Endgame

commonfields:
  id: Endgame
  version: -1
name: Endgame
display: Endgame
category: Endpoint
provider: Elastic
description: Endpoint protection built to stop advanced attacks before damage and loss occurs.
configuration:
- display: 'Server URL (Example: https://me.endgame.com:2443)'
  name: url
  defaultvalue: https://localhost:2443
  type: 0
  required: true
- display: Username
  name: username
  defaultvalue: ""
  type: 9
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  defaultvalue: "false"
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: endgame-deploy
    arguments:
    - name: domain
      required: true
      description: Deployment domain.
    - name: username
      required: true
      description: Machine username.
    - name: password
      required: true
      description: Machine password.
    - name: api_key
      required: true
      description: API key.
    - name: deployment_profile
      required: true
      description: The ID of the sensor profile to be deployed. To get the ID, run the `!endgame-get-deployment-profiles` command.
    - name: endpoints_transaction_id
      description: The ID of the last transaction. To get the ID, run the `!endgame-get-unmanaged-endpoints` command or the `endgame-get-endpoint-status` command. The value is available from the ${EndGame.TransactionID} context key.
    - name: endpoint_ids
      description: The IDs of endpoints to be deployed. Must also provide IPs. To get the IDs, run the `!endgame-get-unmanaged-endpoints` command, and copy the ID (not to be confused with the machine ID).
    - name: endpoint_ips
      description: The IP addresses of endpoints to be deployed. Must also provide IDs.
    outputs:
    - contextPath: EndGame.Deployment.DeploymentProfile
      description: The deployed sensor profile.
    - contextPath: EndGame.Deployment.Domain
      description: The deployed domain.
    - contextPath: EndGame.Deployment.Submitted.Id
      description: Deploy ID.
    description: 'Deploy sensor profile to unmanaged endpoints. '
  - name: endgame-get-deployment-profiles
    arguments: []
    outputs:
    - contextPath: EndGame.SensorProfiles.ApiKey
      description: API Key of sensor profile.
    - contextPath: EndGame.SensorProfiles.Id
      description: ID of sensor profile.
    - contextPath: EndGame.SensorProfiles.SensorDirectory
      description: DIrectory of the sensor profile.
    - contextPath: EndGame.SensorProfiles.Name
      description: Name of sensor profile.
    - contextPath: EndGame.SensorProfiles.UpdatedAt
      description: Last time sensor was updated.
    - contextPath: EndGame.SensorProfiles.Receiver
      description: Receiver IP address.
    - contextPath: EndGame.SensorProfiles.CreatedAt
      description: Date and time sensor was created.
    - contextPath: EndGame.SensorProfiles.SensorVersion
      description: Version of sensor.
    - contextPath: EndGame.SensorProfiles.Config
      description: Sensor profile configuration.
    description: Get all deployment (sensor) profiles
  - name: endgame-get-unmanaged-endpoints
    arguments: []
    outputs:
    - contextPath: EndGame.TransactionID
      description: ID of transaction to use when deploying.
    - contextPath: EndGame.Endpoints.MachineId
      description: Endgame ID of the machine.
    - contextPath: EndGame.Endpoints.CoreOs
      description: Core OS of the machine.
    - contextPath: EndGame.Endpoints.Name
      description: Name of the machine.
    - contextPath: EndGame.Endpoints.Status
      description: Status of hte machine.
    - contextPath: EndGame.Endpoints.IpAddress
      description: IP address of the machine.
    - contextPath: EndGame.Endpoints.UpdatedAt
      description: Last updates time.
    - contextPath: EndGame.Endpoints.ID
      description: Endpoint ID.
    description: Get all unmanaged endpoint details
  - name: endgame-get-endpoint-status
    arguments:
    - name: ip_address
      description: IP address of machine.
    - name: name
      description: Name of machine.
    - name: machine_id
      description: EndGame machine ID.
    outputs:
    - contextPath: EndGame.TransactionID
      description: id of transaction to use when deploying.
    - contextPath: EndGame.Endpoints.MachineId
      description: Endgame id of the machine.
    - contextPath: EndGame.Endpoints.CoreOs
      description: Core OS of the machine.
    - contextPath: EndGame.Endpoints.Name
      description: Name of the machine.
    - contextPath: EndGame.Endpoints.Status
      description: Status of hte machine.
    - contextPath: EndGame.Endpoints.IpAddress
      description: IP address of the machine.
    - contextPath: EndGame.Endpoints.UpdatedAt
      description: Last updates time.
    description: Get specified endpoint status. Must provide at least one argument
  - name: endgame-create-sensor-profile
    arguments:
    - name: name
      required: true
      description: Name of sensor profile.
    - name: transceiver
      required: true
      description: Transceiver address of sensor profile.
    - name: sensor_version
      required: true
      description: Version of sensor profile.
    - name: api_key
      required: true
      description: API key of sensor profile.
    - name: sensor_directory
      required: true
      description: Sensor profile directory.
    outputs:
    - contextPath: EndGame.SensorProfiles.Id
      description: EndGame ID of created sensor profile.
    - contextPath: EndGame.SensorProfiles.Name
      description: Name of created sensor profile.
    description: Create deployment (sensor) profile
  - name: endgame-get-investigations
    arguments: []
    outputs:
    - contextPath: EndGame.Investigations.TaskCompletion
      description: Task completion status.
    - contextPath: EndGame.Investigations.Name
      description: Name of investigation.
    - contextPath: EndGame.Investigations.EndpointCount
      description: Number of endpoints for investigation.
    - contextPath: EndGame.Investigations.CreatedAt
      description: Time created.
    - contextPath: EndGame.Investigations.UpdatedAt
      description: Time last updated.
    - contextPath: EndGame.Investigations.UserDisplayName
      description: Display name of user that created th investigation.
    - contextPath: EndGame.Investigations.CoreOs
      description: Core OS of investigation.
    description: Get all endgame investigations
  - name: endgame-create-investigation
    arguments:
    - name: investigation_name
      required: true
      description: Name of investigation.
    - name: sensors
      description: Sensor ID's of machines to investigate. Overrides endpoints argument.
    - name: endpoints
      description: Names of machines to investigate. Overridden by sensors argument.
    - name: assign_to
      description: Default is the username given in the instance credentials.
    - name: network_local_ip
      description: local ip address for network search.
    - name: network_protocol
      description: protocol for netwprk search.
    - name: network_remote_ips
      description: remote ips (comma separated) for network search.
    - name: network_port
      description: port for network search.
    - name: network_remote
      description: true for remote, false otherwise. Used for network search.
    - name: process
      description: name of process to search.
    - name: process_sha1s
      description: sha1s of process (comma separated).
    - name: process_md5s
      description: md5s of process (comma separated).
    - name: process_sha256s
      description: sha256s of process (comma separated).
    - name: file_dir
      description: Directory of file to search.
      defaultValue: 'C:'
    - name: file_regexes
      description: regexes of file to search.
    - name: file_sha256s
      description: sha256s of files to search (comma separated).
    - name: file_sha1s
      description: sha1s of files to search (comma separated).
    - name: file_md5s
      description: md5s of files to search (comma separated).
    - name: registry_key
      description: Registry Key or Value Name Containing.
    - name: registry_max_size
      description: max size of registry to search.
    - name: registry_min_size
      description: min size of registry to search.
    - name: user_search_domain
      description: Domain to search.
    - name: user_search
      description: username to search.
    outputs:
    - contextPath: EndGame.Investigations.Id
      description: Id of created investigation.
    description: 'Create endgame IOC investigation. '
  - name: endgame-get-sensor
    arguments:
    - name: sensor_id
      required: true
      description: ID of sensor profile.
    outputs:
    - contextPath: EndGame.SensorProfiles.Config
      description: Sensor profile configuration details.
    - contextPath: EndGame.SensorProfiles.ApiKey
      description: API key of sesnor profile.
    - contextPath: EndGame.SensorProfiles.AccountId
      description: Account ID.
    - contextPath: EndGame.SensorProfiles.Name
      description: Name of sensor profile.
    - contextPath: EndGame.SensorProfiles.UpdatedAt
      description: Date and time sensor was last changed.
    - contextPath: EndGame.SensorProfiles.Receiver
      description: Receiver of sensor profile.
    - contextPath: EndGame.SensorProfiles.SensorDirectory
      description: Directory of sensor profile.
    - contextPath: EndGame.SensorProfiles.Deleted
      description: Is sensor profile deleted.
    - contextPath: EndGame.SensorProfiles.CreatedAt
      description: Date and time sensor profile was created.
    - contextPath: EndGame.SensorProfiles.Id
      description: Id of sensor.
    - contextPath: EndGame.SensorProfiles.SensorVersion
      description: Version of given sensor.
    description: Get sensor data by id
  - name: endgame-investigation-results
    description: Get investigation results by id
    arguments:
    - name: investigation_id
      description: Id of investigation.
    outputs:
    - contextPath: EndGame.InvestigationResults.Files
      description: File investigation results.
    - contextPath: EndGame.InvestigationResults.Usernames
      description: Username investigation results.
    - contextPath: EndGame.InvestigationResults.Processes
      description: Processes investigation results.
    - contextPath: EndGame.InvestigationResults.Registries
      description: Registries investigation results.
    - contextPath: EndGame.InvestigationResults.Networks
      description: Networks investigation results.
  - name: endgame-investigation-status
    arguments:
    - name: investigation_id
      required: true
      description: Id of investigation.
    outputs:
    - contextPath: EndGame.Investigations.Id
      description: Endgame ID of investigation.
    - contextPath: EndGame.Investigations.Status
      description: Endgame investigation status.
    description: Returns the current investigation status
tests:
- No test - no instance
fromversion: 5.0.0