAMP_Group_policies[3]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[3]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[3]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[3]_used_in_groups[0]_name"
},
{
"description": "CiscoAMP_Group_policies[3]_used_in_groups[1]_description",
"guid": "CiscoAMP_Group_policies[3]_used_in_groups[1]_guid",
"name": "CiscoAMP_Group_policies[3]_used_in_groups[1]_name"
}
]
},
{
"default": "CiscoAMP_Group_policies[4]_default",
"description": "CiscoAMP_Group_policies[4]_description",
"file_lists": [],
"guid": "CiscoAMP_Group_policies[4]_guid",
"inherited": "CiscoAMP_Group_policies[4]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[4]_name",
"product": "CiscoAMP_Group_policies[4]_product",
"serial_number": "CiscoAMP_Group_policies[4]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[4]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[4]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[4]_used_in_groups[0]_name"
},
{
"description": "CiscoAMP_Group_policies[4]_used_in_groups[1]_description",
"guid": "CiscoAMP_Group_policies[4]_used_in_groups[1]_guid",
"name": "CiscoAMP_Group_policies[4]_used_in_groups[1]_name"
}
]
}
],
"source": "CiscoAMP_Group_source"
}
}
}
Human Readable Output
Group Information
Name Description Creator Created At Computers Count Descendant Computers Count Lior-Group Test group 2022-10-25 13:42:36 1 0
cisco-amp-group-create
Creates a new group along with a group name or description.
Base Command
cisco-amp-group-create
Input
| Argument Name | Description | Required |
|---|---|---|
| name | Group name. | Required |
| description | Group description. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.Group.name | String | Name of the group. |
| CiscoAMP.Group.description | String | Group’s description. |
| CiscoAMP.Group.guid | String | Group GUID. |
| CiscoAMP.Group.source | String | Creation source. |
| CiscoAMP.Group.creator | String | Creator of the group. |
| CiscoAMP.Group.created_at | Date | Date of creation. |
| CiscoAMP.Group.computers_count | Number | Number of computers in the group. |
| CiscoAMP.Group.descendant_computers_count | Number | Number of computers from descendant groups. |
| CiscoAMP.Group.policies.name | String | Policy name. |
| CiscoAMP.Group.policies.description | String | Policy description. |
| CiscoAMP.Group.policies.guid | String | Policy GUID. |
| CiscoAMP.Group.policies.product | String | Policy operating system product. |
| CiscoAMP.Group.policies.default | Boolean | Whether the policy is the default policy. |
| CiscoAMP.Group.policies.serial_number | Number | Policy serial number. |
| CiscoAMP.Group.policies.inherited | Boolean | Whether the policy is inherited. |
| CiscoAMP.Group.policies.file_lists.name | String | File list name. |
| CiscoAMP.Group.policies.file_lists.guid | String | File list GUID. |
| CiscoAMP.Group.policies.file_lists.type | String | File list type. |
| CiscoAMP.Group.policies.ip_lists.name | String | IP list name. |
| CiscoAMP.Group.policies.ip_lists.guid | String | IP list GUID. |
| CiscoAMP.Group.policies.ip_lists.type | String | IP list type. |
| CiscoAMP.Group.policies.exclusion_sets.name | String | Exclusion set name. |
| CiscoAMP.Group.policies.exclusion_sets.guid | String | Exclusion set GUID. |
| CiscoAMP.Group.policies.used_in_groups.name | String | Name of the group it is used in. |
| CiscoAMP.Group.policies.used_in_groups.description | String | Description of the group it is used in. |
| CiscoAMP.Group.policies.used_in_groups.guid | String | GUID of the group it is used in. |
| CiscoAMP.Group.policies.used_in_groups.source | String | Creation source of the group it is used in. |
Command example
!cisco-amp-group-create description="readme test group to be deleted" name="readme group"
Context Example
{
"CiscoAMP": {
"Group": {
"computers_count": "CiscoAMP_Group_computers_count",
"created_at": "CiscoAMP_Group_created_at",
"creator": "CiscoAMP_Group_creator",
"descendant_computers_count": "CiscoAMP_Group_descendant_computers_count",
"description": "CiscoAMP_Group_description",
"guid": "CiscoAMP_Group_guid",
"name": "CiscoAMP_Group_name",
"policies": [
{
"default": "CiscoAMP_Group_policies[0]_default",
"description": "CiscoAMP_Group_policies[0]_description",
"exclusion_sets": [
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[0]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[0]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[1]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[1]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[2]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[2]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[3]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[3]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[4]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[4]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[5]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[5]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[6]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[6]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[7]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[7]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[8]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[8]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[9]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[9]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[10]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[10]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[11]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[11]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[12]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[12]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[13]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[13]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[14]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[14]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[15]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[15]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[16]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[16]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[17]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[17]_name"
},
{
"guid": "CiscoAMP_Group_policies[0]_exclusion_sets[18]_guid",
"name": "CiscoAMP_Group_policies[0]_exclusion_sets[18]_name"
}
],
"file_lists": [
{
"guid": "CiscoAMP_Group_policies[0]_file_lists[0]_guid",
"name": "CiscoAMP_Group_policies[0]_file_lists[0]_name",
"type": "CiscoAMP_Group_policies[0]_file_lists[0]_type"
},
{
"guid": "CiscoAMP_Group_policies[0]_file_lists[1]_guid",
"name": "CiscoAMP_Group_policies[0]_file_lists[1]_name",
"type": "CiscoAMP_Group_policies[0]_file_lists[1]_type"
},
{
"guid": "CiscoAMP_Group_policies[0]_file_lists[2]_guid",
"name": "CiscoAMP_Group_policies[0]_file_lists[2]_name",
"type": "CiscoAMP_Group_policies[0]_file_lists[2]_type"
}
],
"guid": "CiscoAMP_Group_policies[0]_guid",
"inherited": "CiscoAMP_Group_policies[0]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[0]_name",
"product": "CiscoAMP_Group_policies[0]_product",
"serial_number": "CiscoAMP_Group_policies[0]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[0]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[0]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[0]_used_in_groups[0]_name"
}
]
},
{
"default": "CiscoAMP_Group_policies[1]_default",
"description": "CiscoAMP_Group_policies[1]_description",
"file_lists": [],
"guid": "CiscoAMP_Group_policies[1]_guid",
"inherited": "CiscoAMP_Group_policies[1]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[1]_name",
"product": "CiscoAMP_Group_policies[1]_product",
"serial_number": "CiscoAMP_Group_policies[1]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[1]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[1]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[1]_used_in_groups[0]_name"
},
{
"description": "CiscoAMP_Group_policies[1]_used_in_groups[1]_description",
"guid": "CiscoAMP_Group_policies[1]_used_in_groups[1]_guid",
"name": "CiscoAMP_Group_policies[1]_used_in_groups[1]_name"
}
]
},
{
"default": "CiscoAMP_Group_policies[2]_default",
"description": "CiscoAMP_Group_policies[2]_description",
"exclusion_sets": [
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[0]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[0]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[1]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[1]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[2]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[2]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[3]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[3]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[4]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[4]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[5]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[5]_name"
},
{
"guid": "CiscoAMP_Group_policies[2]_exclusion_sets[6]_guid",
"name": "CiscoAMP_Group_policies[2]_exclusion_sets[6]_name"
}
],
"file_lists": [
{
"guid": "CiscoAMP_Group_policies[2]_file_lists[0]_guid",
"name": "CiscoAMP_Group_policies[2]_file_lists[0]_name",
"type": "CiscoAMP_Group_policies[2]_file_lists[0]_type"
},
{
"guid": "CiscoAMP_Group_policies[2]_file_lists[1]_guid",
"name": "CiscoAMP_Group_policies[2]_file_lists[1]_name",
"type": "CiscoAMP_Group_policies[2]_file_lists[1]_type"
},
{
"guid": "CiscoAMP_Group_policies[2]_file_lists[2]_guid",
"name": "CiscoAMP_Group_policies[2]_file_lists[2]_name",
"type": "CiscoAMP_Group_policies[2]_file_lists[2]_type"
}
],
"guid": "CiscoAMP_Group_policies[2]_guid",
"inherited": "CiscoAMP_Group_policies[2]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[2]_name",
"product": "CiscoAMP_Group_policies[2]_product",
"serial_number": "CiscoAMP_Group_policies[2]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[2]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[2]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[2]_used_in_groups[0]_name"
}
]
},
{
"default": "CiscoAMP_Group_policies[3]_default",
"description": "CiscoAMP_Group_policies[3]_description",
"file_lists": [
{
"guid": "CiscoAMP_Group_policies[3]_file_lists[0]_guid",
"name": "CiscoAMP_Group_policies[3]_file_lists[0]_name",
"type": "CiscoAMP_Group_policies[3]_file_lists[0]_type"
},
{
"guid": "CiscoAMP_Group_policies[3]_file_lists[1]_guid",
"name": "CiscoAMP_Group_policies[3]_file_lists[1]_name",
"type": "CiscoAMP_Group_policies[3]_file_lists[1]_type"
},
{
"guid": "CiscoAMP_Group_policies[3]_file_lists[2]_guid",
"name": "CiscoAMP_Group_policies[3]_file_lists[2]_name",
"type": "CiscoAMP_Group_policies[3]_file_lists[2]_type"
}
],
"guid": "CiscoAMP_Group_policies[3]_guid",
"inherited": "CiscoAMP_Group_policies[3]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[3]_name",
"product": "CiscoAMP_Group_policies[3]_product",
"serial_number": "CiscoAMP_Group_policies[3]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[3]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[3]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[3]_used_in_groups[0]_name"
}
]
},
{
"default": "CiscoAMP_Group_policies[4]_default",
"description": "CiscoAMP_Group_policies[4]_description",
"file_lists": [],
"guid": "CiscoAMP_Group_policies[4]_guid",
"inherited": "CiscoAMP_Group_policies[4]_inherited",
"ip_lists": [],
"isolation_ip_lists": [],
"name": "CiscoAMP_Group_policies[4]_name",
"product": "CiscoAMP_Group_policies[4]_product",
"serial_number": "CiscoAMP_Group_policies[4]_serial_number",
"used_in_groups": [
{
"description": "CiscoAMP_Group_policies[4]_used_in_groups[0]_description",
"guid": "CiscoAMP_Group_policies[4]_used_in_groups[0]_guid",
"name": "CiscoAMP_Group_policies[4]_used_in_groups[0]_name"
}
]
}
],
"source": "CiscoAMP_Group_source"
}
}
}
Human Readable Output
Group Information
Name Description Created At Computers Count Descendant Computers Count readme group readme test group to be deleted 2022-10-31 12:16:25 0 0
cisco-amp-group-delete
Destroys a group with a given GUID.
Base Command
cisco-amp-group-delete
Input
| Argument Name | Description | Required |
|---|---|---|
| group_guid | Group’s GUID. | Required |
Context Output
There is no context output for this command.
Command example
!cisco-amp-group-delete group_guid=d088adeb-7cb4-48e4-807b-edcb828f4d29
Human Readable Output
Group GUID: “d088adeb-7cb4-48e4-807b-edcb828f4d29”
Successfully deleted.
cisco-amp-indicator-list
Show information about indicators.
Base Command
cisco-amp-indicator-list
Input
| Argument Name | Description | Required |
|---|---|---|
| indicator_guid | Indicator GUID. | Optional |
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 500. | Optional |
| limit | Number of total results to return. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.Indicator.name | String | Indicator name. |
| CiscoAMP.Indicator.description | String | Indicator description. |
| CiscoAMP.Indicator.guid | String | Indicator GUID. |
| CiscoAMP.Indicator.severity | String | Indicator severity. |
| CiscoAMP.Indicator.mitre.tactics.external_id | String | Mitre tactic ID. |
| CiscoAMP.Indicator.mitre.tactics.name | String | Mitre tactic name. |
| CiscoAMP.Indicator.mitre.tactics.mitre_url | String | Mitre tactic URL. |
| CiscoAMP.Indicator.mitre.techniques.external_id | String | Mitre technique ID. |
| CiscoAMP.Indicator.mitre.techniques.name | String | Mitre technique name. |
| CiscoAMP.Indicator.mitre.techniques.mitre_url | String | Mitre technique URL. |
| CiscoAMP.Indicator.observed_compromises | Number | Total number of observed compromises. |
| CiscoAMP.Indicator.observed_compromises.unresolved | Number | Number of unresolved compromises. |
| CiscoAMP.Indicator.observed_compromises.in_progress | Number | Number of compromises in progress. |
| CiscoAMP.Indicator.observed_compromises.resolved | Number | Number of resolved compromises. |
Command example
!cisco-amp-indicator-list limit=5
Context Example
{
"CiscoAMP": {
"Indicator": [
{
"description": "CiscoAMP_Indicator[0]_description",
"guid": "CiscoAMP_Indicator[0]_guid",
"name": "CiscoAMP_Indicator[0]_name",
"observed_compromises": "CiscoAMP_Indicator[0]_observed_compromises",
"severity": "CiscoAMP_Indicator[0]_severity"
},
{
"description": "CiscoAMP_Indicator[1]_description",
"guid": "CiscoAMP_Indicator[1]_guid",
"name": "CiscoAMP_Indicator[1]_name",
"observed_compromises": "CiscoAMP_Indicator[1]_observed_compromises",
"severity": "CiscoAMP_Indicator[1]_severity"
},
{
"description": "CiscoAMP_Indicator[2]_description",
"guid": "CiscoAMP_Indicator[2]_guid",
"name": "CiscoAMP_Indicator[2]_name",
"observed_compromises": "CiscoAMP_Indicator[2]_observed_compromises",
"severity": "CiscoAMP_Indicator[2]_severity"
},
{
"description": "CiscoAMP_Indicator[3]_description",
"guid": "CiscoAMP_Indicator[3]_guid",
"name": "CiscoAMP_Indicator[3]_name",
"observed_compromises": "CiscoAMP_Indicator[3]_observed_compromises",
"severity": "CiscoAMP_Indicator[3]_severity"
},
{
"description": "CiscoAMP_Indicator[4]_description",
"guid": "CiscoAMP_Indicator[4]_guid",
"name": "CiscoAMP_Indicator[4]_name",
"observed_compromises": "CiscoAMP_Indicator[4]_observed_compromises",
"severity": "CiscoAMP_Indicator[4]_severity"
}
]
}
}
Human Readable Output
Results
Current Item Count Index Items Per Page Total 5 0 5 910 Indicator Information
GUID Name Description Severity Observed Compromises 5593ab7e-1db5-4759-9785-96c55824b675 Crossrider.ioc Crossrider is a an Adware variant that targets Mac with the intent of displaying ads. It also changes the default home page of Safari and Chrome browsers. Medium 0 fef2d8b2-95f6-4392-abec-fc1f6a670251 Dummy.ioc OSX.Dummy is a poorly executed Trojan variant. It requires users to input their password in order to complete it’s install. However, once this is done the malware will have complete access to the whole system, and it will persist itself via a LaunchDaemon. Medium 0 dcc66a98-5658-41d4-a1ca-887933a8b24f GateDotPhp.ioc Accessed URL matches characteristics of several malware families. High 1 940bdaf4-4c89-4423-a55e-410ed56143a8 JS.Trojan.Generic_48153.ioc JS.Trojan.Generic_48153 is malware that contacts a remote server over HTTP. This IOC is based on Snort Intrusion Prevention System (IPS) rule id:48153 from the malware detection rulesets. This IOC fires when a URI pattern similar to this malware has been detected. The components of the URI this IOC inspects for are: “/01/Carontex”. Critical 0 318d030d-7fdc-48f4-afcd-66c7c75cade7 Linux.AutostartPersistence.ioc Most Linux distributions support creation of auto-start files. This consists of placing a configuration file with a .desktop extension in the .config/autostart location. In this case, a suspicious auto-start entry was created. Linux malware such as x-agent also known as sofacy/sednit are known to do that. High 0
cisco-amp-policy-list
Gets information about policies by filtering with a product and name of a specific policy with a policy_guid.
Base Command
cisco-amp-policy-list
Input
| Argument Name | Description | Required |
|---|---|---|
| policy_guid | Policy GUID. | Optional |
| product | Comma-separated list for products to filter by. | Optional |
| name | Comma-separated list for names to filter by (has auto complete capabilities). | Optional |
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 500. | Optional |
| limit | Number of total results to return. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.Policy.name | String | Policy name. |
| CiscoAMP.Policy.description | String | Policy description. |
| CiscoAMP.Policy.guid | String | Policy GUID. |
| CiscoAMP.Policy.product | String | Product used. |
| CiscoAMP.Policy.default | Boolean | Whether the policy is the default policy. |
| CiscoAMP.Policy.serial_number | Number | Policy serial number. |
| CiscoAMP.Policy.file_lists.name | String | File list name. |
| CiscoAMP.Policy.file_lists.guid | String | File list GUID. |
| CiscoAMP.Policy.file_lists.type | String | File list type. |
| CiscoAMP.Policy.ip_lists.name | String | IP list name. |
| CiscoAMP.Policy.ip_lists.guid | String | IP list GUID. |
| CiscoAMP.Policy.ip_lists.type | String | IP list type. |
| CiscoAMP.Policy.exclusion_sets.name | String | Exclusion set name. |
| CiscoAMP.Policy.exclusion_sets.guid | String | Exclusion set GUID. |
| CiscoAMP.Policy.used_in_groups.name | String | Group name. |
| CiscoAMP.Policy.used_in_groups.description | String | Group description. |
| CiscoAMP.Policy.used_in_groups.guid | String | Group GUID. |
Command example
#### Context Example
```json
{
"CiscoAMP": {
"Policy": [
{
"default": "CiscoAMP_Policy[0]_default",
"description": "CiscoAMP_Policy[0]_description",
"guid": "CiscoAMP_Policy[0]_guid",
"name": "CiscoAMP_Policy[0]_name",
"product": "CiscoAMP_Policy[0]_product",
"serial_number": "CiscoAMP_Policy[0]_serial_number"
},
{
"default": "CiscoAMP_Policy[1]_default",
"description": "CiscoAMP_Policy[1]_description",
"guid": "CiscoAMP_Policy[1]_guid",
"name": "CiscoAMP_Policy[1]_name",
"product": "CiscoAMP_Policy[1]_product",
"serial_number": "CiscoAMP_Policy[1]_serial_number"
},
{
"default": "CiscoAMP_Policy[2]_default",
"description": "CiscoAMP_Policy[2]_description",
"guid": "CiscoAMP_Policy[2]_guid",
"name": "CiscoAMP_Policy[2]_name",
"product": "CiscoAMP_Policy[2]_product",
"serial_number": "CiscoAMP_Policy[2]_serial_number"
},
{
"default": "CiscoAMP_Policy[3]_default",
"description": "CiscoAMP_Policy[3]_description",
"guid": "CiscoAMP_Policy[3]_guid",
"name": "CiscoAMP_Policy[3]_name",
"product": "CiscoAMP_Policy[3]_product",
"serial_number": "CiscoAMP_Policy[3]_serial_number"
},
{
"default": "CiscoAMP_Policy[4]_default",
"description": "CiscoAMP_Policy[4]_description",
"guid": "CiscoAMP_Policy[4]_guid",
"name": "CiscoAMP_Policy[4]_name",
"product": "CiscoAMP_Policy[4]_product",
"serial_number": "CiscoAMP_Policy[4]_serial_number"
},
{
"default": "CiscoAMP_Policy[5]_default",
"description": "CiscoAMP_Policy[5]_description",
"guid": "CiscoAMP_Policy[5]_guid",
"name": "CiscoAMP_Policy[5]_name",
"product": "CiscoAMP_Policy[5]_product",
"serial_number": "CiscoAMP_Policy[5]_serial_number"
},
{
"default": "CiscoAMP_Policy[6]_default",
"description": "CiscoAMP_Policy[6]_description",
"guid": "CiscoAMP_Policy[6]_guid",
"name": "CiscoAMP_Policy[6]_name",
"product": "CiscoAMP_Policy[6]_product",
"serial_number": "CiscoAMP_Policy[6]_serial_number"
},
{
"default": "CiscoAMP_Policy[7]_default",
"description": "CiscoAMP_Policy[7]_description",
"guid": "CiscoAMP_Policy[7]_guid",
"name": "CiscoAMP_Policy[7]_name",
"product": "CiscoAMP_Policy[7]_product",
"serial_number": "CiscoAMP_Policy[7]_serial_number"
},
{
"default": "CiscoAMP_Policy[8]_default",
"description": "CiscoAMP_Policy[8]_description",
"guid": "CiscoAMP_Policy[8]_guid",
"name": "CiscoAMP_Policy[8]_name",
"product": "CiscoAMP_Policy[8]_product",
"serial_number": "CiscoAMP_Policy[8]_serial_number"
},
{
"default": "CiscoAMP_Policy[9]_default",
"description": "CiscoAMP_Policy[9]_description",
"guid": "CiscoAMP_Policy[9]_guid",
"name": "CiscoAMP_Policy[9]_name",
"product": "CiscoAMP_Policy[9]_product",
"serial_number": "CiscoAMP_Policy[9]_serial_number"
},
{
"default": "CiscoAMP_Policy[10]_default",
"description": "CiscoAMP_Policy[10]_description",
"guid": "CiscoAMP_Policy[10]_guid",
"name": "CiscoAMP_Policy[10]_name",
"product": "CiscoAMP_Policy[10]_product",
"serial_number": "CiscoAMP_Policy[10]_serial_number"
},
{
"default": "CiscoAMP_Policy[11]_default",
"description": "CiscoAMP_Policy[11]_description",
"guid": "CiscoAMP_Policy[11]_guid",
"name": "CiscoAMP_Policy[11]_name",
"product": "CiscoAMP_Policy[11]_product",
"serial_number": "CiscoAMP_Policy[11]_serial_number"
},
{
"default": "CiscoAMP_Policy[12]_default",
"description": "CiscoAMP_Policy[12]_description",
"guid": "CiscoAMP_Policy[12]_guid",
"name": "CiscoAMP_Policy[12]_name",
"product": "CiscoAMP_Policy[12]_product",
"serial_number": "CiscoAMP_Policy[12]_serial_number"
},
{
"default": "CiscoAMP_Policy[13]_default",
"description": "CiscoAMP_Policy[13]_description",
"guid": "CiscoAMP_Policy[13]_guid",
"name": "CiscoAMP_Policy[13]_name",
"product": "CiscoAMP_Policy[13]_product",
"serial_number": "CiscoAMP_Policy[13]_serial_number"
}
]
}
}
Human Readable Output
Results
Current Item Count Index Items Per Page Total 14 0 100 14 Policy Information
GUID Name Description Product Serial Number 082bc9a3-b73a-4f42-8cc5-de1cd3748700 Protect This is the standard policy for the Secure Endpoint Connector that will quarantine malicious files and block malicious network connections. android 11 5102948a-db78-4a94-849a-b9f12b04e526 Audit This policy puts Clarity in a mode that will log and alert on convictions but not block traffic. ios 23 c90936b3-2ad7-458c-90a3-a806d50ed16e Protect This is the standard policy for Clarity that will log and alert on convictions and block any potentially malicious traffic. ios 25 b4e266c8-ebd1-4e94-80b6-b04a966cb0d5 Audit This policy puts the Secure Endpoint Connector in a mode that will only detect malicious files but not quarantine them. Malicious network traffic is also detected but not blocked. linux 19 653508ed-28d4-465a-80c4-7ed9c0232b55 Protect This is the standard policy for the Secure Endpoint Connector that will quarantine malicious files and block malicious network connections. linux 21 9f2fa537-df5d-4c6c-abf3-edc25a893a7a Audit This policy puts the Secure Endpoint Connector in a mode that will only detect malicious files but not quarantine them. Malicious network traffic is also detected but not blocked. mac 13 30fba653-eb4e-4c3d-b1bb-1cef9f0e31e4 Protect This is the standard policy for the Secure Endpoint Connector that will quarantine malicious files and block malicious network connections. mac 15 cfcf4841-bf00-4030-8ac3-4a607ecf245e Triage This is an aggressive policy that enables the offline engine to scan computers that are suspected or known to be infected with malware. mac 17 be84e169-0830-4b95-915b-1e203a82ed58 Audit This policy puts the Secure Endpoint Connector in a mode that will only detect malicious files but not quarantine them. Malicious network traffic is also detected but not blocked. windows 29 fa0c377e-8f0a-40ab-885a-afc8c08d3732 Domain Controller This is a lightweight policy for use on Active Directory Domain Controllers. windows 10 91c7894d-dd69-4a21-8cf6-5ebfc57ef4df Lior-test Test policy windows 27 a599bf5b-2cb7-4a5b-90bd-d0199e2ccd67 Protect This is the standard policy for the Secure Endpoint Connector that will quarantine malicious files and block malicious network connections. windows 28 dd1da971-926c-42ab-9e5a-154f2695d995 Server This is a lightweight policy for high availability computers and servers that require maximum performance and uptime. windows 8 1a352c59-793b-44f3-b8f9-0ddd354057bc Triage This is an aggressive policy that enables the offline engine to scan computers that are suspected or known to be infected with malware. windows 6
cisco-amp-app-trajectory-query-list
Retrieve app_trajectory queries for a given ios bundle id.
Base Command
cisco-amp-app-trajectory-query-list
Input
| Argument Name | Description | Required |
|---|---|---|
| ios_bid | IOS bundle ID for app trajectory. | Required |
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 500. | Optional |
| limit | Number of total results to return. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.AppTrajectoryQuery.connector_guid | String | GUID of the connector. |
| CiscoAMP.AppTrajectoryQuery.bundle_id | String | Bundle ID. |
| CiscoAMP.AppTrajectoryQuery.group_guids | String | List of group’s GUIDs. |
| CiscoAMP.AppTrajectoryQuery.cdhash | String | CD hash. |
| CiscoAMP.AppTrajectoryQuery.timestamp | Number | Observed timestamp. |
| CiscoAMP.AppTrajectoryQuery.timestamp_nanoseconds | Number | Observed timestamp in nano seconds. |
| CiscoAMP.AppTrajectoryQuery.date | Date | Observed date. |
| CiscoAMP.AppTrajectoryQuery.query_type | String | The type of the query. |
| CiscoAMP.AppTrajectoryQuery.network_info.dirty_url | String | Link to the observed URL. |
| CiscoAMP.AppTrajectoryQuery.network_info.remote_ip | String | Remote IP. |
| CiscoAMP.AppTrajectoryQuery.network_info.remote_port | Number | Remote port. |
| CiscoAMP.AppTrajectoryQuery.network_info.local_ip | String | Local IP. |
| CiscoAMP.AppTrajectoryQuery.network_info.local_port | Number | Local Port. |
| CiscoAMP.AppTrajectoryQuery.network_info.direction | String | Outgoing or incoming connection. |
| CiscoAMP.AppTrajectoryQuery.network_info.protocol | String | Communication protocol used. |
| CiscoAMP.AppTrajectoryQuery.ver | String | Version. |
Command example
!cisco-amp-app-trajectory-query-list ios_bid=com.apple.Safari.SafeBrowsing limit=5
Context Example
{
"CiscoAMP": {
"AppTrajectoryQuery": [
{
"bundle_id": "CiscoAMP_AppTrajectoryQuery[0]_bundle_id",
"cdhash": "CiscoAMP_AppTrajectoryQuery[0]_cdhash",
"connector_guid": "CiscoAMP_AppTrajectoryQuery[0]_connector_guid",
"date": "CiscoAMP_AppTrajectoryQuery[0]_date",
"group_guids": [
"CiscoAMP_AppTrajectoryQuery[0]_group_guids_0"
],
"network_info": {
"direction": "CiscoAMP_AppTrajectoryQuery[0]_network_info_direction",
"dirty_url": "CiscoAMP_AppTrajectoryQuery[0]_network_info_dirty_url",
"local_ip": "CiscoAMP_AppTrajectoryQuery[0]_network_info_local_ip",
"local_port": "CiscoAMP_AppTrajectoryQuery[0]_network_info_local_port",
"protocol": "CiscoAMP_AppTrajectoryQuery[0]_network_info_protocol",
"remote_ip": "CiscoAMP_AppTrajectoryQuery[0]_network_info_remote_ip",
"remote_port": "CiscoAMP_AppTrajectoryQuery[0]_network_info_remote_port"
},
"query_type": "CiscoAMP_AppTrajectoryQuery[0]_query_type",
"timestamp": "CiscoAMP_AppTrajectoryQuery[0]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_AppTrajectoryQuery[0]_timestamp_nanoseconds",
"ver": "CiscoAMP_AppTrajectoryQuery[0]_ver"
},
{
"bundle_id": "CiscoAMP_AppTrajectoryQuery[1]_bundle_id",
"cdhash": "CiscoAMP_AppTrajectoryQuery[1]_cdhash",
"connector_guid": "CiscoAMP_AppTrajectoryQuery[1]_connector_guid",
"date": "CiscoAMP_AppTrajectoryQuery[1]_date",
"group_guids": [
"CiscoAMP_AppTrajectoryQuery[1]_group_guids_0"
],
"network_info": {
"direction": "CiscoAMP_AppTrajectoryQuery[1]_network_info_direction",
"dirty_url": "CiscoAMP_AppTrajectoryQuery[1]_network_info_dirty_url",
"local_ip": "CiscoAMP_AppTrajectoryQuery[1]_network_info_local_ip",
"local_port": "CiscoAMP_AppTrajectoryQuery[1]_network_info_local_port",
"protocol": "CiscoAMP_AppTrajectoryQuery[1]_network_info_protocol",
"remote_ip": "CiscoAMP_AppTrajectoryQuery[1]_network_info_remote_ip",
"remote_port": "CiscoAMP_AppTrajectoryQuery[1]_network_info_remote_port"
},
"query_type": "CiscoAMP_AppTrajectoryQuery[1]_query_type",
"timestamp": "CiscoAMP_AppTrajectoryQuery[1]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_AppTrajectoryQuery[1]_timestamp_nanoseconds",
"ver": "CiscoAMP_AppTrajectoryQuery[1]_ver"
},
{
"bundle_id": "CiscoAMP_AppTrajectoryQuery[2]_bundle_id",
"cdhash": "CiscoAMP_AppTrajectoryQuery[2]_cdhash",
"connector_guid": "CiscoAMP_AppTrajectoryQuery[2]_connector_guid",
"date": "CiscoAMP_AppTrajectoryQuery[2]_date",
"group_guids": [
"CiscoAMP_AppTrajectoryQuery[2]_group_guids_0"
],
"network_info": {
"direction": "CiscoAMP_AppTrajectoryQuery[2]_network_info_direction",
"dirty_url": "CiscoAMP_AppTrajectoryQuery[2]_network_info_dirty_url",
"local_ip": "CiscoAMP_AppTrajectoryQuery[2]_network_info_local_ip",
"local_port": "CiscoAMP_AppTrajectoryQuery[2]_network_info_local_port",
"protocol": "CiscoAMP_AppTrajectoryQuery[2]_network_info_protocol",
"remote_ip": "CiscoAMP_AppTrajectoryQuery[2]_network_info_remote_ip",
"remote_port": "CiscoAMP_AppTrajectoryQuery[2]_network_info_remote_port"
},
"query_type": "CiscoAMP_AppTrajectoryQuery[2]_query_type",
"timestamp": "CiscoAMP_AppTrajectoryQuery[2]_timestamp",
"timestamp_nanoseconds": "CiscoAMP_AppTrajectoryQuery[2]_timestamp_nanoseconds",
"ver": "CiscoAMP_AppTrajectoryQuery[2]_ver"
}
]
}
}
Human Readable Output
App Trajectory Information
Connector GUID Date Query Type Dirty URL dddd4ceb-4ce1-4f81-a7a7-04d13cc1df43 2022-10-24T12:01:59+00:00 Network Query https://configuration.apple.com/configurations/internetservices/safari/SafeBrowsingRemoteConfiguration-0.plist 0f6ee17f-a31b-4b76-902f-7cf68a79089d 2022-10-23T13:48:38+00:00 Network Query https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch 0f6ee17f-a31b-4b76-902f-7cf68a79089d 2022-10-23T13:18:16+00:00 Network Query https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch 8aa97bc7-3cc1-47aa-ad0a-0e23d5493aff 2022-10-23T12:30:46+00:00 Network Query https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch 8aa97bc7-3cc1-47aa-ad0a-0e23d5493aff 2022-10-23T12:00:54+00:00 Network Query https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch
cisco-amp-version-get
Get API version.
Base Command
cisco-amp-version-get
Input
There are no input arguments for this command.
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.Version.version | String | API version. |
Command example
#### Context Example
```json
{
"CiscoAMP": {
"Version": {
"version": "CiscoAMP_Version_version"
}
}
}
Human Readable Output
Version: v1.2.0
cisco-amp-vulnerability-list
Fetch a list of vulnerabilities. This is analogous to the Vulnerable Software view on the AMP for Endpoints Console. The list can be filtered to show only the vulnerable programs detected for a specific time range. Provide a list of computers on which the vulnerability has been observed with a given SHA-256. The list item contains a summary of information on the vulnerability, including: application name and version, SHA-256 value for the executable file, connectors on which the vulnerable application was observed and the most recent CVSS score. IMPORTANT: The computer’s key returns information about the last 1000 connectors on which the vulnerable application was observed.
Base Command
cisco-amp-vulnerability-list
Input
| Argument Name | Description | Required |
|---|---|---|
| sha256 | SHA-256 that has been observed as a vulnerability. | Optional |
| group_guid | Comma-separated list for group GUIDs to filter by. | Optional |
| start_time | The start date and time expressed according to ISO 8601. The retrieved list will include vulnerable programs detected at start_time. | Optional |
| end_time | The end date and/or time expressed according to ISO 8601. Exclusive - if end_time is a time, the list will only include vulnerable programs detected before end_time). Inclusive - if end_time is a date, the list will include vulnerable programs detected on the date. | Optional |
| page | Page number to return. | Optional |
| page_size | Number of results in a page. Maximum is 500. | Optional |
| limit | Number of total results to return. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CiscoAMP.Vulnerability.application | String | Name of the application. |
| CiscoAMP.Vulnerability.version | String | Version of the application. |
| CiscoAMP.Vulnerability.file.filename | String | Name of the file. |
| CiscoAMP.Vulnerability.file.identity.sha256 | String | File’s SHA-256. |
| CiscoAMP.Vulnerability.latest_timestamp | Number | Vulnerability latest timestamp. |
| CiscoAMP.Vulnerability.latest_date | Date | Vulnerability latest date. |
| CiscoAMP.Vulnerability.computers_total_count | Number | Number of computers. |
| CiscoAMP.Vulnerability.connector_guid | String | GUID of the connector. |
| CiscoAMP.Vulnerability.hostname | String | Host’s name. |
| CiscoAMP.Vulnerability.windows_processor_id | String | Windows processor ID. |
| CiscoAMP.Vulnerability.active | Boolean | Whether the computer is active. |
| CiscoAMP.Vulnerability.group_guid | String | Group’s GUID. |
| CiscoAMP.Vulnerability.cves.id | String | Common vulnerability exposure ID. |
| CiscoAMP.Vulnerability.cves.link | String | Common vulnerability exposure link. |
| CiscoAMP.Vulnerability.cves.cvss | Number | Common vulnerability scoring system. |
| CiscoAMP.Vulnerability.groups.name | String | Group’s name. |
| CiscoAMP.Vulnerability.groups.description | String | Group’s description. |
| CiscoAMP.Vulnerability.groups.guid | String | Group’s GUID. |
| CiscoAMP.Vulnerability.groups.source | String | Group’s source of creation. |
| CiscoAMP.Vulnerability.computers.connector_guid | String | GUID of the connector. |
| CiscoAMP.Vulnerability.computers.hostname | String | Host’s name. |
| CiscoAMP.Vulnerability.computers.windows_processor_id | String | Windows processor ID. |
| CiscoAMP.Vulnerability.computers.active | Boolean | Whether the computer is active. |
Command example
#### Context Example
```json
{
"CiscoAMP": {
"Vulnerability": [
{
"application": "CiscoAMP_Vulnerability[0]_application",
"computers": [
{
"active": "CiscoAMP_Vulnerability[0]_computers[0]_active",
"connector_guid": "CiscoAMP_Vulnerability[0]_computers[0]_connector_guid",
"hostname": "CiscoAMP_Vulnerability[0]_computers[0]_hostname",
"windows_processor_id": "CiscoAMP_Vulnerability[0]_computers[0]_windows_processor_id"
}
],
"computers_total_count": "CiscoAMP_Vulnerability[0]_computers_total_count",
"cves": [
{
"cvss": "CiscoAMP_Vulnerability[0]_cves[0]_cvss",
"id": "CiscoAMP_Vulnerability[0]_cves[0]_id",
"link": "CiscoAMP_Vulnerability[0]_cves[0]_link"
}
],
"file": {
"filename": "CiscoAMP_Vulnerability[0]_file_filename",
"identity": {
"sha256": "CiscoAMP_Vulnerability[0]_file_identity_sha256"
}
},
"groups": [
{
"description": "CiscoAMP_Vulnerability[0]_groups[0]_description",
"guid": "CiscoAMP_Vulnerability[0]_groups[0]_guid",
"name": "CiscoAMP_Vulnerability[0]_groups[0]_name"
}
],
"latest_date": "CiscoAMP_Vulnerability[0]_latest_date",
"latest_timestamp": "CiscoAMP_Vulnerability[0]_latest_timestamp",
"version": "CiscoAMP_Vulnerability[0]_version"
},
{
"application": "CiscoAMP_Vulnerability[1]_application",
"computers": [
{
"active": "CiscoAMP_Vulnerability[1]_computers[0]_active",
"connector_guid": "CiscoAMP_Vulnerability[1]_computers[0]_connector_guid",
"hostname": "CiscoAMP_Vulnerability[1]_computers[0]_hostname",
"windows_processor_id": "CiscoAMP_Vulnerability[1]_computers[0]_windows_processor_id"
}
],
"computers_total_count": "CiscoAMP_Vulnerability[1]_computers_total_count",
"cves": [
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[0]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[0]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[0]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[1]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[1]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[1]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[2]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[2]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[2]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[3]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[3]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[3]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[4]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[4]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[4]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[5]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[5]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[5]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[6]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[6]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[6]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[7]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[7]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[7]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[8]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[8]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[8]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[9]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[9]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[9]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[10]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[10]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[10]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[11]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[11]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[11]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[12]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[12]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[12]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[13]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[13]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[13]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[14]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[14]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[14]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[15]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[15]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[15]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[16]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[16]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[16]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[17]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[17]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[17]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[18]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[18]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[18]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[19]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[19]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[19]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[20]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[20]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[20]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[21]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[21]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[21]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[22]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[22]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[22]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[23]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[23]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[23]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[24]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[24]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[24]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[25]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[25]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[25]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[26]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[26]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[26]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[27]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[27]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[27]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[28]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[28]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[28]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[29]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[29]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[29]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[30]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[30]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[30]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[31]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[31]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[31]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[32]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[32]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[32]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[33]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[33]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[33]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[34]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[34]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[34]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[35]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[35]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[35]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[36]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[36]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[36]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[37]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[37]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[37]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[38]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[38]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[38]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[39]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[39]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[39]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[40]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[40]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[40]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[41]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[41]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[41]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[42]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[42]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[42]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[43]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[43]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[43]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[44]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[44]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[44]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[45]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[45]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[45]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[46]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[46]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[46]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[47]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[47]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[47]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[48]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[48]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[48]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[49]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[49]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[49]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[50]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[50]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[50]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[51]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[51]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[51]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[52]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[52]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[52]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[53]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[53]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[53]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[54]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[54]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[54]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[55]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[55]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[55]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[56]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[56]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[56]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[57]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[57]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[57]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[58]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[58]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[58]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[59]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[59]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[59]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[60]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[60]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[60]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[1]_cves[61]_cvss",
"id": "CiscoAMP_Vulnerability[1]_cves[61]_id",
"link": "CiscoAMP_Vulnerability[1]_cves[61]_link"
}
],
"file": {
"filename": "CiscoAMP_Vulnerability[1]_file_filename",
"identity": {
"sha256": "CiscoAMP_Vulnerability[1]_file_identity_sha256"
}
},
"groups": [
{
"description": "CiscoAMP_Vulnerability[1]_groups[0]_description",
"guid": "CiscoAMP_Vulnerability[1]_groups[0]_guid",
"name": "CiscoAMP_Vulnerability[1]_groups[0]_name"
}
],
"latest_date": "CiscoAMP_Vulnerability[1]_latest_date",
"latest_timestamp": "CiscoAMP_Vulnerability[1]_latest_timestamp",
"version": "CiscoAMP_Vulnerability[1]_version"
},
{
"application": "CiscoAMP_Vulnerability[2]_application",
"computers": [
{
"active": "CiscoAMP_Vulnerability[2]_computers[0]_active",
"connector_guid": "CiscoAMP_Vulnerability[2]_computers[0]_connector_guid",
"hostname": "CiscoAMP_Vulnerability[2]_computers[0]_hostname",
"windows_processor_id": "CiscoAMP_Vulnerability[2]_computers[0]_windows_processor_id"
}
],
"computers_total_count": "CiscoAMP_Vulnerability[2]_computers_total_count",
"cves": [
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[0]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[0]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[0]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[1]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[1]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[1]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[2]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[2]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[2]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[3]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[3]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[3]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[4]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[4]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[4]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[5]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[5]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[5]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[6]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[6]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[6]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[7]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[7]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[7]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[8]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[8]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[8]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[9]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[9]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[9]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[10]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[10]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[10]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[11]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[11]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[11]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[12]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[12]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[12]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[13]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[13]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[13]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[14]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[14]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[14]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[15]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[15]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[15]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[16]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[16]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[16]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[17]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[17]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[17]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[18]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[18]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[18]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[19]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[19]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[19]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[20]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[20]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[20]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[21]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[21]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[21]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[22]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[22]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[22]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[23]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[23]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[23]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[24]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[24]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[24]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[25]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[25]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[25]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[26]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[26]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[26]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[27]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[27]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[27]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[28]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[28]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[28]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[29]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[29]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[29]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[30]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[30]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[30]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[31]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[31]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[31]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[32]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[32]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[32]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[33]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[33]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[33]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[34]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[34]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[34]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[35]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[35]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[35]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[36]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[36]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[36]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[37]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[37]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[37]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[38]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[38]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[38]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[39]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[39]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[39]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[40]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[40]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[40]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[41]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[41]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[41]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[42]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[42]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[42]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[43]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[43]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[43]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[44]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[44]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[44]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[45]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[45]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[45]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[46]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[46]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[46]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[47]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[47]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[47]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[48]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[48]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[48]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[49]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[49]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[49]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[50]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[50]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[50]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[51]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[51]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[51]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[52]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[52]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[52]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[53]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[53]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[53]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[54]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[54]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[54]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[55]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[55]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[55]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[56]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[56]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[56]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[57]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[57]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[57]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[58]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[58]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[58]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[59]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[59]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[59]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[60]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[60]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[60]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[61]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[61]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[61]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[62]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[62]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[62]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[63]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[63]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[63]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[64]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[64]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[64]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[65]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[65]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[65]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[66]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[66]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[66]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[67]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[67]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[67]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[68]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[68]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[68]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[69]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[69]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[69]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[70]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[70]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[70]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[71]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[71]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[71]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[72]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[72]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[72]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[73]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[73]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[73]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[74]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[74]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[74]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[75]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[75]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[75]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[76]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[76]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[76]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[77]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[77]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[77]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[78]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[78]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[78]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[79]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[79]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[79]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[80]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[80]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[80]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[81]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[81]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[81]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[82]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[82]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[82]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[83]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[83]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[83]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[84]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[84]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[84]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[85]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[85]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[85]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[86]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[86]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[86]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[87]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[87]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[87]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[88]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[88]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[88]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[89]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[89]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[89]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[90]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[90]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[90]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[91]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[91]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[91]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[92]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[92]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[92]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[93]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[93]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[93]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[94]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[94]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[94]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[95]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[95]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[95]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[96]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[96]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[96]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[97]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[97]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[97]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[2]_cves[98]_cvss",
"id": "CiscoAMP_Vulnerability[2]_cves[98]_id",
"link": "CiscoAMP_Vulnerability[2]_cves[98]_link"
}
],
"file": {
"filename": "CiscoAMP_Vulnerability[2]_file_filename",
"identity": {
"sha256": "CiscoAMP_Vulnerability[2]_file_identity_sha256"
}
},
"groups": [
{
"description": "CiscoAMP_Vulnerability[2]_groups[0]_description",
"guid": "CiscoAMP_Vulnerability[2]_groups[0]_guid",
"name": "CiscoAMP_Vulnerability[2]_groups[0]_name"
}
],
"latest_date": "CiscoAMP_Vulnerability[2]_latest_date",
"latest_timestamp": "CiscoAMP_Vulnerability[2]_latest_timestamp",
"version": "CiscoAMP_Vulnerability[2]_version"
},
{
"application": "CiscoAMP_Vulnerability[3]_application",
"computers": [
{
"active": "CiscoAMP_Vulnerability[3]_computers[0]_active",
"connector_guid": "CiscoAMP_Vulnerability[3]_computers[0]_connector_guid",
"hostname": "CiscoAMP_Vulnerability[3]_computers[0]_hostname",
"windows_processor_id": "CiscoAMP_Vulnerability[3]_computers[0]_windows_processor_id"
},
{
"active": "CiscoAMP_Vulnerability[3]_computers[1]_active",
"connector_guid": "CiscoAMP_Vulnerability[3]_computers[1]_connector_guid",
"hostname": "CiscoAMP_Vulnerability[3]_computers[1]_hostname",
"windows_processor_id": "CiscoAMP_Vulnerability[3]_computers[1]_windows_processor_id"
}
],
"computers_total_count": "CiscoAMP_Vulnerability[3]_computers_total_count",
"cves": [
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[0]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[0]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[0]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[1]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[1]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[1]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[2]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[2]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[2]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[3]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[3]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[3]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[4]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[4]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[4]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[5]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[5]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[5]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[6]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[6]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[6]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[7]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[7]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[7]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[8]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[8]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[8]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[9]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[9]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[9]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[10]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[10]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[10]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[11]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[11]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[11]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[12]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[12]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[12]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[13]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[13]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[13]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[14]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[14]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[14]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[15]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[15]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[15]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[16]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[16]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[16]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[17]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[17]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[17]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[18]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[18]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[18]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[19]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[19]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[19]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[20]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[20]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[20]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[21]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[21]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[21]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[22]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[22]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[22]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[23]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[23]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[23]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[24]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[24]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[24]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[25]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[25]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[25]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[26]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[26]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[26]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[27]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[27]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[27]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[28]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[28]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[28]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[29]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[29]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[29]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[30]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[30]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[30]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[31]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[31]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[31]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[32]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[32]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[32]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[33]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[33]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[33]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[34]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[34]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[34]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[35]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[35]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[35]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[36]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[36]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[36]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[37]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[37]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[37]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[38]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[38]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[38]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[39]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[39]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[39]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[40]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[40]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[40]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[41]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[41]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[41]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[42]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[42]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[42]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[43]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[43]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[43]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[44]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[44]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[44]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[45]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[45]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[45]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[46]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[46]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[46]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[47]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[47]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[47]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[48]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[48]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[48]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[49]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[49]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[49]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[50]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[50]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[50]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[51]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[51]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[51]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[52]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[52]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[52]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[3]_cves[53]_cvss",
"id": "CiscoAMP_Vulnerability[3]_cves[53]_id",
"link": "CiscoAMP_Vulnerability[3]_cves[53]_link"
}
],
"file": {
"filename": "CiscoAMP_Vulnerability[3]_file_filename",
"identity": {
"sha256": "CiscoAMP_Vulnerability[3]_file_identity_sha256"
}
},
"groups": [
{
"description": "CiscoAMP_Vulnerability[3]_groups[0]_description",
"guid": "CiscoAMP_Vulnerability[3]_groups[0]_guid",
"name": "CiscoAMP_Vulnerability[3]_groups[0]_name"
},
{
"description": "CiscoAMP_Vulnerability[3]_groups[1]_description",
"guid": "CiscoAMP_Vulnerability[3]_groups[1]_guid",
"name": "CiscoAMP_Vulnerability[3]_groups[1]_name"
}
],
"latest_date": "CiscoAMP_Vulnerability[3]_latest_date",
"latest_timestamp": "CiscoAMP_Vulnerability[3]_latest_timestamp",
"version": "CiscoAMP_Vulnerability[3]_version"
},
{
"application": "CiscoAMP_Vulnerability[4]_application",
"computers": [
{
"active": "CiscoAMP_Vulnerability[4]_computers[0]_active",
"connector_guid": "CiscoAMP_Vulnerability[4]_computers[0]_connector_guid",
"hostname": "CiscoAMP_Vulnerability[4]_computers[0]_hostname",
"windows_processor_id": "CiscoAMP_Vulnerability[4]_computers[0]_windows_processor_id"
}
],
"computers_total_count": "CiscoAMP_Vulnerability[4]_computers_total_count",
"cves": [
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[0]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[0]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[0]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[1]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[1]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[1]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[2]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[2]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[2]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[3]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[3]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[3]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[4]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[4]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[4]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[5]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[5]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[5]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[6]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[6]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[6]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[7]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[7]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[7]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[8]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[8]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[8]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[9]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[9]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[9]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[10]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[10]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[10]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[11]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[11]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[11]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[12]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[12]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[12]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[13]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[13]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[13]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[4]_cves[14]_cvss",
"id": "CiscoAMP_Vulnerability[4]_cves[14]_id",
"link": "CiscoAMP_Vulnerability[4]_cves[14]_link"
}
],
"file": {
"filename": "CiscoAMP_Vulnerability[4]_file_filename",
"identity": {
"sha256": "CiscoAMP_Vulnerability[4]_file_identity_sha256"
}
},
"groups": [
{
"description": "CiscoAMP_Vulnerability[4]_groups[0]_description",
"guid": "CiscoAMP_Vulnerability[4]_groups[0]_guid",
"name": "CiscoAMP_Vulnerability[4]_groups[0]_name"
}
],
"latest_date": "CiscoAMP_Vulnerability[4]_latest_date",
"latest_timestamp": "CiscoAMP_Vulnerability[4]_latest_timestamp",
"version": "CiscoAMP_Vulnerability[4]_version"
},
{
"application": "CiscoAMP_Vulnerability[5]_application",
"computers": [
{
"active": "CiscoAMP_Vulnerability[5]_computers[0]_active",
"connector_guid": "CiscoAMP_Vulnerability[5]_computers[0]_connector_guid",
"hostname": "CiscoAMP_Vulnerability[5]_computers[0]_hostname",
"windows_processor_id": "CiscoAMP_Vulnerability[5]_computers[0]_windows_processor_id"
}
],
"computers_total_count": "CiscoAMP_Vulnerability[5]_computers_total_count",
"cves": [
{
"cvss": "CiscoAMP_Vulnerability[5]_cves[0]_cvss",
"id": "CiscoAMP_Vulnerability[5]_cves[0]_id",
"link": "CiscoAMP_Vulnerability[5]_cves[0]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[5]_cves[1]_cvss",
"id": "CiscoAMP_Vulnerability[5]_cves[1]_id",
"link": "CiscoAMP_Vulnerability[5]_cves[1]_link"
}
],
"file": {
"filename": "CiscoAMP_Vulnerability[5]_file_filename",
"identity": {
"sha256": "CiscoAMP_Vulnerability[5]_file_identity_sha256"
}
},
"groups": [
{
"description": "CiscoAMP_Vulnerability[5]_groups[0]_description",
"guid": "CiscoAMP_Vulnerability[5]_groups[0]_guid",
"name": "CiscoAMP_Vulnerability[5]_groups[0]_name"
}
],
"latest_date": "CiscoAMP_Vulnerability[5]_latest_date",
"latest_timestamp": "CiscoAMP_Vulnerability[5]_latest_timestamp",
"version": "CiscoAMP_Vulnerability[5]_version"
},
{
"application": "CiscoAMP_Vulnerability[6]_application",
"computers": [
{
"active": "CiscoAMP_Vulnerability[6]_computers[0]_active",
"connector_guid": "CiscoAMP_Vulnerability[6]_computers[0]_connector_guid",
"hostname": "CiscoAMP_Vulnerability[6]_computers[0]_hostname",
"windows_processor_id": "CiscoAMP_Vulnerability[6]_computers[0]_windows_processor_id"
}
],
"computers_total_count": "CiscoAMP_Vulnerability[6]_computers_total_count",
"cves": [
{
"cvss": "CiscoAMP_Vulnerability[6]_cves[0]_cvss",
"id": "CiscoAMP_Vulnerability[6]_cves[0]_id",
"link": "CiscoAMP_Vulnerability[6]_cves[0]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[6]_cves[1]_cvss",
"id": "CiscoAMP_Vulnerability[6]_cves[1]_id",
"link": "CiscoAMP_Vulnerability[6]_cves[1]_link"
}
],
"file": {
"filename": "CiscoAMP_Vulnerability[6]_file_filename",
"identity": {
"sha256": "CiscoAMP_Vulnerability[6]_file_identity_sha256"
}
},
"groups": [
{
"description": "CiscoAMP_Vulnerability[6]_groups[0]_description",
"guid": "CiscoAMP_Vulnerability[6]_groups[0]_guid",
"name": "CiscoAMP_Vulnerability[6]_groups[0]_name"
}
],
"latest_date": "CiscoAMP_Vulnerability[6]_latest_date",
"latest_timestamp": "CiscoAMP_Vulnerability[6]_latest_timestamp",
"version": "CiscoAMP_Vulnerability[6]_version"
},
{
"application": "CiscoAMP_Vulnerability[7]_application",
"computers": [
{
"active": "CiscoAMP_Vulnerability[7]_computers[0]_active",
"connector_guid": "CiscoAMP_Vulnerability[7]_computers[0]_connector_guid",
"hostname": "CiscoAMP_Vulnerability[7]_computers[0]_hostname",
"windows_processor_id": "CiscoAMP_Vulnerability[7]_computers[0]_windows_processor_id"
}
],
"computers_total_count": "CiscoAMP_Vulnerability[7]_computers_total_count",
"cves": [
{
"cvss": "CiscoAMP_Vulnerability[7]_cves[0]_cvss",
"id": "CiscoAMP_Vulnerability[7]_cves[0]_id",
"link": "CiscoAMP_Vulnerability[7]_cves[0]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[7]_cves[1]_cvss",
"id": "CiscoAMP_Vulnerability[7]_cves[1]_id",
"link": "CiscoAMP_Vulnerability[7]_cves[1]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[7]_cves[2]_cvss",
"id": "CiscoAMP_Vulnerability[7]_cves[2]_id",
"link": "CiscoAMP_Vulnerability[7]_cves[2]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[7]_cves[3]_cvss",
"id": "CiscoAMP_Vulnerability[7]_cves[3]_id",
"link": "CiscoAMP_Vulnerability[7]_cves[3]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[7]_cves[4]_cvss",
"id": "CiscoAMP_Vulnerability[7]_cves[4]_id",
"link": "CiscoAMP_Vulnerability[7]_cves[4]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[7]_cves[5]_cvss",
"id": "CiscoAMP_Vulnerability[7]_cves[5]_id",
"link": "CiscoAMP_Vulnerability[7]_cves[5]_link"
},
{
"cvss": "CiscoAMP_Vulnerability[7]_cves[6]_cvss",
"id": "CiscoAMP_Vulnerability[7]_cves[6]_id",
"link": "CiscoAMP_Vulnerability[7]_cves[6]_link"
}
],
"file": {
"filename": "CiscoAMP_Vulnerability[7]_file_filename",
"identity": {
"sha256": "CiscoAMP_Vulnerability[7]_file_identity_sha256"
}
},
"groups": [
{
"description": "CiscoAMP_Vulnerability[7]_groups[0]_description",
"guid": "CiscoAMP_Vulnerability[7]_groups[0]_guid",
"name": "CiscoAMP_Vulnerability[7]_groups[0]_name"
}
],
"latest_date": "CiscoAMP_Vulnerability[7]_latest_date",
"latest_timestamp": "CiscoAMP_Vulnerability[7]_latest_timestamp",
"version": "CiscoAMP_Vulnerability[7]_version"
}
]
}
}
Human Readable Output
Results
Current Item Count Index Items Per Page Total 8 0 100 8 Vulnerabilities Information
Application Version Latest Date File Name SHA-256 Mozilla Firefox 41.0 2022-10-25T12:20:00+00:00 firefox.exe 4312CDB2EAD8FD8D2DD6D8D716F3B6E9717B3D7167A2A0495E4391312102170F Adobe Flash Player 11.5.502.146 2022-10-25T12:05:49+00:00 FlashPlayerApp.exe c1219f0799e60ff48a9705b63c14168684aed911610fec68548ea08f605cc42b Oracle Java(TM) Platform SE 1.7.0:update_10 2022-10-25T12:05:05+00:00 java.exe 0b4eefc0d815ac0fdc20f22add8fd2d8113be99578a4e5189122b28b201ccbd9 Adobe Acrobat Reader IP 2022-10-25T12:02:34+00:00 AcroRd32.exe 825b7b20a913f26641c012f1cb61b81d29033f142ba6c6734425de06432e4f82 Microsoft Office 2013 2022-10-23T12:37:33+00:00 WINWORD.EXE 3D46E95284F93BBB76B3B7E1BF0E1B2D51E8A9411C2B6E649112F22F92DE63C2 Microsoft Internet Explorer 11 2022-10-04T07:02:27+00:00 mshtml.dll D1BEA74AC9D85B3DCD4ABC1AF42AF6C37B9349DEFC8E6577993611B773F56CA0 Microsoft Internet Explorer 11 2022-10-04T07:02:26+00:00 mshtml.dll 1DC5D15A26A79BB46519952A60B15AA4ACB36F6CE3247EBF50DF9C157BC4FCF4 Microsoft Office 2016 2022-10-04T06:32:53+00:00 OUTLOOK.EXE 465F398AE8E3C32395EB7C04BC8CD24595068E6A127E243BED3E9B4931556BFC
endpoint
Returns information about an endpoint.
Base Command
endpoint
Input
| Argument Name | Description | Required |
|---|---|---|
| id | The endpoint ID. Takes priority over the IP and hostname arguments. | Optional |
| ip | The endpoint IP address. The IP argument has priority over the hostname argument. | Optional |
| hostname | The endpoint hostname. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Endpoint.Hostname | String | The hostname of the endpoint. |
| Endpoint.ID | String | The endpoint’s identifier. |
| Endpoint.IPAddress | String | The endpoint’s IP address. |
| Endpoint.OS | String | The endpoint’s operating system. |
| Endpoint.OSVersion | String | The endpoint’s operating system’s version. |
| Endpoint.Status | String | The status of the endpoint (online/offline). |
| Endpoint.MACAddress | String | The endpoint’s MAC address. |
| Endpoint.Vendor | String | The integration name of the endpoint vendor. |
Command example
!endpoint id=22d4a486-1732-4f8b-9a6f-18f172fe7af0
Context Example
{
"Endpoint": {
"Hostname": "Endpoint_Hostname",
"ID": "Endpoint_ID",
"IPAddress": "Endpoint_IPAddress",
"MACAddress": "Endpoint_MACAddress",
"OS": "Endpoint_OS",
"OSVersion": "Endpoint_OSVersion",
"Status": "Endpoint_Status",
"Vendor": "Endpoint_Vendor"
}
}
Human Readable Output
CiscoAMP - Endpoint Demo_AMP
Hostname ID IPAddress MACAddress OS OSVersion Status Vendor Demo_AMP 22d4a486-1732-4f8b-9a6f-18f172fe7af0 IP e6:80:50:1e:e5:20 Windows 10 10.0.19044.1466 Online CiscoAMP Response
file
Runs reputation on files.
Base Command
file
Input
| Argument Name | Description | Required |
|---|---|---|
| file | Hash of the file to query. Supports MD5, SHA1, and SHA256. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| File.MD5 | String | The MD5 hash of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.Name | String | The full file name (including file extension). |
| File.Path | String | The path where the file is located. |
| File.Hostname | String | The name of the host where the file was found. |
| File.Malicious.Vendor | String | The vendor that reported the file as malicious. |
| File.Malicious.Description | String | A description of why the file was determined to be malicious. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Reliability | String | Reliability of the source providing the intelligence data. |
| DBotScore.Score | Number | The actual score. |
Command example
!file file=ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
Context Example
{
"DBotScore": [
{
"Indicator": "DBotScore[0]_Indicator",
"Reliability": "DBotScore[0]_Reliability",
"Score": "DBotScore[0]_Score",
"Type": "DBotScore[0]_Type",
"Vendor": "DBotScore[0]_Vendor"
},
{
"Indicator": "DBotScore[1]_Indicator",
"Reliability": "DBotScore[1]_Reliability",
"Score": "DBotScore[1]_Score",
"Type": "DBotScore[1]_Type",
"Vendor": "DBotScore[1]_Vendor"
},
{
"Indicator": "DBotScore[2]_Indicator",
"Reliability": "DBotScore[2]_Reliability",
"Score": "DBotScore[2]_Score",
"Type": "DBotScore[2]_Type",
"Vendor": "DBotScore[2]_Vendor"
},
{
"Indicator": "DBotScore[3]_Indicator",
"Reliability": "DBotScore[3]_Reliability",
"Score": "DBotScore[3]_Score",
"Type": "DBotScore[3]_Type",
"Vendor": "DBotScore[3]_Vendor"
},
{
"Indicator": "DBotScore[4]_Indicator",
"Reliability": "DBotScore[4]_Reliability",
"Score": "DBotScore[4]_Score",
"Type": "DBotScore[4]_Type",
"Vendor": "DBotScore[4]_Vendor"
},
{
"Indicator": "DBotScore[5]_Indicator",
"Reliability": "DBotScore[5]_Reliability",
"Score": "DBotScore[5]_Score",
"Type": "DBotScore[5]_Type",
"Vendor": "DBotScore[5]_Vendor"
},
{
"Indicator": "DBotScore[6]_Indicator",
"Reliability": "DBotScore[6]_Reliability",
"Score": "DBotScore[6]_Score",
"Type": "DBotScore[6]_Type",
"Vendor": "DBotScore[6]_Vendor"
}
],
"File": [
{
"DetectionEngines": "File[0]_DetectionEngines",
"MD5": "File[0]_MD5",
"PositiveDetections": "File[0]_PositiveDetections",
"SHA1": "File[0]_SHA1",
"SHA256": "File[0]_SHA256",
"VirusTotal": {
"ScanID": "File[0]_VirusTotal_ScanID",
"vtLink": "File[0]_VirusTotal_vtLink"
}
},
{
"Hashes": [
{
"type": "File[1]_Hashes[0]_type",
"value": "File[1]_Hashes[0]_value"
}
],
"Hostname": "File[1]_Hostname",
"Name": "File[1]_Name",
"SHA256": "File[1]_SHA256"
}
]
}
Human Readable Output
Cisco AMP - Hash Reputation for: 4312CDB2EAD8FD8D2DD6D8D716F3B6E9717B3D7167A2A0495E4391312102170F
Hashes Hostname Name SHA256 {‘type’: ‘SHA256’, ‘value’: ‘4312CDB2EAD8FD8D2DD6D8D716F3B6E9717B3D7167A2A0495E4391312102170F’} Demo_AMP_Exploit_Prevention firefox.exe 4312CDB2EAD8FD8D2DD6D8D716F3B6E9717B3D7167A2A0495E4391312102170F
Configuration parameters
server_url— Server URL (required)credentials— Third Party API Client ID (required)insecure— Trust any certificate (not secure)integrationReliability— Source Reliability (required)proxy— Use system proxy settingsmax_fetch— Maximum incidents to fetch.incident_severities— Incident severity to fetch.first_fetch— First fetch timeevent_types— Event typesincidentType— Incident typeisFetch— Fetch incidents
Commands (30)
-
cisco-amp-app-trajectory-query-listRetrieve app_trajectory queries for a given IOS bundle ID.
-
cisco-amp-computer-activity-listFetch a list of computers that have observed files with a given file name. Provides the ability to search all computers across an organization for any events or activities associated with a file or network operation, and returns computers matching those criteria. There is a hard limit of 5000 historical entries searched.
-
cisco-amp-computer-deleteDeletes a specific computer with given connector_guid.
-
cisco-amp-computer-isolation-createRequest isolation for a computer. Supports polling. Isolation must be enabled within the computer's policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation.
-
cisco-amp-computer-isolation-deleteRequest isolation stop for a computer. Supports polling. Isolation must be enabled within the computer's policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation.
-
cisco-amp-computer-isolation-feature-availability-getPerforms a feature availability request on a computer. Isolation must be enabled within the computer's policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation.
-
cisco-amp-computer-isolation-getReturns a fine-grained isolation status for a computer. The available flag is set to true if isolation can be performed on the computer. Status will be set to one of - not_isolated, pending_start, isolated and pending_stop. Isolation must be enabled within the computer's policy. This can be done through the instance. Log in to your account -> Management -> Policies -> Choose the relevant policy -> Edit -> Advanced Settings -> Endpoint Isolation -> Allow Endpoint Isolation.
-
cisco-amp-computer-listFetch computers to show information about them. Can be filtered by a variety of criteria.
-
cisco-amp-computer-moveMoves a computer to a group with the given connector_guid and group_guid.
-
cisco-amp-computer-trajectory-listProvides a list of all activities associated with a particular computer. This is analogous to the Device Trajectory on the FireAMP console.
-
cisco-amp-computer-user-activity-listFetch a list of computers that have observed activity by the given username.
-
cisco-amp-computer-user-trajectory-listFetch a specific computer's trajectory with a given connector GUID and filter for events with user name activity.
-
cisco-amp-computer-vulnerabilities-listProvides a list of vulnerabilities observed on a specific computer. The vulnerabilities can be filtered to show only vulnerable applications observed for a specific time range.
-
cisco-amp-event-listFetch a list of events that can be filtered by a variety of criteria. Each criteria type is logically ANDed with the other criteria, and each selection of a criteria is logically ORed. This is analogous to the Events view on the FireAMP Console.
-
cisco-amp-event-type-listFetches a list of event types. Events are identified and filtered by a unique ID.
-
cisco-amp-file-list-item-createCreates a file list item with a given SHA-256 for a specific file list with a given file_list_guid.
-
cisco-amp-file-list-item-deleteDeletes a file list item with a given SHA-256 and associated to a file list with a given file_list_guid.
-
cisco-amp-file-list-item-listReturns a list of items for a particular file_list. file_list_guid must be provided to retrieve these items. A particular item can be returned by providing a SHA-256.
-
cisco-amp-file-list-listReturns a particular file list for application blocking or simple custom detection. file_list_guid must be provided to retrieve information about a particular file_list. Can fetch an application_blocking or simple_custom_detection file list. Defaults to application_blocking.
-
cisco-amp-group-createCreates a new group along with a group name or description.
-
cisco-amp-group-deleteDestroys a group with a given GUID.
-
cisco-amp-group-listProvides information about groups in an organization.
-
cisco-amp-group-parent-updateConverts an existing group to a child of another group or an existing child group to a root group (that is, one with no parent groups).
-
cisco-amp-group-policy-updateUpdates a group to a given policy and returns all the policies in that group.
-
cisco-amp-indicator-listShow information about indicators.
-
cisco-amp-policy-listGets information about policies by filtering with a product and name of a specific policy with a policy_guid.
-
cisco-amp-version-getGet API version.
-
cisco-amp-vulnerability-listFetch a list of vulnerabilities. This is analogous to the Vulnerable Software view on the AMP for Endpoints Console. The list can be filtered to show only the vulnerable programs detected for a specific time range. Provide a list of computers on which the vulnerability has been observed with given SHA-256. The list item contains a summary of information on the vulnerability, including: application name and version, SHA-256 value for the executable file, connectors on which the vulnerable application was observed and the most recent CVSS score. IMPORTANT: computers key returns information about the last 1000 Connectors on which the vulnerable application was observed.
-
endpointReturns information about an endpoint.
-
fileRuns reputation on files.
import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 """ ██████ ███████ ██████ ██████ ███████ ██████ █████ ████████ ███████ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ █████ ██████ ██████ █████ ██ ███████ ██ █████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██████ ███████ ██ ██ ██ ███████ ██████ ██ ██ ██ ███████ ██████ THIS INTEGRATION/PACK IS DEPRECATED - USE THE AMPv2 INTEGRATION FROM THE AMP PACK RATHER THAN CiscoAMP. The AMP pack is maintained and receives bug fixes, while the CiscoAMP pack is not. """ import copy import math from typing import Callable, Dict, Any, MutableMapping, MutableSequence, Tuple, Optional from http import HTTPStatus from collections import namedtuple from CommonServerUserPython import * # pylint: disable=wildcard-import """ GLOBAL/PARAMS """ # pylint: disable=pointless-string-statement DEFAULT_INTERVAL = 30 DEFAULT_TIMEOUT = 600 FETCH_LIMIT = 200 MAX_PAGE_SIZE = 100 FILENAME_REGEX = r"[\w\-\.]+[\w\-\. ]*" ISO_8601_FORMAT = "%Y-%m-%dT%H:%M:%S.000Z" XSOAR_SEVERITY_BY_AMP_SEVERITY = { "Low": IncidentSeverity.LOW, "Medium": IncidentSeverity.MEDIUM, "High": IncidentSeverity.HIGH, "Critical": IncidentSeverity.CRITICAL, } PAGINATION_FIELDS = ( "page", "page_size", "limit", "offset", "number_of_requests", "offset_multiplier", "is_automatic", "is_manual", ) Pagination = namedtuple( "Pagination", ( "page", "page_size", "limit", "offset", "number_of_requests", "offset_multiplier", "is_automatic", "is_manual", ), defaults=(None, None, None, None, None, None, None, None), ) TRAJECTORY_TITLE = "Event Information" TRAJECTORY_HEADERS_BY_KEYS = { "ID": ["id"], "Date": ["date"], "Event Type": ["event_type"], "Detection": ["detection"], "Severity": ["severity"], "Group GUIDs": ["group_guids"], } ACTIVITY_TITLE = "Activity Information" ACTIVITY_HEADERS_BY_KEYS = { "Connector GUID": ["connector_guid"], "Host Name": ["hostname"], "Windows Processor ID": ["windows_processor_id"], "Active": ["active"], } VULNERABILITY_TITLE = "Vulnerabilities Information" VULNERABILITY_HEADERS_BY_KEYS = { "Application": ["application"], "Version": ["version"], "Latest Date": ["latest_date"], "File Name": ["file", "filename"], "SHA-256": ["file", "identity", "sha256"], } EVENT_TYPE_TITLE = "Event Type Information" EVENT_TYPE_HEADERS_BY_KEYS = { "ID": ["id"], "Name": ["name"], "Description": ["description"], } EVENT_TITLE = "Event Information" EVENT_HEADERS_BY_KEYS = { "ID": ["id"], "Date": ["date"], "Event Type": ["event_type"], "Detection": ["detection"], "Connector GUID": ["connector_guid"], "Severity": ["severity"], } GROUPS_TITLE = "Groups Information" GROUPS_HEADERS_BY_KEYS = { "Name": ["name"], "Description": ["description"], "GUID": ["guid"], "Source": ["source"], } GROUP_TITLE = "Group Information" GROUP_HEADERS_BY_KEYS = { "Name": ["name"], "Description": ["description"], "Creator": ["creator"], "Created At": ["created_at"], "Computers Count": ["computers_count"], "Descendant Computers Count": ["descendant_computers_count"], } VULNERABLE_COMPUTER_TITLE = "Vulnerable Computers Information" VULNERABLE_COMPUTER_HEADERS_BY_KEYS = { "Connector GUID": ["connector_guid"], "Hostname": ["hostname"], "Windows Processor ID": ["windows_processor_id"], "Active": ["active"], "Group GUID": ["group_guid"], } POLICY_TITLE = "Policy Information" POLICY_HEADERS_BY_KEYS = { "GUID": ["guid"], "Name": ["name"], "Description": ["description"], "Product": ["product"], "Serial Number": ["serial_number"], } FILE_LIST_TITLE = "File List Information" FILE_LIST_HEADERS_BY_KEYS = { "GUID": ["guid"], "Name": ["name"], "Type": ["type"], } FILE_LIST_ITEM_TITLE = "File List Item Information" FILE_LIST_ITEM_HEADERS_BY_KEYS = { "SHA-256": ["sha256"], "Source": ["source"], "Description": ["description"], } ISOLATION_TITLE = "Isolation Information" ISOLATION_HEADERS_BY_KEYS = { "Available": ["available"], "Status": ["status"], "Unlock Code": ["unlock_code"], "Comment": ["comment"], "Isolated By": ["isolated_by"], } APP_TRAJECTORY_TITLE = "App Trajectory Information" APP_TRAJECTORY_HEADERS_BY_KEYS = { "Connector GUID": ["connector_guid"], "Date": ["date"], "Query Type": ["query_type"], "Dirty URL": ["network_info", "dirty_url"], } INDICATOR_TITLE = "Indicator Information" INDICATOR_HEADERS_BY_KEYS = { "GUID": ["guid"], "Name": ["name"], "Description": ["description"], "Severity": ["severity"], "Observed Compromises": ["observed_compromises"], } MITRE_TACTIC_TITLE = "Mitre Tactic Information" MITRE_TECHNIQUE_TITLE = "Mitre Technique Information" MITRE_HEADERS_BY_KEYS = { "External ID": ["external_id"], "Name": ["name"], "Mitre URL": ["mitre_url"], } """ CLIENT CLASS """ class Client(BaseClient): """ API Client to communicate with CiscoAMP API. """ API_VERSION = "v1" def __init__( self, server_url: str, api_key: str, client_id: str, reliability: str, verify: bool = False, proxy: bool = False, ): """ Build URL with authorization arguments to provide the required Basic Authentication. Args: server_url (str): CiscoAMP API URL. api_key (str): API key to connect to the server. client_id (str): 3rd Party API Client ID. reliability (str): Reliability of the source providing the intelligence data. verify (bool, optional): SSL verification handled by BaseClient. Defaults to False. proxy (bool, optional): System proxy is handled by BaseClient. Defaults to False. """ super().__init__( base_url=urljoin(server_url, self.API_VERSION), verify=verify, proxy=proxy, auth=(client_id, api_key), ) self.reliability = reliability def computer_list_request( self, limit: int = None, offset: int = None, hostnames: List[str] = None, internal_ip: str = None, external_ip: str = None, group_guids: List[str] = None, last_seen_within: int = None, last_seen_over: int = None, ) -> Dict[str, Any]: """ Return a single computer with a connector_guid or a list filtered by the other arguments. Args: limit (int, optional): Maximum number of items to return. Defaults to None. offset (int, optional): Item number to start looking from. Defaults to None. hostnames (List[str], optional): Hostname to filter by. Defaults to None. internal_ip (str, optional): Internal IP to filter by. Defaults to None. external_ip (str, optional): External IP to filter by. Defaults to None. group_guid (List[str], optional): Group GUID to filter by. Defaults to None. last_seen_within (str, optional): Number of days the last time the computer has been seen within. Defaults to None. last_seen_over (str, optional): Number of days the last time the computer has been seen. Defaults to None. Returns: Dict[str, Any]: Information about a list of computers or a single computer. """ params = remove_empty_elements( { "limit": limit, "offset": offset, "hostname[]": hostnames, "internal_ip": internal_ip, "external_ip": external_ip, "group_guid[]": group_guids, "last_seen_within": last_seen_within, "last_seen_over": last_seen_over, } ) return self._http_request( method="GET", url_suffix="/computers", params=params, ) def computer_get_request( self, connector_guid: str, ) -> Dict[str, Any]: """ Return a single computer with a connector_guid. Args: connector_guid (str): Specific computer to return. Returns: Dict[str, Any]: Information about a computer. """ return self._http_request( method="GET", url_suffix=f"/computers/{connector_guid}", ) def computer_trajectory_list_request( self, connector_guid: str, limit: int = None, query_string: str = None ) -> Dict[str, Any]: """ Get information about a computer and its trajectory which be set in a list of events. Args: connector_guid (str): Specific computer to return. limit (int, optional): Maximum number of items to return. Defaults to None. query_string (str, optional): Freeform query string which accepts: IP address, SHA-256 or URL. Defaults to None. Returns: Dict[str, Any]: Information about a computer and its trajectory. """ params = remove_empty_elements( { "limit": limit, "q": query_string, } ) return self._http_request( method="GET", url_suffix=f"/computers/{connector_guid}/trajectory", params=params, ) def computer_user_activity_get_request( self, username: str, limit: int = None, offset: int = None, ) -> Dict[str, Any]: """ Get computers that have observed activity by given username. Args: username (str): Username to filter by. limit (int, optional): Maximum number of items to return. Defaults to None. offset (int, optional): Item number to start looking from. Defaults to None. Returns: Dict[str, Any]: List of computers. """ params = remove_empty_elements( {"q": username, "limit": limit, "offset": offset} ) return self._http_request( method="GET", url_suffix="/computers/user_activity", params=params, ) def computer_user_trajectory_list_request( self, connector_guid: str, limit: int = None, username: str = None ) -> Dict[str, Any]: """ Get information about a computer and its trajectory which be set in a list of events. Args: connector_guid (str): Specific computer to return. limit (int, optional): Maximum number of items to return. Defaults to None. username (str, optional): Username to filter by. Defaults to None. Returns: Dict[str, Any]: Information about a computer and its trajectory. """ params = remove_empty_elements( { "limit": limit, "q": username, } ) return self._http_request( method="GET", url_suffix=f"/computers/{connector_guid}/user_trajectory", params=params, ) def computer_vulnerabilities_list_request( self, connector_guid: str, start_time: str = None, end_time: str = None, limit: int = None, offset: int = None, ) -> Dict[str, Any]: """ Return vulnerabilities observed on a specific computer. Args: connector_guid (str): Specific computer to return. start_time (str, optional): Inclusive, include vulnerable programs detected at start_time. Defaults to None. end_time (str, optional): Exclusive if end_time is a time, inclusive if end_time is a date, include vulnerable programs detected before end_time. Defaults to None. limit (int, optional): Maximum number of items to return. Defaults to None. offset (int, optional): Item number to start looking from. Defaults to None. Returns: Dict[str, Any]: Information about a computer and its vulnerabilities. """ params = remove_empty_elements( { "start_time": start_time, "end_time": end_time, "limit": limit, "offset": offset, } ) return self._http_request( method="GET", url_suffix=f"/computers/{connector_guid}/vulnerabilities", params=params, ) def computer_move_request( self, connector_guid: str, group_guid: str ) -> Dict[str, Any]: """ Moves the computer with the input connector_guid to a group with the input group_guid. Args: connector_guid (str): Connector GUID of the selected computer. group_guid (str): Group GUID of the group to move the computer to.s Returns: Dict[str, Any]: Information about the computer. """ return self._http_request( method="PATCH", url_suffix=f"/computers/{connector_guid}", json_data={ "group_guid": group_guid, }, ) def computer_delete_request(self, connector_guid: str) -> Dict[str, Any]: """ Deletes the computer with the connector_guid. Args: connector_guid (str): Connector GUID of the selected computer. Returns: Dict[str, Any]: Information about the delete operation, if it has succeeded. """ return self._http_request( method="DELETE", url_suffix=f"/computers/{connector_guid}", ) def computer_activity_list_request( self, query_string: str, limit: int = None, offset: str = None ) -> Dict[str, Any]: """ Get computers that have observed activity by given username. Args: query_string (str): Query string which accepts: IPv4 address, SHA-256, File Name and a URL Fragment. limit (int, optional): Maximum number of items to return. Defaults to None. offset (int, optional): Item number to start looking from. Defaults to None. Returns: Dict[str, Any]: List of computers. """ params = remove_empty_elements( { "q": query_string, "limit": limit, "offset": offset, } ) return self._http_request( method="GET", url_suffix="/computers/activity", params=params, ) def computer_isolation_feature_availability_get_request( self, connector_guid: str ) -> requests.Response: """ Get information about available options for a computer's isolation. Args: connector_guid (str): Computer to get information about. Returns: requests.Response: Information about a computer's isolation. """ return self._http_request( method="OPTIONS", url_suffix=f"/computers/{connector_guid}/isolation", resp_type="response", ) def computer_isolation_get_request(self, connector_guid: str) -> Dict[str, Any]: """ Get information about a computer's isolation. Args: connector_guid (str): Computer to get information about. Returns: Dict[str, Any]: Information about a computer's isolation. """ return self._http_request( method="GET", url_suffix=f"/computers/{connector_guid}/isolation", ) def computer_isolation_create_request( self, connector_guid: str, comment: str, unlock_code: str ) -> Dict[str, Any]: """ Put a computer in isolation. Args: connector_guid (str): Computer to put in isolation. comment (str): Computer to put in isolation. unlock_code (str): Unlock code. Returns: Dict[str, Any]: Information about the computer's isolation. """ body = remove_empty_elements( { "comment": comment, "unlock_code": unlock_code, } ) return self._http_request( method="PUT", url_suffix=f"/computers/{connector_guid}/isolation", json_data=body, ) def computer_isolation_delete_request( self, connector_guid: str, comment: str = None, ) -> Dict[str, Any]: """ Stop a computer in isolation. Args: connector_guid (str): Computer to put in isolation. comment (str): Computer to put in isolation. Defaults to None. Returns: Dict[str, Any]: Information about the computer's isolation. """ body = remove_empty_elements( { "comment": comment, } ) return self._http_request( method="DELETE", url_suffix=f"/computers/{connector_guid}/isolation", json_data=body, ) def event_list_request( self, detection_sha256: str = None, application_sha256: str = None, connector_guids: List[str] = None, group_guids: List[str] = None, start_date: str = None, event_types: List[int] = None, limit: int = None, offset: int = None, ) -> Dict[str, Any]: """ Get a list of events that can be filtered by the input parameters. Args: detection_sha256 (str, optional): Detection SHA-256 to filter by.. Defaults to None. application_sha256 (str, optional): Application SHA-256 to filter by. Defaults to None. connector_guids (List[str], optional): connector_guid for specific computer. Defaults to None. group_guids (List[str], optional): Group GUID to filter by. Defaults to None. start_date (str, optional): Fetch events that are newer than given time. Defaults to None. event_types (List[int], optional): Event type to filter by. Defaults to None. limit (int, optional): Maximum number of items to return. Defaults to None. offset (int, optional): Item number to start looking from. Defaults to None. Returns: Dict[str, Any]: A list of events. """ params = remove_empty_elements( { "detection_sha256": detection_sha256, "application_sha256": application_sha256, "connector_guid[]": connector_guids, "group_guid[]": group_guids, "start_date": start_date, "event_type[]": event_types, "limit": limit, "offset": offset, } ) return self._http_request( method="GET", url_suffix="/events", params=params, ) def event_type_list_request(self) -> Dict[str, Any]: """ Get a list of event types. Returns: Dict[str, Any]: List of event types. """ return self._http_request( method="GET", url_suffix="/event_types", ) def file_list_application_blocking_list_request( self, names: List[str] = None, limit: int = None, offset: int = None ) -> Dict[str, Any]: """ Get a file list of application blocking type. Args: names (List[str], optional): Name to filter by. Defaults to None. limit (int, optional): Maximum number of items to return. Defaults to None. offset (int, optional): Item number to start looking from. Defaults to None. Returns: Dict[str, Any]: File list of application blocking type. """ params = remove_empty_elements( { "name[]": names, "limit": limit, "offset": offset, } ) return self._http_request( method="GET", url_suffix="/file_lists/application_blocking", params=params, ) def file_list_get_request(self, file_list_guid: str) -> Dict[str, Any]: """ Get a file list. Args: file_list_guid (str): GUID of the file list to get. Returns: Dict[str, Any]: Information about a policy. """ return self._http_request( method="GET", url_suffix=f"/file_lists/{file_list_guid}", ) def file_list_simple_custom_detections_list_request( self, names: List[str] = None, limit: int = None, offset: int = None ) -> Dict[str, Any]: """ Get a file list of simple custom detections type. Args: names (List[str], optional): Name to filter by. Defaults to None. limit (int, optional): Maximum number of items to return. Defaults to None. offset (int, optional): Item number to start looking from. Defaults to None. Returns: Dict[str, Any]: File list of simple custom detections type. """ params = remove_empty_elements( { "name[]": names, "limit": limit, "offset": offset, } ) return self._http_request( method="GET", url_suffix="/file_lists/simple_custom_detections", params=params, ) def file_list_item_list_request( self, file_list_guid: str, limit: int = None, offset: int = None ) -> Dict[str, Any]: """ Get information about a file list items. Args: file_list_guid (str): GUID of the file list to get its items. limit (int, optional): Maximum number of items to return. Defaults to None. offset (int, optional): Item number to start looking from. Defaults to None. Returns: Dict[str, Any]: Information about a file list items. """ params = remove_empty_elements( { "limit": limit, "offset": offset, } ) return self._http_request( method="GET", url_suffix=f"/file_lists/{file_list_guid}/files", params=params, ) def file_list_item_get_request( self, file_list_guid: str, sha256: str ) -> Dict[str, Any]: """ Get information about a file list item. Args: file_list_guid (str): GUID of the file list to get its items. sha256 (str): sha256 of item to get. Returns: Dict[str, Any]: Information about a file list item. """ return self._http_request( method="GET", url_suffix=f"/file_lists/{file_list_guid}/files/{sha256}", ) def file_list_item_create_request( self, file_list_guid: str, sha256: str, description: str = None ) -> Dict[str, Any]: """ Create a new file list item. Args: file_list_guid (str): GUID of the file list to add the new item. sha256 (str): sha256 of the item to create. Returns: Dict[str, Any]: Information about the new file list item. """ body = remove_empty_elements( { "description": description, } ) return self._http_request( method="POST", url_suffix=f"/file_lists/{file_list_guid}/files/{sha256}", json_data=body, ) def file_list_item_delete_request( self, file_list_guid: str, sha256: str ) -> Dict[str, Any]: """ Delete an item from a file list item. Args: file_list_guid (str): GUID of the file list to delete item. sha256 (str): sha256 of the item to delete. Returns: Dict[str, Any]: Information about the deletion result. """ return self._http_request( method="DELETE", url_suffix=f"/file_lists/{file_list_guid}/files/{sha256}", ) def group_list_request( self, name: str = None, limit: int = None, offset: int = None ) -> Dict[str, Any]: """ Get a list of groups information that can be filtered by a name. Args: name (str, optional): Name to filter by. Defaults to None. limit (int, optional): Maximum number of items to return. Defaults to None. offset (int, optional): Item number to start looking from. Defaults to None. Returns: Dict[str, Any]: List of group information. """ params = remove_empty_elements( { "name": name, "limit": limit, "offset": offset, } ) return self._http_request( method="GET", url_suffix="/groups", params=params, ) def group_get_request(self, group_guid: str) -> Dict[str, Any]: """ Get information about a group. Args: group_guid (str): GUID of the group to get information about. Returns: Dict[str, Any]: Information about a group. """ return self._http_request( method="GET", url_suffix=f"/groups/{group_guid}", ) def group_policy_update_request( self, group_guid: str, windows_policy_guid: str = None, mac_policy_guid: str = None, android_policy_guid: str = None, linux_policy_guid: str = None, ) -> Dict[str, Any]: """ Update a group's Policy to given Policy GUID. Args: group_guid (str): The group to update. windows_policy_guid (str, optional): Policy GUID for Windows. Defaults to None. mac_policy_guid (str, optional): Policy GUID for MAC. Defaults to None. android_policy_guid (str, optional): Policy GUID for Android. Defaults to None. linux_policy_guid (str, optional): Policy GUID for Linux. Defaults to None. Returns: Dict[str, Any]: Information about the updated group. """ body = remove_empty_elements( { "windows_policy_guid": windows_policy_guid, "mac_policy_guid": mac_policy_guid, "android_policy_guid": android_policy_guid, "linux_policy_guid": linux_policy_guid, } ) return self._http_request( method="PATCH", url_suffix=f"groups/{group_guid}", json_data=body, ) def group_parent_update_request( self, child_guid: str, parent_group_guid: str = None, ) -> Dict[str, Any]: """ Converts an existing group to a child of another group or an existing child group to a root group (that is, one with no parent groups). Args: child_guid (str): Groups GUID to set as child or make as root. parent_group_guid (str, optional): Group parent to set to child group. Defaults to None. Returns: Dict[str, Any]: Information about the updated group. """ return self._http_request( method="PATCH", url_suffix=f"groups/{child_guid}/parent", json_data=remove_empty_elements({"parent_group_guid": parent_group_guid}), ) def group_create_request(self, name: str, description: str) -> Dict[str, Any]: """ Create a new group and get its information. Args: name (str): Name of the new group. description (str): Description of the new group. Returns: Dict[str, Any]: Information about the new group. """ body = { "name": name, "description": description, } return self._http_request( method="POST", url_suffix="/groups", json_data=body, ) def group_delete_request(self, group_guid: str) -> Dict[str, Any]: """ Deletes the group with the group_guid. Args: group_guid (str): Group GUID of the selected group to delete. Returns: Dict[str, Any]: Information about the delete operation, if it has succeeded. """ return self._http_request( method="DELETE", url_suffix=f"groups/{group_guid}", ) def indicator_get_request(self, indicator_guid: str) -> Dict[str, Any]: """ Get information about a indicator. Args: indicator_guid (str): GUID of the indicator to get. Returns: Dict[str, Any]: Information about a indicator. """ return self._http_request( method="GET", url_suffix=f"/indicators/{indicator_guid}", ) def indicator_list_request( self, limit: int = None, offset: int = None ) -> Dict[str, Any]: """ Get a list of indicators information. Args: limit (int, optional): Maximum number of items to return. Defaults to None. offset (int, optional): Item number to start looking from. Defaults to None. Returns: Dict[str, Any]: List of indicators information. """ params = remove_empty_elements( { "limit": limit, "offset": offset, } ) return self._http_request( method="GET", url_suffix="/indicators", params=params, ) def policy_list_request( self, products: List[str] = None, names: List[str] = None, limit: int = None, offset: int = None, ) -> Dict[str, Any]: """ Get a list of policies information. Args: product (List[str], optional): OS product to filter by. Defaults to None. name (List[str], optional): Name to filter by. Defaults to None. limit (int, optional): Maximum number of items to return. Defaults to None. offset (int, optional): Item number to start looking from. Defaults to None. Returns: Dict[str, Any]: List of policies information. """ params = remove_empty_elements( { "product[]": products, "name[]": names, "limit": limit, "offset": offset, } ) return self._http_request( method="GET", url_suffix="/policies", params=params, ) def policy_get_request(self, policy_guid: str) -> Dict[str, Any]: """ Get information about a policy. Args: policy_guid (str): GUID of the policy to get. Returns: Dict[str, Any]: Information about a policy. """ return self._http_request( method="GET", url_suffix=f"/policies/{policy_guid}", ) def app_trajectory_query_list_request(self, ios_bid: str) -> Dict[str, Any]: """ Get app trajectory query for a given IOS bundle ID. Args: ios_bid (str): IOS bundle ID. Returns: Dict[str, Any]: App Trajectory for IOS bundle ID. """ params = { "ios_bid": ios_bid, } return self._http_request( method="GET", url_suffix="/app_trajectory/queries", params=params ) def version_get_request(self) -> Dict[str, Any]: """ Get the current version of the API. Returns: Dict[str, Any]: Current version of the API. """ return self._http_request( method="GET", url_suffix="/version", ) def vulnerability_list_request( self, group_guids: List[str] = None, start_time: str = None, end_time: str = None, limit: int = None, offset: int = None, ) -> Dict[str, Any]: """ Get a list of vulnerabilities. Args: group_guids (List[str], optional): Group GUIDs to filter by. Defaults to None. start_time (str, optional): Inclusive (The list will include vulnerable programs detected at start_time). Defaults to None. end_time (str, optional): Exclusive - if end_time is a time (The list will only include vulnerable programs detected before end_time); Inclusive - if end_time is a date (The list will include vulnerable programs detected on the date). Defaults to None. limit (int, optional): Maximum number of items to return. Defaults to None. offset (int, optional): Item number to start looking from. Defaults to None. Returns: Dict[str, Any]: List of vulnerabilities. """ params = remove_empty_elements( { "group_guid[]": group_guids, "start_time": start_time, "end_time": end_time, "limit": limit, "offset": offset, } ) return self._http_request( method="GET", url_suffix="/vulnerabilities", params=params, ) def vulnerable_computers_list_request( self, sha256: str, group_guids: List[str] = None, start_time: str = None, end_time: str = None, limit: int = None, offset: int = None, ) -> Dict[str, Any]: """ Get a list of computers observed with given SHA-256. Args: sha256 (str): SHA-256 that has been observed as a vulnerability. group_guid (List[str], optional): Group GUIDs to filter by. Defaults to None. start_time (str, optional): Inclusive (The list will include vulnerable programs detected at start_time). Defaults to None. end_time (str, optional): Exclusive - if end_time is a time (The list will only include vulnerable programs detected before end_time); Inclusive - if end_time is a date (The list will include vulnerable programs detected on the date). Defaults to None. limit (int, optional): Maximum number of items to return. Defaults to None. offset (int, optional): Item number to start looking from. Defaults to None. Returns: Dict[str, Any]: List of vulnerable computers. """ params = remove_empty_elements( { "group_guid[]": group_guids, "start_time": start_time, "end_time": end_time, "limit": limit, "offset": offset, } ) return self._http_request( method="GET", url_suffix=f"/vulnerabilities/{sha256}/computers", params=params, ) """ COMMAND FUNCTIONS """ # pylint: disable=pointless-string-statement def fetch_incidents( client: Client, last_run: Dict[str, Any], first_fetch_time: str, event_types: List[int] = None, incident_severities: List[str] = None, max_incidents_to_fetch: int = FETCH_LIMIT, ) -> Tuple[Dict[str, int], List[dict]]: """ Retrieves new alerts every interval (default is 1 minute). Implements the logic of making sure that incidents are fetched only once. By default it's invoked by XSOAR every minute. It will use last_run to save the time of the last incident it processed and previous incident IDs. If last_run is not provided, first_fetch_time will be used to determine when to start fetching the first time. Args: client (Client): Cisco AMP client to run desired requests last_run (Dict[str, Any]): last_fetch: Time of the last processed incident. previous_ids: List of incident IDs to that would not be repeated. first_fetch_time (str): Determines the time of when fetching has been started. event_types (List[int], optional): Event types to filter by. Defaults to None. incident_severities (List[str], optional): Incident severities to filter by. Defaults to None. max_incidents_to_fetch (int, optional): Max number of incidents to fetch in a single run. Defaults to FETCH_LIMIT. Returns: Tuple[Dict[str, int], List[dict]]: next_run: Contains information that will be used in the next run. incidents: List of incidents that will be created in XSOAR. """ last_fetch = last_run.get("last_fetch") previous_ids = set(last_run.get("previous_ids", [])) # If a last fetch run doesn't exist, use the first fetch time. if last_fetch is None: last_fetch = first_fetch_time last_fetch_timestamp = date_to_timestamp(last_fetch, ISO_8601_FORMAT) response = client.event_list_request(start_date=last_fetch, event_types=event_types) items = response["data"] incidents: List[Dict[str, Any]] = [] incident_name = 'Cisco AMP Event ID:"{event_id}"' for item in items: # Break once the maximum number of incidents has been achieved. if len(incidents) >= max_incidents_to_fetch: break # Continue if the incident severity isn't in the requested list (only if there is one). if ( incident_severities and (severity := item.get("severity")) not in incident_severities ): continue # Continue if the incident ID has been fetched already. if (incident_id := str(item.get("id"))) in previous_ids: continue previous_ids.add(incident_id) incident_timestamp = item["timestamp"] * 1000 incident = remove_empty_elements( { "name": incident_name.format( event_id=incident_id, ), "occurred": timestamp_to_datestring(incident_timestamp), "rawJSON": json.dumps(item), "severity": XSOAR_SEVERITY_BY_AMP_SEVERITY.get( severity, IncidentSeverity.UNKNOWN ), "details": str(item.get("event_type")), "dbotMirrorId": incident_id, } ) incidents.append(incident) # Update the latest incident time that was fetched. if incident_timestamp > last_fetch_timestamp: last_fetch_timestamp = incident_timestamp next_run = { "last_fetch": timestamp_to_datestring(last_fetch_timestamp), "previous_ids": list(previous_ids), } return next_run, incidents def test_module(client: Client) -> str: """ Tests API connectivity and authentication Returning 'ok' indicates that the integration works like it is supposed to. Connection to the service is successful. Raises exceptions if something goes wrong. Args: client (Client): Cisco AMP client to run desired requests Returns: str: 'ok' if test passed, anything else will fail the test. """ try: client.version_get_request() except DemistoException as exc: if exc.res and exc.res.status_code == HTTPStatus.UNAUTHORIZED: return "Authorization Error: Unknown API key or Client ID" return exc.message return "ok" def computer_list_command(client: Client, args: Dict[str, Any]) -> List[CommandResults]: """ Get information about computers. The command can get a list of filtered computers or a specific computer with connector_guid. The command supports pagination. If needed the response will be concatenated. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Raises: ValueError: If there is a connector_guid other arguments must not exist. Returns: List[CommandResults]: Information about a list of computers or a specific computer. """ page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) connector_guid = args.get("connector_guid", "") hostnames = argToList(args.get("hostname")) internal_ip = args.get("internal_ip") external_ip = args.get("external_ip") group_guids = argToList(args.get("group_guid")) last_seen_within = arg_to_number(args.get("last_seen_within")) last_seen_over = arg_to_number(args.get("last_seen_over")) is_get_request = bool(connector_guid) is_list_request = any( ( page, page_size, limit, hostnames, internal_ip, external_ip, group_guids, last_seen_within, last_seen_over, ) ) if is_get_request and is_list_request: raise ValueError( "connector_guid must be the only input, when fetching a specific computer." ) if not is_get_request: pagination = get_pagination_parameters(page, page_size, limit) raw_response_list: List[Dict[str, Any]] = [] # Run multiple requests according to pagination inputs. for request_number in pagination_range(pagination): raw_response_list.append( client.computer_list_request( limit=pagination.limit, offset=None if pagination.offset is None else pagination.offset * request_number, hostnames=hostnames, internal_ip=internal_ip, external_ip=external_ip, group_guids=group_guids, last_seen_within=last_seen_within, last_seen_over=last_seen_over, ) ) if not raw_response_list[-1]["data"]: break raw_response: Dict[str, Any] = combine_response_results( raw_response_list, pagination.is_automatic ) else: raw_response = client.computer_get_request( connector_guid=connector_guid, ) context_outputs = get_context_output(raw_response, ["links"]) readable_output = get_results_readable_output(raw_response) readable_output += get_computer_readable_output(raw_response) command_results = [] for context_output in context_outputs: endpoint_indicator = Common.Endpoint( id=context_output["connector_guid"], ip_address=context_output["internal_ips"][0], hostname=context_output["hostname"], mac_address=context_output["network_addresses"][0]["mac"], os=context_output["operating_system"], os_version=context_output["os_version"], status="Online" if context_output["active"] else "Offline", vendor="CiscoAMP Response", ) command_results.append( CommandResults( outputs_prefix="CiscoAMP.Computer", outputs_key_field="connector_guid", outputs=context_output, raw_response=raw_response, indicator=endpoint_indicator, ) ) command_results.append(CommandResults(readable_output=readable_output)) return command_results def computer_trajectory_list_command( client: Client, args: Dict[str, Any] ) -> CommandResults: """ Get information about a computer's trajectory. The command supports pagination. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Raises: ValueError: If the user hasn't entered one of the required query options wrong. Returns: CommandResults: Information about a computer's trajectory. """ connector_guid = args["connector_guid"] page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) query_string = args.get("query_string") if not validate_query( query=query_string, accept_ipv4=True, accept_sha256=True, accept_url=True, accept_filename=False, ): raise ValueError("query_string must be: SHA-256/IPv4/URL") pagination = get_pagination_parameters(page, page_size, limit) raw_response = client.computer_trajectory_list_request( connector_guid=connector_guid, limit=pagination.page * pagination.page_size if pagination.is_manual else (limit or None), query_string=query_string, ) context_output, readable_output = extract_pagination_from_response( pagination, raw_response ) return CommandResults( outputs_prefix="CiscoAMP.ComputerTrajectory", outputs_key_field="id", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def computer_user_activity_list_command( client: Client, args: Dict[str, Any] ) -> CommandResults: """ Get information about computers with user activity on them. The command supports pagination. If needed the response will be concatenated. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about computers with user activity on them. """ username = args["username"] page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) pagination = get_pagination_parameters(page, page_size, limit) raw_response_list: List[Dict[str, Any]] = [] # Run multiple requests according to pagination inputs. for request_number in pagination_range(pagination): raw_response_list.append( client.computer_user_activity_get_request( username=username, limit=pagination.limit, offset=None if pagination.offset is None else pagination.offset * request_number, ) ) if not raw_response_list[-1]["data"]: break raw_response: Dict[str, Any] = combine_response_results( raw_response_list, pagination.is_automatic ) context_output = get_context_output(raw_response, ["links"]) readable_output = get_results_readable_output(raw_response) readable_output += get_readable_output( response=raw_response, header_by_keys=ACTIVITY_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=ACTIVITY_TITLE, ) return CommandResults( outputs_prefix="CiscoAMP.ComputerUserActivity", outputs_key_field="connector_guid", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def computer_user_trajectory_list_command( client: Client, args: Dict[str, Any] ) -> CommandResults: """ Get information about a computer's trajectory with the option filter by username. The command supports pagination. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about a computer's trajectory. """ connector_guid = args["connector_guid"] page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) username = args.get("username") pagination = get_pagination_parameters(page, page_size, limit) raw_response = client.computer_user_trajectory_list_request( connector_guid=connector_guid, limit=pagination.page * pagination.page_size if pagination.is_manual else (limit or None), username=username, ) context_output, readable_output = extract_pagination_from_response( pagination, raw_response ) return CommandResults( outputs_prefix="CiscoAMP.ComputerUserTrajectory", outputs_key_field="id", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def computer_vulnerabilities_list_command( client: Client, args: Dict[str, Any] ) -> CommandResults: """ Get information about a computer's vulnerabilities. The command supports pagination. If needed the response will be concatenated. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about a computer's vulnerabilities. """ connector_guid = args["connector_guid"] start_time = args.get("start_time") end_time = args.get("end_time") page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) pagination = get_pagination_parameters(page, page_size, limit) raw_response_list: List[Dict[str, Any]] = [] # Run multiple requests according to pagination inputs. for request_number in pagination_range(pagination): raw_response_list.append( client.computer_vulnerabilities_list_request( connector_guid=connector_guid, start_time=start_time, end_time=end_time, limit=pagination.limit, offset=None if pagination.offset is None else pagination.offset * request_number, ) ) if not raw_response_list[-1]["data"]: break raw_response: Dict[str, Any] = combine_response_results( raw_response_list, pagination.is_automatic ) context_output = get_context_output(raw_response, ["links"]) context_output = context_output[0]["vulnerabilities"] add_item_to_all_dictionaries( context_output, "connector_guid", dict_safe_get(raw_response, ["data", "connector_guid"]), ) readable_output = get_results_readable_output(raw_response) readable_output += get_computer_readable_output(raw_response) readable_output += get_readable_output( response=raw_response, header_by_keys=VULNERABILITY_HEADERS_BY_KEYS, keys_to_items_option_1=["data", "vulnerabilities"], keys_to_items_option_2=["data"], title=VULNERABILITY_TITLE, ) return CommandResults( outputs_prefix="CiscoAMP.ComputerVulnerability", outputs_key_field="connector_guid", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def computer_move_command(client: Client, args: Dict[str, Any]) -> CommandResults: """ Move a computer to another group. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about the moved computer. """ connector_guid = args["connector_guid"] group_guid = args["group_guid"] raw_response = client.computer_move_request( connector_guid=connector_guid, group_guid=group_guid, ) context_output = get_context_output(raw_response, ["links"]) readable_output = get_computer_readable_output(raw_response) return CommandResults( outputs_prefix="CiscoAMP.Computer", outputs_key_field="connector_guid", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def computer_delete_command(client: Client, args: Dict[str, Any]) -> CommandResults: """ Deletes a computer and returns a result if the deletion has succeeded. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Raises: ValueError: Incase the deletion has failed, raise an error. Returns: CommandResults: Success message of the deleted computer. """ connector_guid = args["connector_guid"] raw_response = client.computer_delete_request(connector_guid=connector_guid) is_deleted = dict_safe_get(raw_response, ["data", "deleted"]) if not is_deleted: raise DemistoException( message=f'Failed to delete Connector GUID: "{connector_guid}".', res=raw_response, ) readable_output = f'Connector GUID: "{connector_guid}"\nSuccessfully deleted.' return CommandResults( readable_output=readable_output, raw_response=raw_response, ) def computer_activity_list_command( client: Client, args: Dict[str, Any] ) -> CommandResults: """ Get information about computers with query activity on them. The command supports pagination. If needed the response will be concatenated. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Raises: ValueError: If the input query isn't an IP, URL Returns: CommandResults: Information about computers with query activity on them. """ query_string = args["query_string"] page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) # Check if the query is empty or of one of the following formats: SHA256, IPv4, URL or Filename. if not validate_query( query=query_string, accept_ipv4=True, accept_filename=True, accept_sha256=True, accept_url=True, ): raise ValueError("query_string must be: SHA-256/IPv4/URL/Filename") pagination = get_pagination_parameters(page, page_size, limit) raw_response_list: List[Dict[str, Any]] = [] # Run multiple requests according to pagination inputs. for request_number in pagination_range(pagination): raw_response_list.append( client.computer_activity_list_request( query_string=query_string, limit=pagination.limit, offset=None if pagination.offset is None else pagination.offset * request_number, ) ) if not raw_response_list[-1]["data"]: break raw_response: Dict[str, Any] = combine_response_results( raw_response_list, pagination.is_automatic ) context_output = get_context_output(raw_response, ["links"]) readable_output = get_results_readable_output(raw_response) readable_output += get_readable_output( response=raw_response, header_by_keys=ACTIVITY_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=ACTIVITY_TITLE, ) return CommandResults( outputs_prefix="CiscoAMP.ComputerActivity", outputs_key_field="connector_guid", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def computers_isolation_feature_availability_get_command( client: Client, args: Dict[str, Any] ) -> CommandResults: """ Get information about available isolation options for a computer. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about a computer's isolation options. """ connector_guid = args["connector_guid"] try: raw_response = client.computer_isolation_feature_availability_get_request( connector_guid=connector_guid, ) readable_output = get_isolation_options_readable_output(raw_response) except DemistoException as exc: # this is an expected behavior, when isolation is not allowed. if exc.res and exc.res.status_code == HTTPStatus.METHOD_NOT_ALLOWED: readable_output = "Isolation is not allowed on policy." else: raise # if there's a different HTTP status code, it's not an expected behavior. return CommandResults(readable_output=readable_output) def computer_isolation_get_command( client: Client, args: Dict[str, Any] ) -> CommandResults: """ Get information about a computer's isolation. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about a computer's isolation. """ connector_guid = args["connector_guid"] raw_response = client.computer_isolation_get_request( connector_guid=connector_guid, ) readable_output = get_readable_output( response=raw_response, header_by_keys=ISOLATION_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=ISOLATION_TITLE, ) context_output = get_context_output( response=raw_response, contexts_to_delete=["links"], item_to_add=("connector_guid", connector_guid), )[0] return CommandResults( outputs_prefix="CiscoAMP.ComputerIsolation", outputs_key_field="connector_guid", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def computer_isolation_create_command( client: Client, args: Dict[str, Any] ) -> CommandResults: """ Put a computer in isolation. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about the computer's isolation. """ connector_guid = args["connector_guid"] comment = args["comment"] unlock_code = args["unlock_code"] raw_response = client.computer_isolation_create_request( connector_guid=connector_guid, comment=comment, unlock_code=unlock_code, ) readable_output = get_readable_output( response=raw_response, header_by_keys=ISOLATION_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=ISOLATION_TITLE, ) context_output = get_context_output( response=raw_response, contexts_to_delete=["links"], item_to_add=("connector_guid", connector_guid), )[0] return CommandResults( outputs_prefix="CiscoAMP.ComputerIsolation", outputs_key_field="connector_guid", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) @polling_function( name="cisco-amp-computer-isolation-create", interval=arg_to_number(demisto.args().get("interval_in_seconds", DEFAULT_INTERVAL)), timeout=arg_to_number(demisto.args().get("timeout_in_seconds", DEFAULT_TIMEOUT)), requires_polling_arg=False, ) def computer_isolation_create_polling_command( args: Dict[str, Any], **kwargs ) -> PollResult: """ Polling command to display the progress of computer isolation create command. After the first run, progress will be shown through the computer isolation get command. Computer isolation create command will run till its status is 'isolated' or 'pending_start'. Args: args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request and a Client. Returns: PollResult: A result to return to the user which will be set as a CommandResults. The result itself will depend on the stage of polling. """ return computer_isolation_polling_command( client=kwargs["client"], args=args, computer_isolation_command=computer_isolation_create_command, result_isolation_status=("isolated", "pending_start"), ) def computer_isolation_delete_command( client: Client, args: Dict[str, Any] ) -> CommandResults: """ Stop a computer's in isolation. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about the computer's isolation. """ connector_guid = args["connector_guid"] comment = args.get("comment") raw_response = client.computer_isolation_delete_request( connector_guid=connector_guid, comment=comment, ) readable_output = get_readable_output( response=raw_response, header_by_keys=ISOLATION_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=ISOLATION_TITLE, ) context_output = get_context_output(raw_response, ["links"]) return CommandResults( outputs_prefix="CiscoAMP.ComputerIsolation", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) @polling_function( name="cisco-amp-computer-isolation-delete", interval=arg_to_number(demisto.args().get("interval_in_seconds", DEFAULT_INTERVAL)), timeout=arg_to_number(demisto.args().get("timeout_in_seconds", DEFAULT_TIMEOUT)), requires_polling_arg=False, ) def computer_isolation_delete_polling_command( args: Dict[str, Any], **kwargs ) -> PollResult: """ Polling command to display the progress of computer isolation delete command. After the first run, progress will be shown through the computer isolation get command. Computer isolation delete command will run till its status is 'not_isolated' or 'pending_stop'. Args: args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request and a Client. Returns: PollResult: A result to return to the user which will be set as a CommandResults. The result itself will depend on the stage of polling. """ return computer_isolation_polling_command( client=kwargs["client"], args=args, computer_isolation_command=computer_isolation_delete_command, result_isolation_status=("not_isolated", "pending_stop"), ) def computer_isolation_polling_command( client: Client, args: Dict[str, Any], computer_isolation_command: Callable, result_isolation_status: Tuple[str, str], ) -> PollResult: """ _summary_ Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. computer_isolation_command (Callable): can be one of the two functions: computer_isolation_create_command computer_isolation_delete_command result_isolation_status (Tuple[str, str]): Result status to end polling function, can be on of the two options: ('isolated', 'pending_start') ('not_isolated', 'pending_stop') Returns: PollResult: A result to return to the user which will be set as a CommandResults. The result itself will depend on the stage of polling. """ if "status" not in args: command_results = computer_isolation_command(client, args) else: command_results = computer_isolation_get_command(client, args) status = dict_safe_get(command_results.raw_response, ["data", "status"]) if status in result_isolation_status: return PollResult( response=command_results, continue_to_poll=False, ) args_for_next_run = {"status": status, **args} return PollResult( response=command_results, continue_to_poll=True, args_for_next_run=args_for_next_run, ) def event_list_command(client: Client, args: Dict[str, Any]) -> List[CommandResults]: """ Get information about events with the option to filter them. The command supports pagination. If needed the response will be concatenated. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Raises: ValueError: If detection_sha256 isn't a SHA-256 value. ValueError: If application_sha256 isn't a SHA-256 value. Returns: List[CommandResults]: Information about events. """ detection_sha256 = args.get("detection_sha256") application_sha256 = args.get("application_sha256") connector_guid = argToList(args.get("connector_guid")) group_guid = argToList(args.get("group_guid")) start_date = args.get("start_date") event_type = argToList(args.get("event_type")) event_type = [arg_to_number(et) for et in event_type if et is not None] page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) if detection_sha256 and not sha256Regex.match(detection_sha256): raise ValueError("detection_sha256 must be: SHA-256") if application_sha256 and not sha256Regex.match(application_sha256): raise ValueError("application_sha256 must be: SHA-256") pagination = get_pagination_parameters(page, page_size, limit) raw_response_list: List[Dict[str, Any]] = [] # Run multiple requests according to pagination inputs. for request_number in pagination_range(pagination): raw_response_list.append( client.event_list_request( detection_sha256=detection_sha256, application_sha256=application_sha256, connector_guids=connector_guid, group_guids=group_guid, start_date=start_date, event_types=event_type, # type: ignore # List[Optional[int]] arg_to_number; expected Optional[List[int]] limit=pagination.limit, offset=None if pagination.offset is None else pagination.offset * request_number, ) ) raw_response: Dict[str, Any] = combine_response_results( raw_response_list, pagination.is_automatic ) context_outputs = get_context_output(raw_response, ["links"]) readable_output = get_results_readable_output(raw_response) readable_output += get_readable_output( response=raw_response, header_by_keys=EVENT_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=EVENT_TITLE, ) command_results = [] for context_output in context_outputs: file_indicator = None if "file" in context_output: sha256 = dict_safe_get(context_output, ["file", "identity", "sha256"]) disposition = dict_safe_get(context_output, ["file", "disposition"]) dbot_score = get_dbotscore(client.reliability, sha256, disposition) file_indicator = Common.File( md5=dict_safe_get(context_output, ["file", "identity", "md5"]), sha1=dict_safe_get(context_output, ["file", "identity", "sha1"]), sha256=sha256, path=dict_safe_get(context_output, ["file", "file_path"]), name=dict_safe_get(context_output, ["file", "file_name"]), hostname=dict_safe_get(context_output, ["computer", "hostname"]), relationships=dict_safe_get(context_output, ["file", "parent"]), dbot_score=dbot_score, ) command_results.append( CommandResults( outputs_prefix="CiscoAMP.Event", outputs_key_field="id", outputs=context_output, raw_response=raw_response, indicator=file_indicator, ) ) command_results.append(CommandResults(readable_output=readable_output)) return command_results def event_type_list_command(client: Client, args: Dict[str, Any]) -> CommandResults: """ Get information about event types. The command supports pagination. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about event types. """ page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) pagination = get_pagination_parameters(page, page_size, limit) raw_response = client.event_type_list_request() if pagination.is_manual: start = (pagination.page - 1) * pagination.page_size stop = pagination.page * pagination.page_size raw_response["data"] = raw_response["data"][start:stop] else: raw_response["data"] = raw_response["data"][: pagination.limit] context_output = get_context_output(raw_response, ["links"]) readable_output = get_results_readable_output(raw_response) readable_output += get_readable_output( response=raw_response, header_by_keys=EVENT_TYPE_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=EVENT_TYPE_TITLE, ) return CommandResults( outputs_prefix="CiscoAMP.EventType", outputs_key_field="id", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def file_list_list_command(client: Client, args: Dict[str, Any]) -> CommandResults: """ Get information about policies. The command supports pagination. If needed the response will be concatenated. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about policies. """ file_list_type = args.get("file_list_type", "Application Blocking") names = argToList(args.get("name")) file_list_guid = args.get("file_list_guid") page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) file_list_request_by_type = { "Application Blocking": client.file_list_application_blocking_list_request, "Simple Custom Detection": client.file_list_simple_custom_detections_list_request, } if not file_list_guid: pagination = get_pagination_parameters(page, page_size, limit) raw_response_list: List[Dict[str, Any]] = [] # Run multiple requests according to pagination inputs. for request_number in pagination_range(pagination): raw_response_list.append( file_list_request_by_type[file_list_type]( names=names, limit=pagination.limit, offset=None if pagination.offset is None else pagination.offset * request_number, ) ) if not raw_response_list[-1]["data"]: break raw_response: Dict[str, Any] = combine_response_results( raw_response_list, pagination.is_automatic ) else: raw_response = client.file_list_get_request( file_list_guid=file_list_guid, ) readable_output = get_results_readable_output(raw_response) readable_output += get_readable_output( response=raw_response, header_by_keys=FILE_LIST_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=FILE_LIST_TITLE, ) context_output = get_context_output(raw_response, ["links"]) return CommandResults( outputs_prefix="CiscoAMP.FileList", outputs_key_field="guid", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def file_list_item_list_command(client: Client, args: Dict[str, Any]) -> CommandResults: """ Get information about file list items. The command supports pagination. If needed the response will be concatenated. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about file list items. """ file_list_guid = args["file_list_guid"] sha256 = args.get("sha256") page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) if not sha256: pagination = get_pagination_parameters(page, page_size, limit) raw_response_list: List[Dict[str, Any]] = [] # Run multiple requests according to pagination inputs. for request_number in pagination_range(pagination): raw_response_list.append( client.file_list_item_list_request( file_list_guid=file_list_guid, limit=pagination.limit, offset=None if pagination.offset is None else pagination.offset * request_number, ) ) if not raw_response_list[-1]["data"]: break raw_response: Dict[str, Any] = combine_response_results( raw_response_list, pagination.is_automatic ) else: raw_response = client.file_list_item_get_request( file_list_guid=file_list_guid, sha256=sha256, ) readable_output = get_results_readable_output(raw_response) readable_output += get_readable_output( response=raw_response, header_by_keys=FILE_LIST_ITEM_HEADERS_BY_KEYS, keys_to_items_option_1=["data", "items"], keys_to_items_option_2=["data"], title=FILE_LIST_ITEM_TITLE, ) if dict_safe_get(raw_response, ["data", "policies"]): readable_output += get_readable_output( response=raw_response, header_by_keys=POLICY_HEADERS_BY_KEYS, keys_to_items_option_1=["data", "policies"], title=POLICY_TITLE, ) context_output = get_context_output(raw_response, ["links"]) return CommandResults( outputs_prefix="CiscoAMP.FileListItem", outputs_key_field="sha256", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def file_list_item_create_command( client: Client, args: Dict[str, Any] ) -> CommandResults: """ Create a new item for a file list. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about the new file list item. """ file_list_guid = args["file_list_guid"] sha256 = args["sha256"] description = args.get("description") raw_response = client.file_list_item_create_request( file_list_guid=file_list_guid, sha256=sha256, description=description, ) readable_output = get_readable_output( response=raw_response, header_by_keys=FILE_LIST_ITEM_HEADERS_BY_KEYS, keys_to_items_option_1=["data", "items"], keys_to_items_option_2=["data"], title=FILE_LIST_ITEM_TITLE, ) if dict_safe_get(raw_response, ["data", "policies"]): readable_output += get_readable_output( response=raw_response, header_by_keys=POLICY_HEADERS_BY_KEYS, keys_to_items_option_1=["data", "policies"], title=POLICY_TITLE, ) context_output = get_context_output(raw_response, ["links"]) return CommandResults( outputs_prefix="CiscoAMP.FileListItem", outputs_key_field="sha256", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def file_list_item_delete_command( client: Client, args: Dict[str, Any] ) -> CommandResults: """ Delete an item from a file list. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Success message of the deleted item. """ file_list_guid = args["file_list_guid"] sha256 = args["sha256"] raw_response = client.file_list_item_delete_request( file_list_guid=file_list_guid, sha256=sha256, ) if "errors" in raw_response: raise DemistoException( message=f'Failed to delete-\nFile List GUID: "{file_list_guid}"\nSHA-256: "{sha256}" not found.', res=raw_response, ) readable_output = f'SHA-256: "{sha256}" Successfully deleted from File List GUID: "{file_list_guid}".' return CommandResults( readable_output=readable_output, raw_response=raw_response, ) def group_list_command(client: Client, args: Dict[str, Any]) -> CommandResults: """ Get information about groups with the option to filter by name. The command supports pagination. If needed the response will be concatenated. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about groups. """ group_guid = args.get("group_guid") name = args.get("name") page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) if not group_guid: pagination = get_pagination_parameters(page, page_size, limit) raw_response_list: List[Dict[str, Any]] = [] # Run multiple requests according to pagination inputs. for request_number in pagination_range(pagination): raw_response_list.append( client.group_list_request( name=name, limit=pagination.limit, offset=None if pagination.offset is None else pagination.offset * request_number, ) ) if not raw_response_list[-1]["data"]: break raw_response: Dict[str, Any] = combine_response_results( raw_response_list, pagination.is_automatic ) readable_output = get_results_readable_output(raw_response) readable_output += get_readable_output( response=raw_response, header_by_keys=GROUPS_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=GROUPS_TITLE, ) else: raw_response = client.group_get_request( group_guid=group_guid, ) readable_output = get_readable_output( response=raw_response, header_by_keys=GROUP_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=GROUP_TITLE, ) context_output = get_context_output(raw_response, ["links"]) return CommandResults( outputs_prefix="CiscoAMP.Group", outputs_key_field="guid", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def group_policy_update_command(client: Client, args: Dict[str, Any]) -> CommandResults: """ Update a groups Policy and get information about the group. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Raises: ValueError: Incase the user hasn't entered at least one policy GUID. Returns: CommandResults: Information about the updated group. """ group_guid = args["group_guid"] windows_policy_guid = args.get("windows_policy_guid") mac_policy_guid = args.get("mac_policy_guid") android_policy_guid = args.get("android_policy_guid") linux_policy_guid = args.get("linux_policy_guid") has_no_policy_guid = not ( any( ( windows_policy_guid, mac_policy_guid, android_policy_guid, linux_policy_guid, ) ) ) if has_no_policy_guid: raise ValueError("At least one Policy GUID must be entered.") raw_response = client.group_policy_update_request( group_guid=group_guid, windows_policy_guid=windows_policy_guid, mac_policy_guid=mac_policy_guid, android_policy_guid=android_policy_guid, linux_policy_guid=linux_policy_guid, ) context_output = get_context_output(raw_response, ["links"]) readable_output = get_readable_output( response=raw_response, header_by_keys=GROUP_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=GROUP_TITLE, ) return CommandResults( outputs_prefix="CiscoAMP.Group", outputs_key_field="guid", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def group_parent_update_command(client: Client, args: Dict[str, Any]) -> CommandResults: """ Update a groups Policy and get information about the group. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Raises: ValueError: Incase the user hasn't entered at least one policy GUID. Returns: CommandResults: Information about the updated group. """ child_guid = args["child_guid"] parent_group_guid = args.get("parent_group_guid") raw_response = client.group_parent_update_request( child_guid=child_guid, parent_group_guid=parent_group_guid, ) context_output = get_context_output(raw_response, ["links"]) readable_output = get_readable_output( response=raw_response, header_by_keys=GROUP_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=GROUP_TITLE, ) return CommandResults( outputs_prefix="CiscoAMP.Group", outputs_key_field="guid", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def group_create_command(client: Client, args: Dict[str, Any]) -> CommandResults: """ Create a new group and get information about it. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about the new group. """ name = args["name"] description = args["description"] raw_response = client.group_create_request( name=name, description=description, ) context_output = get_context_output(raw_response, ["links"]) readable_output = get_readable_output( response=raw_response, header_by_keys=GROUP_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=GROUP_TITLE, ) return CommandResults( outputs_prefix="CiscoAMP.Group", outputs_key_field="guid", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def groups_delete_command(client: Client, args: Dict[str, Any]) -> CommandResults: """ Deletes a group and returns a result if the deletion has succeeded. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Raises: ValueError: Incase the deletion has failed, raise an error. Returns: CommandResults: Success message of the deleted group. """ group_guid = args["group_guid"] raw_response = client.group_delete_request(group_guid=group_guid) is_deleted = dict_safe_get(raw_response, ["data", "deleted"]) if not is_deleted: raise DemistoException( message=f'Failed to delete Group GUID: "{group_guid}".', res=raw_response, ) readable_output = f'Group GUID: "{group_guid}"\nSuccessfully deleted.' return CommandResults( readable_output=readable_output, raw_response=raw_response, ) def indicator_list_command(client: Client, args: Dict[str, Any]) -> CommandResults: """ Get information about indicators. The command supports pagination. If needed the response will be concatenated. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about indicators. """ indicator_guid = args.get("indicator_guid") page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) if not indicator_guid: pagination = get_pagination_parameters(page, page_size, limit) raw_response_list: List[Dict[str, Any]] = [] # Run multiple requests according to pagination inputs. for request_number in pagination_range(pagination): raw_response_list.append( client.indicator_list_request( limit=pagination.limit, offset=None if pagination.offset is None else pagination.offset * request_number, ) ) if not raw_response_list[-1]["data"]: break raw_response: Dict[str, Any] = combine_response_results( raw_response_list, pagination.is_automatic ) else: raw_response = client.indicator_get_request( indicator_guid=indicator_guid, ) readable_output = get_results_readable_output(raw_response) readable_output += get_readable_output( response=raw_response, header_by_keys=INDICATOR_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=INDICATOR_TITLE, ) if dict_safe_get(raw_response, ["data", "mitre", "tactics"]): readable_output += get_readable_output( response=raw_response, header_by_keys=MITRE_HEADERS_BY_KEYS, keys_to_items_option_1=["data", "mitre", "tactics"], title=MITRE_TACTIC_TITLE, ) if dict_safe_get(raw_response, ["data", "mitre", "techniques"]): readable_output += get_readable_output( response=raw_response, header_by_keys=MITRE_HEADERS_BY_KEYS, keys_to_items_option_1=["data", "mitre", "techniques"], title=MITRE_TECHNIQUE_TITLE, ) context_output = get_context_output(raw_response, ["links"]) return CommandResults( outputs_prefix="CiscoAMP.Indicator", outputs_key_field="guid", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def policy_list_command(client: Client, args: Dict[str, Any]) -> CommandResults: """ Get information about policies. The command supports pagination. If needed the response will be concatenated. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about policies. """ policy_guid = args.get("policy_guid") products = argToList(args.get("product")) names = argToList(args.get("name")) page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) if not policy_guid: pagination = get_pagination_parameters(page, page_size, limit) raw_response_list: List[Dict[str, Any]] = [] # Run multiple requests according to pagination inputs. for request_number in pagination_range(pagination): raw_response_list.append( client.policy_list_request( products=products, names=names, limit=pagination.limit, offset=None if pagination.offset is None else pagination.offset * request_number, ) ) if not raw_response_list[-1]["data"]: break raw_response: Dict[str, Any] = combine_response_results( raw_response_list, pagination.is_automatic ) else: raw_response = client.policy_get_request( policy_guid=policy_guid, ) readable_output = get_results_readable_output(raw_response) readable_output += get_readable_output( response=raw_response, header_by_keys=POLICY_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=POLICY_TITLE, ) context_output = get_context_output(raw_response, ["links"]) return CommandResults( outputs_prefix="CiscoAMP.Policy", outputs_key_field="guid", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def app_trajectory_query_list_command( client: Client, args: Dict[str, Any] ) -> CommandResults: """ Get app trajectory query for a given IOS bundle ID.. The command supports pagination. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Information about an app trajectory. """ ios_bid = args["ios_bid"] page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) pagination = get_pagination_parameters(page, page_size, limit) raw_response = client.app_trajectory_query_list_request(ios_bid=ios_bid) if pagination.is_manual: start = (pagination.page - 1) * pagination.page_size stop = pagination.page * pagination.page_size raw_response["data"] = raw_response["data"][start:stop] else: raw_response["data"] = raw_response["data"][: pagination.limit] context_output = get_context_output(raw_response, ["links"]) readable_output = get_readable_output( response=raw_response, header_by_keys=APP_TRAJECTORY_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=APP_TRAJECTORY_TITLE, ) return CommandResults( outputs_prefix="CiscoAMP.AppTrajectoryQuery", outputs_key_field="connector_guid", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def version_get_command( client: Client, args: Dict[str, Any] ) -> CommandResults: # pylint: disable=unused-argument """ Get the current version of the API. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Current version of the API. """ raw_response = client.version_get_request() version = raw_response.get("version") readable_output = f"Version: {version}" context_output = {"version": version} return CommandResults( outputs_prefix="CiscoAMP.Version", outputs_key_field="version", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def vulnerability_list_command(client: Client, args: Dict[str, Any]) -> CommandResults: """ Get information about vulnerabilities within computers. The command supports pagination. If needed the response will be concatenated. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Returns: CommandResults: Vulnerabilities of computers. """ sha256 = args.get("sha256") group_guid = argToList(args.get("group_guid")) start_time = args.get("start_time") end_time = args.get("end_time") page = arg_to_number(args.get("page", 0)) page_size = arg_to_number(args.get("page_size", 0)) limit = arg_to_number(args.get("limit", 0)) pagination = get_pagination_parameters(page, page_size, limit) raw_response_list: List[Dict[str, Any]] = [] # Run multiple requests according to pagination inputs. for request_number in pagination_range(pagination): if not sha256: raw_response_list.append( client.vulnerability_list_request( group_guids=group_guid, start_time=start_time, end_time=end_time, limit=pagination.limit, offset=None if pagination.offset is None else pagination.offset * request_number, ) ) else: raw_response_list.append( client.vulnerable_computers_list_request( sha256=sha256, group_guids=group_guid, start_time=start_time, end_time=end_time, limit=pagination.limit, offset=None if pagination.offset is None else pagination.offset * request_number, ) ) if not raw_response_list[-1]["data"]: break raw_response: Dict[str, Any] = combine_response_results( raw_response_list, pagination.is_automatic ) readable_output = get_results_readable_output(raw_response) if sha256: readable_output += get_readable_output( response=raw_response, header_by_keys=VULNERABLE_COMPUTER_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=VULNERABLE_COMPUTER_TITLE, ) else: readable_output += get_readable_output( response=raw_response, header_by_keys=VULNERABILITY_HEADERS_BY_KEYS, keys_to_items_option_1=["data"], title=VULNERABILITY_TITLE, ) context_output = get_context_output(raw_response, ["links"]) return CommandResults( outputs_prefix="CiscoAMP.Vulnerability", outputs=context_output, readable_output=readable_output, raw_response=raw_response, ) def endpoint_command(client: Client, args: Dict[str, Any]) -> List[CommandResults]: """ Generic command that returns information about an endpoint. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Raises: DemistoException: Incase ID, IP or an hostname wasn't inserted Returns: List[CommandResults]: A list of endpoint indicators. """ endpoint_ids = argToList(args.get("id")) endpoint_ips = argToList(args.get("ip")) endpoint_hostnames = argToList(args.get("hostname")) if not any((endpoint_ids, endpoint_ips, endpoint_hostnames)): raise DemistoException( "CiscoAMP - In order to run this command, please provide a valid id, ip or hostname" ) responses = [] if endpoint_ids: for endpoint_id in endpoint_ids: response = client.computer_get_request(connector_guid=endpoint_id) responses.append(response) elif endpoint_ips: for endpoint_ip in endpoint_ips: response = client.computer_list_request(internal_ip=endpoint_ip) responses.append(response) else: responses.append(client.computer_list_request(hostnames=endpoint_hostnames)) endpoints: List = [] for response in responses: data_list = response["data"] if endpoint_ids: data_list = [data_list] for data in data_list: endpoint = Common.Endpoint( id=data["connector_guid"], ip_address=data["internal_ips"][0], hostname=data["hostname"], mac_address=data["network_addresses"][0]["mac"], os=data["operating_system"], os_version=data["os_version"], status="Online" if data["active"] else "Offline", vendor="CiscoAMP Response", ) endpoint_context = endpoint.to_context().get(Common.Endpoint.CONTEXT_PATH) readable_output = tableToMarkdown( f'CiscoAMP - Endpoint {data["hostname"]}', endpoint_context ) endpoints.append( CommandResults( readable_output=readable_output, raw_response=response, outputs_key_field="_id", indicator=endpoint, ) ) return endpoints def file_command(client: Client, args: Dict[str, Any]) -> List[CommandResults]: """ Generic command that returns information about files. Args: client (Client): Cisco AMP client to run desired requests args (Dict[str, Any]): Arguments passed down by the CLI to provide in the HTTP request. Raises: ValueError: In case the file_hash isn't SHA256 Returns: List[CommandResults]: Indicator for every file_hash """ files = argToList(args["file"]) command_results: List[CommandResults] = [] for file_hash in files: hash_type = get_hash_type(file_hash) if hash_type != "sha256": raise ValueError(f'Cisco AMP: Hash "{file_hash}" is not of type SHA-256') raw_response = client.event_list_request(detection_sha256=file_hash) data_list = raw_response["data"] disposition = dict_safe_get(data_list[0], ["file", "disposition"]) dbot_score = get_dbotscore(client.reliability, file_hash, disposition) file_indicator = Common.File( md5=dict_safe_get(data_list[0], ["file", "identity", "md5"]), sha1=dict_safe_get(data_list[0], ["file", "identity", "sha1"]), sha256=file_hash, path=dict_safe_get(data_list[0], ["file", "file_path"]), name=dict_safe_get(data_list[0], ["file", "file_name"]), hostname=dict_safe_get(data_list[0], ["computer", "hostname"]), dbot_score=dbot_score, ) for data in data_list[1:]: disposition = dict_safe_get(data, ["file", "disposition"]) dbot_score = get_dbotscore(client.reliability, file_hash, disposition) file_indicator.md5 = file_indicator.md5 or dict_safe_get( data, ["file", "identity", "md5"] ) file_indicator.sha1 = file_indicator.sha1 or dict_safe_get( data, ["file", "identity", "sha1"] ) file_indicator.path = file_indicator.path or dict_safe_get( data, ["file", "file_path"] ) file_indicator.name = file_indicator.name or dict_safe_get( data, ["file", "file_name"] ) file_indicator.hostname = file_indicator.hostname or dict_safe_get( data, ["computer", "hostname"] ) file_indicator.dbot_score = file_indicator.dbot_score or dbot_score is_all_filled = ( file_indicator.md5 and file_indicator.sha1 and file_indicator.sha256 and file_indicator.path and file_indicator.name and file_indicator.hostname and file_indicator.dbot_score ) if is_all_filled: break file_context = file_indicator.to_context().get(Common.File.CONTEXT_PATH) readable_output = tableToMarkdown( f"Cisco AMP - Hash Reputation for: {file_hash}", file_context ) command_results.append( CommandResults( readable_output=readable_output, outputs_prefix="", raw_response=raw_response, outputs_key_field="SHA256", indicator=file_indicator, ) ) return command_results """ HELPER FUNCTIONS """ # pylint: disable=pointless-string-statement def pagination_range(pagination: Pagination) -> range: """ Generate a range according to pagination parameters. Args: pagination (Pagination): parameters to be used to calculate the start and stop index. Returns: range: A range according to pagination parameters """ return range( pagination.offset_multiplier, pagination.number_of_requests + pagination.offset_multiplier, ) def get_pagination_parameters( page: Optional[int] = 0, page_size: Optional[int] = 0, limit: Optional[int] = 0, ) -> Pagination: """ Get the limit and offset required for the http request, number of requests required and if the pagination is automatic, manual or none of them. Args: page (Optional[int]): Page number to view. Defaults to None. page_size (Optional[int]): Number of elements in each page. Defaults to None. limit (Optional[int]): Total number of elements to return. Defaults to None. Raises: ValueError: If both manual and automatic arguments have been filled. Returns: Pagination: page (int): Page number to view. page_size (int): Number of elements in each page. limit (int): Total number of elements to return. offset (int): Number of 1st element to return. number_of_requests (int): Number of http requests to make. offset_multiplier (int): Multiply by 1 when number of requests is 1, otherwise 0. is_automatic (bool): Whether the pagination type is automatic. is_manual (bool): Whether the pagination type is manual. """ is_automatic: bool = limit != 0 is_manual: bool = page != 0 or page_size != 0 if is_manual and is_automatic: raise ValueError("page or page_size can not be entered with limit.") # Automatic Pagination if is_automatic: if limit > MAX_PAGE_SIZE: # type: ignore[operator] number_of_requests = math.ceil(limit / MAX_PAGE_SIZE) # type: ignore[operator] limit = MAX_PAGE_SIZE offset = MAX_PAGE_SIZE offset_multiplier = 0 else: number_of_requests = 1 offset = None offset_multiplier = 1 # Manual Pagination elif is_manual: page = page or 1 page_size = page_size or 1 number_of_requests = 1 limit = page_size offset = (page - 1) * page_size offset_multiplier = 1 # No Pagination else: number_of_requests = 1 limit = MAX_PAGE_SIZE offset = None offset_multiplier = 1 return Pagination( page, page_size, limit, offset, number_of_requests, offset_multiplier, is_automatic, is_manual, ) def extract_pagination_from_response( pagination: Pagination, raw_response: Dict[str, Any] ) -> Tuple[List, str]: """ Extract values from the response according to pagination parameters. Args: pagination (Pagination): Pagination parameters to extract values according to. raw_response (Dict[str, Any]): Raw response to extract values from. Returns: Tuple[List, str]: Context output and Readable output. """ if pagination.is_manual: start = (pagination.page - 1) * pagination.page_size stop = pagination.page * pagination.page_size raw_response["data"]["events"] = raw_response["data"]["events"][start:stop] else: raw_response["data"]["events"] = raw_response["data"]["events"][ : pagination.limit ] context_output = get_context_output(raw_response, ["links"]) context_output = context_output[0]["events"] add_item_to_all_dictionaries( context_output, "connector_guid", dict_safe_get(raw_response, ["data", "computer", "connector_guid"]), ) readable_output = get_computer_readable_output(raw_response) readable_output += get_readable_output( response=raw_response, header_by_keys=TRAJECTORY_HEADERS_BY_KEYS, keys_to_items_option_1=["data", "events"], title=TRAJECTORY_TITLE, ) return context_output, readable_output def delete_keys_from_dict( dictionary: MutableMapping, keys_to_delete: List[str] | Set[str] ) -> Dict[str, Any]: """ Get a modified dictionary without the requested keys Args: dictionary (Dict[str, Any]): Dictionary to modify according to. keys_to_delete (List[str]): Keys to not include in the modified dictionary. Returns: Dict[str, Any]: Modified dictionary without requested keys. """ keys_set = set(keys_to_delete) modified_dict: Dict[str, Any] = {} for key, value in dictionary.items(): if key not in keys_set: if isinstance(value, MutableMapping): modified_dict[key] = delete_keys_from_dict(value, keys_set) elif ( isinstance(value, MutableSequence) and len(value) > 0 and isinstance(value[0], MutableMapping) ): modified_dict[key] = [ delete_keys_from_dict(val, keys_set) for val in value ] else: modified_dict[key] = copy.deepcopy(value) return modified_dict def add_item_to_all_dictionaries( dictionaries: List[Dict[str, Any]], key: str, value: Any ) -> None: for dictionary in dictionaries: dictionary[key] = value def validate_query( accept_ipv4: bool, accept_url: bool, accept_sha256: bool, accept_filename: bool, query: str = None, ) -> bool: """ Check if the query is empty or the format is correct. Args: accept_ipv4 (bool): Validate IPv4. accept_url (bool): Validate URL. accept_sha256 (bool): Validate SHA256. accept_filename (bool): Validate Filename. query (str, optional): Query string in some format. Defaults to None. Returns: bool: Whether the query is correct or not. """ if not query: return True is_sha256 = accept_sha256 and sha256Regex.match(query) is_ipv4 = accept_ipv4 and re.match(ipv4Regex, query) is_url = accept_url and re.match(urlRegex, query) is_filename = accept_filename and re.match(FILENAME_REGEX, query) return any( ( is_sha256, is_ipv4, is_url, is_filename, ) ) def get_dbotscore( reliability: str, sha256: str = None, disposition: str = None ) -> Common.DBotScore: """ Get XSOAR score for the file's disposition. Args: reliability (str): Reliability of the source providing the intelligence data. sha256 (str, optional): SHA256 of the file. Defaults to None. disposition (str, optional): 3rd party score of the file's disposition. Defaults to None. Returns: Common.DBotScore: DBot Score according to the disposition. """ if disposition == "Malicious": score = Common.DBotScore.BAD elif disposition == "Clean": score = Common.DBotScore.GOOD else: score = Common.DBotScore.NONE return Common.DBotScore( indicator=sha256, indicator_type=DBotScoreType.FILE, integration_name="CiscoAMP", malicious_description=disposition, reliability=reliability, score=score, ) def combine_response_results( raw_response_list: List[Dict[str, Any]], is_automatic: bool = False ) -> Dict[str, Any]: """ If the pagination is automatic combine the results returned from all the http requests. Args: raw_response_list (List[Dict[str, Any]]): List of responses from the server. is_automatic (bool, optional): Whether the pagination is automatic. Defaults to False. Returns: Dict[str, Any]: Concatenated response from the server. """ concatenated_raw_response: Dict[str, Any] = raw_response_list[0] if not is_automatic: return concatenated_raw_response for raw_response in raw_response_list[1:]: concatenated_raw_response["metadata"]["results"][ "current_item_count" ] += dict_safe_get(raw_response, ["metadata", "results", "current_item_count"]) concatenated_raw_response["data"].extend(raw_response["data"]) concatenated_raw_response["metadata"]["results"][ "items_per_page" ] = concatenated_raw_response["metadata"]["results"]["current_item_count"] return concatenated_raw_response def get_context_output( response: Dict[str, Any], contexts_to_delete: List[str], item_to_add: Tuple[str, Any] = None, ) -> List[Dict[str, Any]]: """ Get context output from the response. Loop through each value and create a modified response without the contexts_to_delete. Args: response (List[Dict[str, Any]] | Dict[str, Any]): Raw response from the API. contexts_to_delete (List[str]): Context outputs to leave out. Returns: List[Dict[str, Any]]: Context output for the response. """ data_list = response.get("data") if not isinstance(data_list, List): data_list = [data_list] context_outputs: List[Dict[str, Any]] = [] for data in data_list: modified_data = delete_keys_from_dict(data, contexts_to_delete) context_outputs.append(modified_data) if item_to_add: for context_output in context_outputs: context_output |= { item_to_add[0]: item_to_add[1], } return context_outputs def get_results_readable_output(response: Dict[str, Any]) -> str: """ Get relevant information for the readable output. Args: response (Dict[str, Any]): Raw response from the API. Returns: str: Readable output for results in tableToMarkdown value. """ results = dict_safe_get(response, ["metadata", "results"]) if not results: return "" readable_output = tableToMarkdown( "Results", results, headerTransform=string_to_table_header, removeNull=True, ) return readable_output def get_readable_output( response: Dict[str, Any], header_by_keys: Dict[str, List[str]], keys_to_items_option_1: List[str], keys_to_items_option_2: List[str] = [], title: str = "", ) -> str: """ Get a response's readable output by formatting it through its headers. Args: response (Dict[str, Any]): API response. header_by_keys (Dict[str, List[str]]): headers by a list of keys to the response value. keys_to_items_option_1 (List[str]): list of keys 1st option to the response value. keys_to_items_option_2 (List[str], optional): list of keys to the response value, incase 1st failed. Defaults to None. title (str, optional): readable output title. Defaults to ''. Returns: str: readable output of the API response. """ if not (items := dict_safe_get(response, keys_to_items_option_1)): items = dict_safe_get(response, keys_to_items_option_2) if not items: return "" item_readable_arguments: List[Dict[str, Any]] = [] headers = [header for header in header_by_keys] if not isinstance(items, List): items = [items] for item in items: dictionary: Dict[str, Any] = {} for key, value in header_by_keys.items(): dictionary[key] = dict_safe_get(item, value) item_readable_arguments.append(dictionary) readable_output = tableToMarkdown( title, item_readable_arguments, headers=headers, removeNull=True, ) return readable_output def get_computer_readable_output(response: Dict[str, Any]) -> str: """ Get relevant information for the readable output. If the raw response is of a single computer, cast it to a list. Args: response (Dict[str, Any]): Raw response from the API. Returns: str: Readable output for computers in tableToMarkdown value. """ if not (computers := dict_safe_get(response, ["data", "computer"])): computers = response.get("data") if not isinstance(computers, List): computers = [computers] operating_system_format = "{operating_system} (Build {os_version})" readable_arguments: List[Dict[str, Any]] = [] for computer in computers: readable_arguments.append( { "Host Name": computer.get("hostname"), "Connector GUID": computer.get("connector_guid"), "Operating System": operating_system_format.format( operating_system=computer.get("operating_system"), os_version=computer.get("os_version"), ), "External IP": computer.get("external_ip"), "Group GUID": computer.get("group_guid"), "Policy GUID": dict_safe_get(computer, ["policy", "guid"]), } ) headers = [ "Host Name", "Connector GUID", "Operating System", "External IP", "Group GUID", "Policy GUID", ] readable_output = tableToMarkdown( "Computer Information", readable_arguments, headers=headers, removeNull=True, ) return readable_output def get_isolation_options_readable_output(response: requests.Response) -> str: """ Get relevant information for the readable output. Args: response (requests.Response): Raw response from the API. Returns: str: Readable output for isolation options. """ readable_output: str = "" options_string = response.headers.get("Allow") if not options_string: return readable_output options = options_string.split(", ") message_by_option = { "GET": "Can get information about an isolation with computer-isolation-get", "PUT": "Can request to create a new isolation with computer-isolation-create", "DELETE": "Can request to stop the isolation with computer-isolation-delete", } for option in options: if message := message_by_option.get(option): readable_output += f"{message}\n" return readable_output """ MAIN FUNCTION """ # pylint: disable=pointless-string-statement def main() -> None: """ Get the needed user's input params and initialize a Client with them. Check the user's input command with if statements and a dictionary. Raises: NotImplementedError: An error if the input command hasn't been implemented """ params: Dict[str, Any] = demisto.params() args: Dict[str, Any] = demisto.args() command = demisto.command() server_url = params["server_url"] client_id = params["credentials"]["identifier"] api_key = params["credentials"]["password"] verify_certificate = not params.get("insecure", False) reliability = params.get("integrationReliability", DBotScoreReliability.C) proxy = params.get("proxy", False) if DBotScoreReliability.is_valid_type(reliability): reliability = DBotScoreReliability.get_dbot_score_reliability_from_str( reliability ) else: raise Exception( "Please provide a valid value for the Source Reliability parameter." ) commands = { "cisco-amp-computer-list": computer_list_command, "cisco-amp-computer-trajectory-list": computer_trajectory_list_command, "cisco-amp-computer-user-activity-list": computer_user_activity_list_command, "cisco-amp-computer-user-trajectory-list": computer_user_trajectory_list_command, "cisco-amp-computer-vulnerabilities-list": computer_vulnerabilities_list_command, "cisco-amp-computer-move": computer_move_command, "cisco-amp-computer-delete": computer_delete_command, "cisco-amp-computer-activity-list": computer_activity_list_command, "cisco-amp-computer-isolation-feature-availability-get": computers_isolation_feature_availability_get_command, "cisco-amp-computer-isolation-get": computer_isolation_get_command, "cisco-amp-computer-isolation-create": computer_isolation_create_polling_command, "cisco-amp-computer-isolation-delete": computer_isolation_delete_polling_command, "cisco-amp-event-list": event_list_command, "cisco-amp-event-type-list": event_type_list_command, "cisco-amp-file-list-list": file_list_list_command, "cisco-amp-file-list-item-list": file_list_item_list_command, "cisco-amp-file-list-item-create": file_list_item_create_command, "cisco-amp-file-list-item-delete": file_list_item_delete_command, "cisco-amp-group-list": group_list_command, "cisco-amp-group-policy-update": group_policy_update_command, "cisco-amp-group-parent-update": group_parent_update_command, "cisco-amp-group-create": group_create_command, "cisco-amp-group-delete": groups_delete_command, "cisco-amp-indicator-list": indicator_list_command, "cisco-amp-policy-list": policy_list_command, "cisco-amp-app-trajectory-query-list": app_trajectory_query_list_command, "cisco-amp-version-get": version_get_command, "cisco-amp-vulnerability-list": vulnerability_list_command, "endpoint": endpoint_command, "file": file_command, } demisto.debug(f"Command being called is {command}") try: client = Client( server_url=server_url, api_key=api_key, client_id=client_id, verify=verify_certificate, reliability=reliability, proxy=proxy, ) if command == "test-module": return_results(test_module(client)) elif command == "fetch-incidents": incident_severities = argToList(params.get("incident_severities")) max_incidents_to_fetch = arg_to_number(params.get("max_fetch", FETCH_LIMIT)) event_types = argToList(params.get("event_types")) first_fetch_datetime = arg_to_datetime( arg=params["first_fetch"], arg_name="First fetch time", required=True ) if not isinstance(max_incidents_to_fetch, int): raise ValueError("Failed to get max fetch.") if not isinstance(first_fetch_datetime, datetime): raise ValueError("Failed to get first fetch time.") first_fetch_time = first_fetch_datetime.strftime(ISO_8601_FORMAT) next_run, incidents = fetch_incidents( client=client, last_run=demisto.getLastRun(), first_fetch_time=first_fetch_time, incident_severities=incident_severities, max_incidents_to_fetch=max_incidents_to_fetch, event_types=event_types, ) demisto.setLastRun(next_run) demisto.incidents(incidents) elif command in commands: return_results(commands[command](args=args, client=client)) else: raise NotImplementedError(f"Command doesn't exist - {command}") except Exception as exc: # pylint: disable=broad-except demisto.error(traceback.format_exc()) return_error(f"Failed to execute {command} command.\nError:\n{str(exc)}") if __name__ in ("__main__", "__builtin__", "builtins"): main()