CounterTack

Details

ID	`CounterTack`
Provider	SparkCognition
Category	Endpoint
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

CounterTack empowers endpoint security teams to assure endpoint protection for Identifying Cyber Threats. Integrating a predictive endpoint protection platform

Configure CounterTack in Cortex

Parameter	Required
Server URL (e.g. https://democloud.countertack.com)	True
User Name	True
Password	True
Use system proxy settings	False
Trust any certificate (not secure)	False
Fetch incidents	False
Incident type	False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)	False
Fetch notifications incidents	False
Fetch behviors incidents	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

countertack-get-endpoints

Returns information for endpoints.

Base Command

countertack-get-endpoints

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
CounterTack.Endpoint.IsQuarantined	boolean	Is the endpoint currently quarantined
CounterTack.Endpoint.MaxImpact	number	Impact of the highest scoring behavior
CounterTack.Endpoint.Memory	number	The RAM of the endpoint (in megabytes).
CounterTack.Endpoint.DriverVersion	string	Endpoint sensor version
CounterTack.Endpoint.ProfileVersion	string	Version of the current profile used for collection
CounterTack.Endpoint.BehaviorCount	number	Number of behaviors detected
CounterTack.Endpoint.CurrentProfile	string	Currently active analysis profile
CounterTack.Endpoint.Domain	string	DNS suffix for the endpoint
CounterTack.Endpoint.NumCpus	number	Number of CPUs
CounterTack.Endpoint.Macs	string	MAC addresses associated with the endpoint
CounterTack.Endpoint.WinRdpPort	number	RDP port used by the endpoint
CounterTack.Endpoint.Ip	string	IP address used to connect to the analysis cluster
CounterTack.Endpoint.ClusterHosts	string	The list of hosts that the endpoint tries to connect through (in order).
CounterTack.Endpoint.Vendor	string	OS vendor
CounterTack.Endpoint.SensorMode	string	Specifies the sensor mode of the driver
CounterTack.Endpoint.Identifier	string	OS identifier
CounterTack.Endpoint.CurrentResponsePolicy	string	Currently active response policy
CounterTack.Endpoint.Tenant	string	Tenant ID set at the time of KM installation
CounterTack.Endpoint.Name	string	Product name of the endpoint OS
CounterTack.Endpoint.ImpactLevel	string	Threat level of the endpoint.(LOW, MEDIUM, HIGH, CRITICAL)
CounterTack.Endpoint.Ips	string	IP addresses associated with the endpoint
CounterTack.Endpoint.ClusterConnectionRoute	string	List of hosts the endpoint is currently connected through
CounterTack.Endpoint.LastActive	date	Time of last event captured on the endpoint
CounterTack.Endpoint.TimeStarted	date	Time kernel module collection last engaged
CounterTack.Endpoint.Mac	string	The endpoint MAC address
CounterTack.Endpoint.EventStartTime	date	The time that the event was captured
CounterTack.Endpoint.CpuType	string	Bit length of the CPU architecture.
CounterTack.Endpoint.Status	string	Collection status of the endpoint (ON, PAUSE, OFF, INIT)
CounterTack.Endpoint.OsType	number	The OS type.
CounterTack.Endpoint.Version	string	OS version
CounterTack.Endpoint.Tags	string	List of user assigned tags
CounterTack.Endpoint.Threat	string	Threat level associated with the endpoint
CounterTack.Endpoint.Id	string	Endpoints ID
CounterTack.Endpoint.ProductName	string	Product name of the endpoint OS
Endpoint.Memory	number	Endpoint RAM (megabytes)
Endpoint.Processors	number	Number of CPUs
Endpoint.Domain	string	DNS suffix for the endpoint
Endpoint.OS	string	Product name of the endpoint OS
Endpoint.MACAddress	string	The MAC address of the endpoint.
Endpoint.Model	string	The analysis profile that is currently active.
Endpoint.IPAddress	string	The IP addresses that are associated with the endpoint.
Endpoint.OSVersion	string	The endpoint sensor version.
Endpoint.ID	string	The ID of the Endpoints.

countertack-get-behaviors

Returns information for all behaviors.

Base Command

countertack-get-behaviors

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
CounterTack.Behavior.MaxImpact	number	The impact of the highest scoring event (0-100)
CounterTack.Behavior.EndpointId	string	The ID of the endpoint, based on the UUID of the last installed endpoint sensor
CounterTack.Behavior.Tenant	string	The tenant of the behavior.
CounterTack.Behavior.EventCount	number	The number of events detected.
CounterTack.Behavior.Name	string	The name of the condition that triggered the behavior.
CounterTack.Behavior.ImpactLevel	string	The threat level of the behavior (LOW, MEDIUM, HIGH, CRITICAL).
CounterTack.Behavior.LastActive	date	The time that the behavior was last active.
CounterTack.Behavior.FirstEventId	date	The ID of the first event.
CounterTack.Behavior.TimeStamp	date	The start time for the behavior.
CounterTack.Behavior.Type	string	The type of behavior (CLASSIFICATION, TRACE)
CounterTack.Behavior.Id	string	The ID of the behaviors.
CounterTack.Behavior.LastReported	date	The time that the behavior was last seen.

countertack-get-endpoint

Get information on specific endpoint

Base Command

countertack-get-endpoint

Input

Argument Name	Description	Required
endpoint_id	The ID of the endpoint. To get the “endpoint_id”, run the `get-endpoints` command.	Required

Context Output

Path	Type	Description
CounterTack.Endpoint.MaxImpact	number	The impact of the highest scoring behavior.
CounterTack.Endpoint.Memory	number	The RAM of the endpoint (in megabytes)
CounterTack.Endpoint.DriverVersion	string	The sensor version of the endpoint.
CounterTack.Endpoint.ProfileVersion	string	The version of the current profile used for collection.
CounterTack.Endpoint.BehaviorCount	number	The number of behaviors that were detected.
CounterTack.Endpoint.CurrentProfile	string	The analysis profile that is currently active.
CounterTack.Endpoint.Domain	string	DNS suffix for the endpoint.
CounterTack.Endpoint.NumCpus	number	The number of CPUs for the endpoint.
CounterTack.Endpoint.WinRdpPort	number	The RDP port used by the endpoint.
CounterTack.Endpoint.Macs	string	The MAC addresses associated with the endpoint.
CounterTack.Endpoint.Ip	string	The IP address used to connect to the analysis cluster.
CounterTack.Endpoint.ClusterHosts	string	The list of hosts that the endpoint tries to connect through (in order).
CounterTack.Endpoint.Vendor	string	The OS vendor.
CounterTack.Endpoint.SensorMode	string	The sensor mode of the driver.
CounterTack.Endpoint.Identifier	string	The identifier of the OS.
CounterTack.Endpoint.Tenant	string	The tenant ID that was set at the time of KM installation.
CounterTack.Endpoint.Name	string	The machine name of the endpoint.
CounterTack.Endpoint.ImpactLevel	string	The threat level of the endpoint.
CounterTack.Endpoint.Ips	string	The IP addresses associated with the endpoint.
CounterTack.Endpoint.ClusterConnectionRoute	string	The list of hosts that the endpoint is currently connected through.
CounterTack.Endpoint.LastActive	date	The time of the last event that was captured on the endpoint.
CounterTack.Endpoint.TimeStarted	date	The first time that the endpoint started to work.
CounterTack.Endpoint.Mac	string	The MAC address of the endpoint.
CounterTack.Endpoint.EventStartTime	date	The time that the event was captured.
CounterTack.Endpoint.CpuType	number	The bit length of the CPU architecture.
CounterTack.Endpoint.Status	string	The collection status of the endpoint (ON, PAUSE, OFF, INIT).
CounterTack.Endpoint.OsType	number	The OS type.
CounterTack.Endpoint.Version	string	The version of the endpoint.
CounterTack.Endpoint.Threat	string	The threat level associated with the endpoint.
CounterTack.Endpoint.Id	string	The ID of the endpoint.
CounterTack.Endpoint.ProductName	string	The product name of the endpoint OS.
CounterTack.Endpoint.Tags	string	The list of user assigned tags.
CounterTack.Endpoint.IsQuarantined	boolean	Whether the endpoint is currently quarantined.
Endpoint.Memory	number	The RAM of the endpoint (in megabytes).
Endpoint.Processors	number	The number of CPUs.
Endpoint.Domain	string	The DNS suffix for the endpoint.
Endpoint.OS	string	The product name of the endpoint OS.
Endpoint.MACAddress	string	The MAC address of the endpoint.
Endpoint.Model	string	The analysis profile that is currently active.
Endpoint.IPAddress	string	The IP addresses associated with the endpoint.
Endpoint.OSVersion	string	The version of the endpoint sensor.

countertack-get-behavior

Gets information of a given behavior.

Base Command

countertack-get-behavior

Input

Argument Name	Description	Required
behavior_id	The ID of the behavior.	Required

Context Output

Path	Type	Description
CounterTack.Behavior.MaxImpact	number	The maximum impact of the behavior.
CounterTack.Behavior.EndpointId	string	The ID of the endpoint.
CounterTack.Behavior.Tenant	string	The tenant of the behavior.
CounterTack.Behavior.EventCount	number	The event count of the behavior.
CounterTack.Behavior.ReportedOn	date	The time that the behavior was first seen.
CounterTack.Behavior.Name	string	The name of the behavior.
CounterTack.Behavior.ImpactLevel	string	The impact level of the behavior.
CounterTack.Behavior.LastActive	date	The last time that the behavior was active.
CounterTack.Behavior.TimeStamp	date	The time stamp of the behavior.
CounterTack.Behavior.FirstEventId	string	The ID of the first event.
CounterTack.Behavior.Type	string	The type of behavior.
CounterTack.Behavior.Id	string	The ID of the behavior.
CounterTack.Behavior.LastReported	date	The time that the behavior was last seen.

countertack-get-endpoint-tags

Gets the tags of a given endpoint.

Base Command

countertack-get-endpoint-tags

Input

Argument Name	Description	Required
endpoint_id	The ID of the endpoint to get tags for.	Required

Context Output

Path	Type	Description
CounterTack.Endpoint.Tags	string	The list of user assigned tags.
CounterTack.Endpoint.EndpointId	string	The ID of the endpoints.

countertack-add-tags

Adds tags to a given endpoint.

Base Command

countertack-add-tags

Input

Argument Name	Description	Required
endpoint_id	The ID of the endpoint. To get the “endpoint_id”, run the `get-endpoints` command.	Required
tags	A CSV list of tags you want to add to the endpoint, for example, “test1,test2”.	Required

Context Output

Path	Type	Description
CounterTack.Endpoint.EndpointId	string	The ID of the endpoint.
CounterTack.Endpoint.Tags	string	The tags that were added to the endpoint.

countertack-delete-tags

Deletes the supplied tags from a given endpoint.

Base Command

countertack-delete-tags

Input

Argument Name	Description	Required
tags	The tags to be deleted from specified endpoint. To delete more then one, separate the tags with a comma. (e.g test1,test2).	Required
endpoint_id	The endpoint ID. Get the ID from the “get-endpoints” command.	Required

Context Output

Path	Type	Description
CounterTack.Endpoint.Id	string	The ID of the endpoint
CounterTack.Endpoint.Tags	string	The tags of the specified endpoint

countertack-add-behavior-tags

Adds tags to a given behavior.

Base Command

countertack-add-behavior-tags

Input

Argument Name	Description	Required
behaviour_id	The ID of the behavior.	Required
tags	A CSV list of tags to add to the behavior, for example, “test1,test2”.	Required

Context Output

Path	Type	Description
CounterTack.Behavior.Id	string	The ID of the behavior.
CounterTack.Behavior.Tags	string	The tags of the behavior.

countertack-delete-behavior-tags

Deletes the supplied tags from a given behavior.

Base Command

countertack-delete-behavior-tags

Input

Argument Name	Description	Required
behaviour_id	The behavior ID.	Required
tags	Tags to delete from a behavior. To delete more then one, separate the tags with a comma. (e.g test1,test2).	Required

Context Output

Path	Type	Description
CounterTack.Behavior.Id	string	The ID of the behavior.
CounterTack.Behavior.Tags	Unknown	The tags of the behavior.

countertack-endpoint-quarantine

Quarantines a given endpoint.

Base Command

countertack-endpoint-quarantine

Input

Argument Name	Description	Required
endpoint_id	The ID of the endpoint to quarantine.	Required

Context Output

Path	Type	Description
CounterTack.Endpoint.Id	string	The ID of the endpoint.
CounterTack.Endpoint.IsQuarantine	boolean	Is the endpoint currently quarantined.

countertack-disable-quarantine

Removes a given endpoint from quarantine.

Base Command

countertack-disable-quarantine

Input

Argument Name	Description	Required
endpoint_id	The ID of the endpoint to remove from quarantine.	Required

Context Output

Path	Type	Description
CounterTack.Endpoint.Id	string	The ID of the endpoint that was removed from quarantine.
CounterTack.Endpoint.IsQuarantine	string	Is the endpoint is currently quarantined.

countertack-extract-file

Extracts a file from given endpoint.

Base Command

countertack-extract-file

Input

Argument Name	Description	Required
endpoint_id	The ID of the endpoint to extract a file from.	Required
file_path	The path of the file to extract, for example, “C:\test1.txt”.	Required

Context Output

Path	Type	Description
CounterTack.File.CommandArg.contents	boolean	The contents of the extracted file.
CounterTack.File.CommandArg.extracted_ids	string	The IDs of the extracted file.
CounterTack.File.CommandArg.md5	boolean	The MD5 hash of the extracted file.
CounterTack.File.CommandArg.paths	string	The path of the extracted file.
CounterTack.File.CommandArg.sha256	boolean	The SHA-256 has of teh extracted file.
CounterTack.File.CommandArg.ssdeep	boolean	The ssdeep hash of the extracted file.
CounterTack.File.CommandArg	Unknown	The command arguments.
CounterTack.File.CommandName	string	The name of the command that is sent.
CounterTack.File.Username	string	The username of the user that requested the command.
CounterTack.File.TargetType	string	The type of resource or collection this command is being sent to.
CounterTack.File.Status	string	The status of the command (initial, pending, complete, error).
CounterTack.File.RequestTime	date	The time at which the client requested the command.
CounterTack.File.Id	string	The ID of the commands.
CounterTack.File.EndpointIds	string	The ID of the source this command is being sent to.

countertack-delete-file

Deletes a file from the given endpoint.

Base Command

countertack-delete-file

Input

Argument Name	Description	Required
endpoint_id	The ID of the endpoint to delete a file from.	Required
file_path	The path of the file to delete.	Required

Context Output

There is no context output for this command.

countertack-get-all-files

Gets all extracted files for all endpoints.

Base Command

countertack-get-all-files

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
CounterTack.File.Size	number	The size of the extracted file (in bytes).
CounterTack.File.EndpointId	string	The ID of the endpoint that contains the extracted file.
CounterTack.File.ExtractionTime	date	The time that the file was extracted.
CounterTack.File.Path	string	The full file system path of the extracted file, including the filename, as seen on the endpoint.
CounterTack.File.Sha256	string	The SHA-256 digest of the file contents.
CounterTack.File.Tenant	string	The tenant ID for the endpoint.
CounterTack.File.User	string	The name of the user requesting the file.
CounterTack.File.Ssdeep	string	The ssdeep digest of the file contents.
CounterTack.File.EndpointIp	string	The IP address of the endpoint with the extracted file.
CounterTack.File.AvCoverage	number	The percentage of AV engines that determined that the hash is malicious.
CounterTack.File.Status	string	The status of the contents.
CounterTack.File.VtStatus	string	The Virus Total report status.
CounterTack.File.EndpointName	string	The name of the endpoint with the extracted file.
CounterTack.File.Id	string	The file ID of the extracted file.
CounterTack.File.Md5	string	The MD5 digest of the file contents.
CounterTack.File.VtReportLocation	string	The VirusTotal report location path.
File.MD5	string	The MD5 digest of the file contents.
File.Path	string	The full file system path of the extracted file, including the filename, as seen on the endpoint.
File.SHA256	string	The SHA-256 digest of the file contents.
File.SSDeep	string	The ssdeep digest of the file contents.
File.Size	number	The size of the extracted file (in bytes).

countertack-get-endpoint-files

Returns all extracted files from a given endpoint.

Base Command

countertack-get-endpoint-files

Input

Argument Name	Description	Required
endpoint_id	The ID of the endpoint. To get the endpoint_id, run the `get-endpoints` command.	Required

Context Output

Path	Type	Description
CounterTack.File.Id	string	The file ID of the extracted file.
CounterTack.File.Status	string	The status of the contents.
CounterTack.File.EndpointId	string	The ID of the endpoint with the extracted file.
CounterTack.File.ExtractionTime	date	The time that the file was extracted.
CounterTack.File.Tenant	string	The tenant ID for the endpoint.
CounterTack.File.User	string	The name of the user requesting the file.
CounterTack.File.Path	string	The full file system path of the extracted file, including the filename, as seen on the endpoint.
CounterTack.File.Sha256	string	The SHA-256 digest of the file contents.
CounterTack.File.Ssdeep	string	The ssdeep digest of the file contents.
CounterTack.File.EndpointIp	string	The IP address of the endpoint with the extracted file.
CounterTack.File.VtStatus	string	The VirusTotal report status.
CounterTack.File.VtReportLocation	string	The location path of the VirusTotal report.
CounterTack.File.Size	number	The size of the extracted file (in bytes).
CounterTack.File.EndpointName	string	The name of the endpoint with the extracted file.
CounterTack.File.Md5	string	The MD5 digest of the file contents.
File.MD5	string	The MD5 digest of the file contents.
File.Path	string	The full file system path of the extracted file, including the filename, as seen on the endpoint.
File.SHA256	string	The SHA-256 digest of the file contents.
File.SSDeep	string	The ssdeep digest of the file contents.
File.Size	number	The size of the extracted file (bytes).

countertack-get-file-information

Gets the information of a given file.

Base Command

countertack-get-file-information

Input

Argument Name	Description	Required
file_id	The ID of the requested file. To get the “file_id”m run the `get-all-files` command.	Required

Context Output

Path	Type	Description
CounterTack.File.Size	number	The size of the extracted file (in bytes).
CounterTack.File.EndpointId	string	The ID of the endpoint with the extracted file.
CounterTack.File.ExtractionTime	date	The time that the file was extracted.
CounterTack.File.Path	string	Full file system path of the extracted file, including the filename, as seen on the endpoint.
CounterTack.File.Sha256	string	The SHA-256 digest of the file contents.
CounterTack.File.Tenant	string	The tenant ID for the endpoint.
CounterTack.File.User	string	The name of the user requesting the file.
CounterTack.File.Ssdeep	string	The ssdeep digest of the file contents.
CounterTack.File.EndpointIp	string	The IP address of the endpoint with the extracted file.
CounterTack.File.AvCoverage	number	The percentage of AV engines that determined that the hash is malicious.
CounterTack.File.Status	string	The status of the contents.
CounterTack.File.VtStatus	string	The status of the VirusTotal report.
CounterTack.File.EndpointName	string	The name of the endpoint with the extracted file.
CounterTack.File.Id	string	The ID of the extracted file.
CounterTack.File.Md5	string	The MD5 digest of the file contents.
CounterTack.File.VtReportLocation	string	The location path of the VirusTotal report.
File.MD5	string	The MD5 digest of the file contents.
File.Path	string	The full file system path of the extracted file, including the filename, as seen on the endpoint.
File.SHA256	string	The SHA-256 digest of the file contents.
File.SSDeep	string	The ssdeep digest of the file contents.
File.Size	number	The size of the extracted file (in bytes).

countertack-download-file

Downloads an extracted file in ZIP format. The password to unlock the ZIP file is sentinel.

Base Command

countertack-download-file

Input

Argument Name	Description	Required
file_id	The ID of the extracted file. To get the “file_id”, run the `get-all-files` command.	Required

Context Output

Path	Type	Description
File.Size	number	The size of the extracted file (in bytes).
File.SHA1	string	The SHA-1 digest of the file contents.
File.SHA256	string	The SHA-256 digest of the file contents.
File.Name	string	The name of the file.
File.SSDeep	string	The ssdeep digest of the file contents.
File.EntryID	string	The EntryID of the file.
File.Info	string	The file information.
File.Type	string	The file type.
File.MD5	string	The MD5 digest of the file contents.
File.Extension	string	The extension of the file (.zip).

countertack-search-events

Searches for events, using CQL expression.

Base Command

countertack-search-events

Input

Argument Name	Description	Required
expression	The CQL expression to be used for the search, for example, “events.event_type=basic”.	Required

Context Output

Path	Type	Description
CounterTack.Event.SourceProcessTimeStarted	date	The start time for the source process.
CounterTack.Event.SourceThreadProcessPid	number	The process PID of the source thread.
CounterTack.Event.IsTaintTransfer	boolean	Is the event a malignant transfer.
CounterTack.Event.IsBasic	boolean	Is the event a basic event.
CounterTack.Event.SourceThreadTimeFinished	date	The exit time of the source thread.
CounterTack.Event.SourceThreadTid	number	The TID of the source thread.
CounterTack.Event.Tenant	string	The tenant of the event.
CounterTack.Event.SourceThreadProcessTimeStarted	date	The start time of the parent process for the source thread.
CounterTack.Event.TargetType	string	The system object type that was target of the event (PROCESS, THREAD, REGISTRY, DRIVER, TCPIP,FILE, MUTEX, MEMORY_REGION).
CounterTack.Event.ConditionNames	Unknown	The names of the condition triggered by the event.
CounterTack.Event.IsOrigin	boolean	Is the event an origin for a trace.
CounterTack.Event.endpoint_id	string	The endpoint ID, based on the UUID of the last installed endpoint sensor.
CounterTack.Event.TargetFilePath	string	The path of the target file.
CounterTack.Events.SourceThreadProcessBackingFilePath	string	The backing file of the source thread.
CounterTack.Event.EventType	string	The type of event.
CounterTack.Event.IsKey	boolean	Is the event a key event in a trace.
CounterTack.Event.SourceType	string	The system object that was the source of the event.
CounterTack.Event.SourceThreadProcessName	string	The name of the parent process for the source thread.
CounterTack.Event.SourceThreadProcessUser	string	The user associated with the process of the thread.
CounterTack.Event.TimeStamp	date	The time that the event was collected.
CounterTack.Event.Action	string	The system interaction that characterizes the event.
CounterTack.Event.IsTainted	boolean	Are the objects in the event tainted.
CounterTack.Event.SourceThreadProcessParentPid	number	The parent PID of the source thread process.
CounterTack.Event.SourceProcessPid	number	The PID of the source process.
CounterTack.Event.SourceThreadStartAddress	number	The start address of the thread.
CounterTack.Event.SourceProcessSid	number	The user SIDs associated with the process.
CounterTack.Event.Id	string	The ID of the event.
CounterTack.Event.ConditionIds	Unknown	The IDs of the condition triggered by the event.
CounterTack.Event.SourceProcessName	string	The name of the process that was the source of the event.
CounterTack.Event.SourceProcessUser	string	The user associated with the process

countertack-kill-process

Terminates all instances of the process identified in the command. Processes can be identified by the PID or process name.

Base Command

countertack-kill-process

Input

Argument Name	Description	Required
endpoint_id	The ID of the endpoint. To get the “endpoint_id”, run the `get-endpoints` command.	Required
process_id	The process PID. To get the “process_id”, run the `search-events` command.	Optional
process_name	The name of the process. To get the “process_name”, run the `search-events` command.	Optional

Context Output

Path	Type	Description
CounterTack.Endpoint.EndpointIds	string	The ID of the source this command is being sent to.
CounterTack.Endpoint.TargetType	string	The type of resource or collection this command is being sent to.
CounterTack.Endpoint.CommandArg.name	string	The name of the process that was terminated.
CounterTack.Endpoint.CommandArg.pid	number	The PID of the process that was terminated.
CounterTack.Endpoint.CommandArg	string	The command arguments.
CounterTack.Endpoint.Status	string	The status of the command (initial, pending, complete, error).
CounterTack.Endpoint.CommandName	string	The name of the command that is sent.
CounterTack.Endpoint.Username	string	The username of the user that requested the command.
CounterTack.Endpoint.Id	string	The ID of the commands.
CounterTack.Endpoint.RequestTime	date	The time at which the client requested the command.

countertack-search-hashes

Searches for hashes using CQL expressions (Contextual Query Language) to represent queries.

Base Command

countertack-search-hashes

Input

Argument Name	Description	Required
expression	The CQL expression to be used for the search (e.g hashes.type = md5).	Required

Context Output

Path	Type	Description
CounterTack.Hash.AvCoverage	number	The percentage of AV engines that determined that the hash is malicious.
CounterTack.Hash.Id	string	The ID of the hashes.
CounterTack.Hash.Impact	number	The impact score for the event in the hash (1-100).
CounterTack.Hash.Type	string	The type of hash (sha256, md5, or ssdeep).
CounterTack.Hash.VtReportLocation	string	The report location for VirusTotal report.
File.MD5	string	The MD5 of the file
File.SHA256	string	The SHA-256 of the file.
File.SSDeep	string	The ssdeep of the file.

countertack-search-endpoints

Request for endpoints search using CQL expression (Contextual Query Language) to represent queries.

Base Command

countertack-search-endpoints

Input

Argument Name	Description	Required
expression	The CQL expression to be used for the search. (e.g endpoints.status=on).	Required

Context Output

Path	Type	Description
CounterTack.Endpoint.Memory	Number	The RAM of the endpoint (in megabytes).
CounterTack.Endpoint.CpuType	Number	Bit length of the CPU architecture.
CounterTack.Endpoint.WinRdpPort	Number	RDP port used by the endpoint
CounterTack.Endpoint.Macs	String	MAC addresses associated with the endpoint
CounterTack.Endpoint.Ip	String	IP address used to connect to the analysis cluster
CounterTack.Endpoint.Vendor	String	OS vendor
CounterTack.Endpoint.Identifier	String	OS identifier
CounterTack.Endpoint.Tenant	String	Tenant ID set at the time of KM installation
CounterTack.Endpoint.MaxImpact	Number	Impact of the highest scoring behavior
CounterTack.Endpoint.Name	String	Product name of the endpoint OS
CounterTack.Endpoint.Ips	String	IP addresses associated with the endpoint
CounterTack.Endpoint.CurrentResponsePolicy	String	Currently active response policy
CounterTack.Endpoint.ProfileVersion	String	Version of the current profile used for collection
CounterTack.Endpoint.CurrentProfile	String	Currently active analysis profile
CounterTack.Endpoint.DriverVersion	String	Endpoint sensor version
CounterTack.Endpoint.NumCpus	Number	Number of CPUs
CounterTack.Endpoint.ClusterConnectionRoute	String	List of hosts the endpoint is currently connected through
CounterTack.Endpoint.ClusterHosts	String	The list of hosts that the endpoint tries to connect through (in order).
CounterTack.Endpoint.Status	String	Collection status of the endpoint (ON, PAUSE, OFF, INIT)
CounterTack.Endpoint.TimeStarted	Date	Time kernel module collection last engaged
CounterTack.Endpoint.EventStartTime	Date	The time that the event was captured
CounterTack.Endpoint.Version	String	OS version
CounterTack.Endpoint.Threat	String	Threat level associated with the endpoint
CounterTack.Endpoint.ProductName	String	Product name of the endpoint OS
CounterTack.Endpoint.Id	String	Endpoints ID
CounterTack.Endpoint.LastActive	Date	Time of last event captured on the endpoint
CounterTack.Endpoint.SensorMode	String	Specifies the sensor mode of the driver
CounterTack.Endpoint.BehaviorCount	Number	Number of behaviors detected
CounterTack.Endpoint.ImpactLevel	String	Threat level of the endpoint.(LOW, MEDIUM, HIGH, CRITICAL)
CounterTack.Endpoint.OsType	Number	The OS type.
Endpoint.Memory	Number	Endpoint RAM (megabytes)
Endpoint.Processors	Number	Number of CPUs
Endpoint.Domain	String	DNS suffix for the endpoint
Endpoint.OS	String	Product name of the endpoint OS
Endpoint.MACAddress	String	The MAC address of the endpoint.
Endpoint.Model	String	The analysis profile that is currently active.
Endpoint.IPAddress	String	The IP addresses that are associated with the endpoint.
Endpoint.OSVersion	String	The endpoint sensor version.
Endpoint.Id	String	The ID of the Endpoints.

countertack-search-behaviors

Request for behaviors search using CQL expression (Contextual Query Language) to represent queries.

Base Command

countertack-search-behaviors

Input

Argument Name	Description	Required
expression	The CQL expression to be used for the search(e.g behaviors.event_count<60).	Required

Context Output

Path	Type	Description
CounterTack.Behavior.FirstEventId	String	The ID of the first event.
CounterTack.Behavior.LastReported	Date	The time that the behavior was last seen.
CounterTack.Behavior.Tenant	String	The tenant of the behavior.
CounterTack.Behavior.MaxImpact	Number	The impact of the highest scoring event (0-100)
CounterTack.Behavior.Name	String	The name of the condition that triggered the behavior.
CounterTack.Behavior.EndpointId	String	The ID of the endpoint, based on the UUID of the last installed endpoint sensor
CounterTack.Behavior.ReportedOn	Date	The time that the behavior was first seen.
CounterTack.Behavior.EventCount	Number	The number of events detected.
CounterTack.Behavior.TimeStamp	Date	The start time for the behavior.
CounterTack.Behavior.Type	String	The type of behavior (CLASSIFICATION, TRACE)
CounterTack.Behavior.Id	String	The ID of the behaviors.
CounterTack.Behavior.LastActive	Date	The time that the behavior was last active.
CounterTack.Behavior.ImpactLevel	String	The threat level of the behavior (LOW, MEDIUM, HIGH, CRITICAL).

Configuration parameters

server — Server URL (e.g. https://democloud.countertack.com) (required)
credentials — User Name (required)
proxy — Use system proxy settings
unsecure — Trust any certificate (not secure)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
fetch_notifications — Fetch notifications incidents
fetch_behviors — Fetch behviors incidents

Commands (22)

countertack-add-behavior-tags
Adds tags to a given behavior.
countertack-add-tags
Adds tags to a given endpoint.
countertack-delete-behavior-tags
Deletes the supplied tags from a given behavior.
countertack-delete-file
Deletes a file from the given endpoint.
countertack-delete-tags
Deletes the supplied tags from a given endpoint.
countertack-disable-quarantine
Removes a given endpoint from quarantine.
countertack-download-file
Downloads an extracted file in ZIP format. The password to unlock the ZIP file is `sentinel`.
countertack-endpoint-quarantine
Quarantines a given endpoint.
countertack-extract-file
Extracts a file from given endpoint.
countertack-get-all-files
Gets all extracted files for all endpoints.
countertack-get-behavior
Gets information of a given behavior.
countertack-get-behaviors
Returns information for all behaviors.
countertack-get-endpoint
Get information on specific endpoint
countertack-get-endpoint-files
Returns all extracted files from a given endpoint.
countertack-get-endpoint-tags
Gets the tags of a given endpoint.
countertack-get-endpoints
Returns information for endpoints.
countertack-get-file-information
Gets the information of a given file.
countertack-kill-process
Terminates all instances of the process identified in the command. Processes can be identified by the PID or process name.
countertack-search-behaviors
Request for behaviors search using CQL expression (Contextual Query Language) to represent queries.
countertack-search-endpoints
Request for endpoints search using CQL expression (Contextual Query Language) to represent queries.
countertack-search-events
Searches for events, using CQL expression.
countertack-search-hashes
Searches for hashes using CQL expressions (Contextual Query Language) to represent queries.

Source

CounterTack.py CounterTack.yml CounterTack_description.md

Download History Raw