Fidelis EDR
Use the Fidelis Endpoint integration for advanced endpoint detection and response (EDR) across Windows, Mac and Linux OSes for faster threat remediation.
Endpoint · Fidelis Endpoint
Details
| ID | Fidelis EDR |
|---|---|
| Provider | Skyview Capital |
| Category | Endpoint |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Overview
Use the Fidelis Endpoint integration for advanced endpoint detection and response (EDR) across Windows, Mac and Linux OSes for faster threat remediation.
This integration was integrated and tested with version 9.2 of Fidelis EDR.
The account must have appropriate permissions to execute API calls. While you could use an administrator account, use an account designated for executing API calls.
To Get the appropriate permissions navigate to Configuration > Roles > Create a role > Permissions
Use Cases
- Fetch Alerts
- Get Alert Details
- Download File to Cortex XSOAR
- Execute Script on Endpoint
- query / search the Logs on Fidelis Console
- Navigate to Settings > Integrations > Servers & Services.
- Search for Fidelis EDR.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Server URL (e.g.
https://abcde.fideliscloud.com/) - Username
- Incident type
- Fetch incidents
- First fetch timestamp (“number time unit”, e.g., 12 hours, 7 days, 3 months, 1 year)
- Fetch limit (minimum 5)
- Trust any certificate (not secure)
- Use system proxy settings
- Click Test to validate the URLs, token, and connection.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
- fidelis-endpoint-list-alerts
- fidelis-endpoint-host-info
- fidelis-endpoint-file-search
- fidelis-endpoint-file-search-status
- fidelis-endpoint-file-search-result-metadata
- fidelis-endpoint-get-file
- fidelis-endpoint-delete-file-search-job
- fidelis-endpoint-list-scripts
- fidelis-endpoint-get-script-manifest
- fidelis-endpoint-list-processes
- fidelis-endpoint-get-script-result
- fidelis-endpoint-kill-process
- fidelis-endpoint-delete-file
- fidelis-endpoint-isolate-network
- fidelis-endpoint-remove-network-isolation
- fidelis-endpoint-script-job-status
- fidelis-endpoint-execute-script
- fidelis-endpoint-query-file
- fidelis-endpoint-query-process
- fidelis-endpoint-query-connection-by-remote-ip
- fidelis-endpoint-query-by-dns
- fidelis-endpoint-query-dns-by-server-ip
- fidelis-endpoint-query-dns-by-source-ip
- fidelis-endpoint-query-events
1. fidelis-endpoint-list-alerts
Returns all alerts in the system.
Required Permissions
The required permissions: View Alerts
Base Command
fidelis-endpoint-list-alerts
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | The maximum number of alerts to return. | Optional |
| sort | Sorts the result before applying take and skip. Can be any property name of the alert object. For example: “insertionDate Descending” |
Optional |
| start_date | The start of the time range of returned values in UTC format. For example: 0001-01-01T00:00:00Z | Optional |
| end_date | The end of the time range of returned values in UTC format. For example: 0001-01-01T00:00:00Z | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Alert.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Alert.IntelName | String | Intel name. |
| FidelisEndpoint.Alert.HasJob | Boolean | Whether the alert has an open job. |
| FidelisEndpoint.Alert.EventTime | Date | Alert event time. |
| FidelisEndpoint.Alert.ActionsTaken | String | The actions taken for this alert. |
| FidelisEndpoint.Alert.CreateDate | Date | Alert creation date. |
| FidelisEndpoint.Alert.ParentEventID | String | Parent event ID. |
| FidelisEndpoint.Alert.Name | String | Alert name. |
| FidelisEndpoint.Alert.ReportID | String | Report ID. |
| FidelisEndpoint.Alert.EndpointID | String | Endpoint ID. |
| FidelisEndpoint.Alert.IntelID | String | Intel ID. |
| FidelisEndpoint.Alert.Name | String | Alert Name. |
| FidelisEndpoint.Alert.EventType | Number | Event Type. |
| FidelisEndpoint.Alert.EventID | String | Event ID. |
| FidelisEndpoint.Alert.SourceType | Number | Source type. |
| FidelisEndpoint.Alert.AgentTag | String | Agent tag. |
| FidelisEndpoint.Alert.EventIndex | Number | Event index. |
| FidelisEndpoint.Alert.Telemetry | String | Telemetry data. |
| FidelisEndpoint.Alert.Source | String | Alert source. |
| FidelisEndpoint.Alert.ID | Number | Alert ID. |
| FidelisEndpoint.Alert.ValidatedDate | Date | Validation date. |
| FidelisEndpoint.Alert.Description | String | Alert description. |
| FidelisEndpoint.Alert.InsertionDate | Date | Alert insertion date. |
| FidelisEndpoint.Alert.Severity | Number | Alert severity. |
| FidelisEndpoint.Alert.ArtifactName | String | Artifact name. |
Command Example
!fidelis-endpoint-list-alerts limit="5"
Context Example
{
"FidelisEndpoint.Alert": [
{
"Severity": 2,
"IntelName": null,
"Telemetry": null,
"Source": "Installed Software CVE",
"InsertionDate": "2020-03-21T00:06:38.940Z",
"IntelID": null,
"HasJob": false,
"Description": "2 new vulnerable software installed today:\n\n[[!0::rsyslog:8.24.0:]]\r\nHighest Severity: High\r\nEndpoints: 1\r\n\u2022 [[!0::rsyslog:8.24.0:CVE-2017-12588]] - High\r\nThe zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a format string attack with unspecified impact.\r\n\u2022 [[!0::rsyslog:8.24.0:CVE-2018-16881]] - Medium\r\nA denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0 are vulnerable.\r\n\r\n[[!0::binutils:2.27:]]\r\nHighest Severity: Medium\r\nEndpoints: 1\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12448]] - Medium\r\nThe bfd_cache_close function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a heap use after free and possibly achieve code execution via a crafted nested archive file. This issue occurs...\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12449]] - Medium\r\nThe _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12450]] - Medium\r\nThe alpha_vms_object_p function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted vms alpha file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12451]] - Medium\r\nThe _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds stack read via a crafted COFF image file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12452]] - Medium\r\nThe bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted mach-o file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12453]] - Medium\r\nThe _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12454]] - Medium\r\nThe _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12455]] - Medium\r\nThe evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12456]] - Medium\r\nThe read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12457]] - Medium\r\nThe bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a NULL dereference via a crafted file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12458]] - Medium\r\nThe nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted nlm file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12459]] - Medium\r\nThe bfd_mach_o_read_symtab_strtab function in bfd/mach-o.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted mach-o file.\r\n\u2022 [[!0::binutils:2.27:CVE-2018-19931]] - Medium\r\nAn issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted.\r\n\u2022 [[!0::binutils:2.27:CVE-2018-1000876]] - Medium\r\nbinutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be...\r\n\u2022 [[!0::binutils:2.27:CVE-2018-19932]] - Medium\r\nAn issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c.\r\n\u2022 [[!0::binutils:2.27:CVE-2018-20671]] - Medium\r\nload_specific_debug_section in objdump.c in GNU Binutils through 2.31.1 contains an integer overflow vulnerability that can trigger a heap-based buffer overflow via a crafted section size.\r\n\u2022 [[!0::binutils:2.27:CVE-2019-1010204]] - Medium\r\nGNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an...\r\n\r\n",
"EventType": null,
"EventIndex": null,
"ArtifactName": null,
"CreateDate": "2020-03-19T23:59:59.999Z",
"EventTime": null,
"Name": "Vulnerable Software Installed - 3/19/2020",
"ParentEventID": null,
"EndpointName": "fidelis-endpoint.windows",
"ReportID": null,
"ActionsTaken": null,
"ID": 437,
"EventID": null,
"ValidatedDate": null,
"SourceType": 19,
"AgentTag": null,
"EndpointID": "70815600-2b9c-4cbe-971f-ab5601ed1ce1"
},
{
"Severity": 3,
"IntelName": "CVE-2013-1753",
"Telemetry": null,
"Source": "Installed Software CVE",
"InsertionDate": "2020-03-12T09:21:27.021Z",
"IntelID": null,
"HasJob": false,
"Description": "python - 2.7.5\n\nThe gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request.",
"EventType": null,
"EventIndex": null,
"ArtifactName": null,
"CreateDate": "2020-03-12T09:21:27.021Z",
"EventTime": null,
"Name": "Vulnerable Software - CVE-2013-1777",
"ParentEventID": null,
"EndpointName": "fidelis-endpoint.windows",
"ReportID": null,
"ActionsTaken": null,
"ID": 436,
"EventID": null,
"ValidatedDate": null,
"SourceType": 19,
"AgentTag": null,
"EndpointID": "70815600-2b9c-4cbe-971f-ab5601ed1ce1"
},
{
"Severity": 4,
"IntelName": "CVE-2020-10029",
"Telemetry": null,
"Source": "Installed Software CVE",
"InsertionDate": "2020-03-07T09:21:24.356Z",
"IntelID": null,
"HasJob": false,
"Description": "glibc - 2.17\n\nThe GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.",
"EventType": null,
"EventIndex": null,
"ArtifactName": null,
"CreateDate": "2020-03-07T09:21:24.356Z",
"EventTime": null,
"Name": "Vulnerable Software - CVE-2020-10029",
"ParentEventID": null,
"EndpointName": "fidelis-endpoint.windows",
"ReportID": null,
"ActionsTaken": null,
"ID": 435,
"EventID": null,
"ValidatedDate": null,
"SourceType": 19,
"AgentTag": null,
"EndpointID": "70815600-2b9c-4cbe-971f-ab5601ed1ce1"
},
{
"Severity": 2,
"IntelName": "CVE-2015-8710",
"Telemetry": null,
"Source": "Installed Software CVE",
"InsertionDate": "2020-02-27T09:21:03.253Z",
"IntelID": null,
"HasJob": false,
"Description": "libxml2 - 2.9.1\n\nThe htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.",
"EventType": null,
"EventIndex": null,
"ArtifactName": null,
"CreateDate": "2020-02-27T09:21:03.253Z",
"EventTime": null,
"Name": "Vulnerable Software - CVE-2015-8710",
"ParentEventID": null,
"EndpointName": "fidelis-endpoint.windows",
"ReportID": null,
"ActionsTaken": null,
"ID": 434,
"EventID": null,
"ValidatedDate": null,
"SourceType": 19,
"AgentTag": null,
"EndpointID": "70815600-2b9c-4cbe-971f-ab5601ed1ce1"
},
{
"Severity": 2,
"IntelName": "CVE-2014-4650",
"Telemetry": null,
"Source": "Installed Software CVE",
"InsertionDate": "2020-02-27T09:21:03.253Z",
"IntelID": null,
"HasJob": false,
"Description": "python - 2.7.5\n\nThe CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.",
"EventType": null,
"EventIndex": null,
"ArtifactName": null,
"CreateDate": "2020-02-27T09:21:03.253Z",
"EventTime": null,
"Name": "Vulnerable Software - CVE-2014-4444",
"ParentEventID": null,
"EndpointName": "fidelis-endpoint.windows",
"ReportID": null,
"ActionsTaken": null,
"ID": 433,
"EventID": null,
"ValidatedDate": null,
"SourceType": 19,
"AgentTag": null,
"EndpointID": "70815600-2b9c-4cbe-971f-ab5601ed1ce1"
}
]
}
Human Readable Output
Fidelis Endpoint Alerts
| ID | Name | EndpointName | EndpointID | Source | IntelName | Severity | CreateDate |
|---|---|---|---|---|---|---|---|
| 437 | Vulnerable Software Installed - 3/19/2020 | fidelis-endpoint.windows | 70815600-2b9c-4cbe-971f-ab5601ed1ce1 | Installed Software CVE | 2 | 2020-03-19T23:59:59.999Z | |
| 436 | Vulnerable Software - CVE-2013-1777 | fidelis-endpoint.windows | 70815600-2b9c-4cbe-971f-ab5601ed1ce1 | Installed Software CVE | CVE-2013-1753 | 3 | 2020-03-12T09:21:27.021Z |
| 435 | Vulnerable Software - CVE-2020-10029 | fidelis-endpoint.windows | 70815600-2b9c-4cbe-971f-ab5601ed1ce1 | Installed Software CVE | CVE-2020-10029 | 4 | 2020-03-07T09:21:24.356Z |
| 434 | Vulnerable Software - CVE-2015-8710 | fidelis-endpoint.windows | 70815600-2b9c-4cbe-971f-ab5601ed1ce1 | Installed Software CVE | CVE-2015-8710 | 2 | 2020-02-27T09:21:03.253Z |
| 433 | Vulnerable Software - CVE-2014-4444 | fidelis-endpoint.windows | 70815600-2b9c-4cbe-971f-ab5601ed1ce1 | Installed Software CVE | CVE-2014-4650 | 2 | 2020-02-27T09:21:03.253Z |
2. fidelis-endpoint-host-info
Searches for endpoints based on an IP address or hostname.
Base Command
fidelis-endpoint-host-info
Input
| Argument Name | Description | Required |
|---|---|---|
| ip_address | The IP address to search for. | Optional |
| host | The host name to search for. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Host.AgentVersion | String | The agent version. |
| FidelisEndpoint.Host.MacAddress | String | Host MAC address. |
| FidelisEndpoint.Host.OS | String | Endpoint OS. |
| FidelisEndpoint.Host.IPAddress | String | Endpoint IP address. |
| FidelisEndpoint.Host.Isolated | Boolean | Whether the endpoint is isolated. |
| FidelisEndpoint.Host.AV_Enabled | Boolean | Whether AV is enabled. |
| FidelisEndpoint.Host.Hostname | String | Host name. |
| FidelisEndpoint.Host.AgentInstalled | Boolean | Whether an agent was installed. |
| FidelisEndpoint.Host.Groups | String | Endpoint groups. |
| FidelisEndpoint.Host.LastContactDate | Date | Host last contact date. |
| FidelisEndpoint.Host.ID | String | Host ID. |
| FidelisEndpoint.Host.ProcessorName | String | Processor name. |
| FidelisEndpoint.Host.OnNetwork | Boolean | Whether the host is on the network. |
Command Example
!fidelis-endpoint-host-info ip_address="2.2.2.2"
Context Example
{
"Endpoint": [
{
"MACAddress": "23:01:0a:50:00:02",
"IPAddress": "2.2.2.2",
"Hostname": "fidelis-endpoint.windows",
"Processor": "Intel(R) Xeon(R) CPU @ 2.30GHz",
"OS": "CentOS Linux 7 (Core) Linux x64",
"ID": "70815600-2b9c-4cbe-971f-ab5601ed1ce1"
}
],
"FidelisEndpoint.Host": [
{
"AV_Enabled": true,
"LastContactDate": "2020-03-26T04:35:02.2887847",
"OS": "CentOS Linux 7 (Core) Linux x64",
"Hostname": "fidelis-endpoint.windows",
"Isolated": false,
"MacAddress": "23:01:0a:50:00:02",
"AgentVersion": "9.2.4.31",
"Groups": null,
"AgentInstalled": true,
"OnNetwork": true,
"ProcessorName": "Intel(R) Xeon(R) CPU @ 2.30GHz",
"IPAddress": "2.2.2.2",
"ID": "70815600-2b9c-4cbe-971f-ab5601ed1ce1"
}
]
}
Human Readable Output
Fidelis Endpoint Host Info
| ID | OS | MacAddress | Isolated | LastContactDate | AgentInstalled | AgentVersion | OnNetwork | AV_Enabled | ProcessorName |
|---|---|---|---|---|---|---|---|---|---|
| 70815600-2b9c-4cbe-971f-ab5601ed1ce1 | CentOS Linux 7 (Core) Linux x64 | 23:01:0a:50:00:02 | false | 2020-03-26T04:35:02.2887847 | true | 9.2.4.31 | true | true | Intel(R) Xeon(R) CPU @ 2.30GHz |
3. fidelis-endpoint-file-search
Searches for files on multiple hosts, using file hash, file extension, file size, and other search criteria.
Required Permissions
The required permissions: Scripts, View Executables
Base Command
fidelis-endpoint-file-search
Input
| Argument Name | Description | Required |
|---|---|---|
| host | A comma-separated list of hosts in which to search for the specified file. | Optional |
| md5 | A comma-separated list MD5 hashes to search for. Get the hashes from the queries commands. | Required |
| file_extension | The file extension. | Optional |
| file_path | The file path (recommended to lower the search time). | Optional |
| file_size | The file size greater than. The default is 100. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.FileSearch.JobID | String | The job ID. |
| FidelisEndpoint.FileSearch.JobResultID | String | The job result ID. |
Command Example
!fidelis-endpoint-file-search host="2.2.2.2" md5="098f6bcd4621d373cade4e832347b4f6" file_extension=".txt" file_size="0"
Context Example
{
"FidelisEndpoint.FileSearch": {
"JobResultID": "e93e848a-2462-4933-b442-ab8a02118111",
"JobID": "fcb3b94c-7344-4c30-a47b-93f90bd2385e"
}
}
Human Readable Output
Fidelis Endpoint file search
| JobID | JobResultID |
|---|---|
| fcb3b94c-7344-4c30-a47b-93f90bd2385e | e93e848a-2462-4933-b442-ab8a02118111 |
4. fidelis-endpoint-file-search-status
Gets the file search job status.
Required Permissions
The required permissions: View Executables
Base Command
fidelis-endpoint-file-search-status
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The job ID. Get the ID from the file-search command. | Required |
| job_result_id | The job result ID. Get the ID from the file-search command. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.FileSearch.JobID | String | The file search job ID. |
| FidelisEndpoint.FileSearch.JobResultID | String | Job result ID. |
| FidelisEndpoint.FileSearch.Status | String | Job status. |
Command Example
!fidelis-endpoint-file-search-status job_id=a345056b-b290-4746-b953-0822dab381ae job_result_id=0b7161ed-ffe9-4b87-b009-ab8a02034e0e
Context Example
{
"FidelisEndpoint.FileSearch": {
"Status": "Completed",
"JobResultID": "0b7161ed-ffe9-4b87-b009-ab8a02034e0e",
"JobID": "a345056b-b290-4746-b953-0822dab381ae"
}
}
Human Readable Output
Fidelis Endpoint file search status is: Completed
5. fidelis-endpoint-file-search-result-metadata
Gets the job results metadata. The maximum is 50 results.
Required Permissions
The required permissions: View Executables
Base Command
fidelis-endpoint-file-search-result-metadata
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The job ID. Get the job ID from the file-search command. | Required |
| job_result_id | The job result ID. Get the job result ID from the file-search command. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.File.AgentID | String | Agent ID. |
| FidelisEndpoint.File.FileName | String | File name. |
| FidelisEndpoint.File.FilePath | String | File path. |
| FidelisEndpoint.File.FileSize | Number | File size. |
| FidelisEndpoint.File.HostIP | String | Host IP address. |
| FidelisEndpoint.File.HostName | String | Host name. |
| FidelisEndpoint.File.ID | String | File ID. |
| FidelisEndpoint.File.MD5Hash | String | File MD5 hash. |
| File.Path | String | The file path. |
| File.Hostname | String | The name of the host where the file was found. |
| File.MD5 | String | The MD5 hash of the file. |
| File.Name | String | The full file name (including file extension). |
| File.Size | Number | The size of the file in bytes. |
Command Example
!fidelis-endpoint-file-search-result-metadata job_id=a345056b-b290-4746-b953-0822dab381ae job_result_id=0b7161ed-ffe9-4b87-b009-ab8a02034e0e
Context Example
{
"FidelisEndpoint.File": {
"MD5Hash": "098f6bcd4621d373cade4e832347b4f6",
"FilePath": "Users\\admin\\Documents\\test.txt",
"HostName": "fidelis-endpoint-winserver2019",
"FileName": "test.txt",
"FileSize": 4,
"HostIP": "2.2.2.2",
"AgentID": "4088e5f0-0d18-4daa-a1a3-e0becc34c803",
"ID": "eyJOYW1lIjoidGVzdC50eHQiLCJQYXRoIjoiL3Jlc3VsdHMvMGI3MTYxZWQtZmZlOS00Yjg3LWIwMDktYWI4YTAyMDM0ZTBlL2IyUnZPVFl5YjFSUGNqRnZSRTkwYlU1aWQxQnJUemRUZDJkTUwzUmFNbUZWY21wMlJrRjFhRXRwTUQwPSJ90"
},
"File": {
"Size": 4,
"Path": "Users\\admin\\Documents\\test.txt",
"Hostname": "fidelis-endpoint-winserver2019",
"Name": "test.txt",
"MD5": "098f6bcd4621d373cade4e832347b4f6"
}
}
Human Readable Output
Fidelis Endpoint file results metadata
| ID | FileName | FilePath | MD5Hash | FileSize | HostName | HostIP | AgentID |
|---|---|---|---|---|---|---|---|
| eyJOYW1lIjoidGVzdC50eHQiLCJQYXRoIjoiL3Jlc3VsdHMvMGI3MTYxZWQtZmZlOS00Yjg3LWIwMDktYWI4YTAyMDM0ZTBlL2IyUnZPVFl5YjFSUGNqRnZSRTkwYlU1aWQxQnJUemRUZDJkTUwzUmFNbUZWY21wMlJrRjFhRXRwTUQwPSJ90 | test.txt | Users\admin\Documents\test.txt | 098f6bcd4621d373cade4e832347b4f6 | 4 | fidelis-endpoint-winserver2019 | 2.2.2.2 | 4088e5f0-0d18-4daa-a1a3-e0becc34c803 |
6. fidelis-endpoint-get-file
Gets the file stream and download the file.
Required Permissions
The required permissions: Scripts, View Executables
Base Command
fidelis-endpoint-get-file
Input
| Argument Name | Description | Required |
|---|---|---|
| file_id | The file ID. Get the ID from the file-search-result-metadata command. | Required |
| file_name | The file name to download (including extension). Get the file name from the file-search-result-metadata command. command). | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| File.Size | Number | The size of the file in bytes. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.Name | String | The full file name (including file extension). |
| File.SSDeep | String | The ssdeep hash of the file (same as displayed in file entries). |
| File.EntryID | String | The ID for locating the file in the War Room. |
| File.Info | String | The file information. |
| File.Type | String | The file type, as determined by libmagic (same as displayed in file entries). |
| File.MD5 | String | The MD5 hash of the file. |
Command Example
!fidelis-endpoint-get-file file_id=eyJOYW1lIjoidGVzdC50eHQiLCJQYXRoIjoiL3Jlc3VsdHMvMGI3MTYxZWQtZmZlOS00Yjg3LWIwMDktYWI4YTAyMDM0ZTBlL2IyUnZPVFl5YjFSUGNqRnZSRTkwYlU1aWQxQnJUemRUZDJkTUwzUmFNbUZWY21wMlJrRjFhRXRwTUQwPSJ90 file_name=test.txt
Human Readable Output
Return the file to download
7. fidelis-endpoint-delete-file-search-job
Removes the job to free up space on the server.
Required Permissions
The required permissions: Scripts, View Executables, Delete Executables
Base Command
fidelis-endpoint-delete-file-search-job
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The job ID. Get the job ID from the file-search command. | Required |
Context Output
There is no context output for this command.
Command Example
!fidelis-endpoint-delete-file-search-job job_id=a345056b-b290-4746-b953-0822dab381ae
Human Readable Output
The job was successfully deleted
8. fidelis-endpoint-list-scripts
Gets a list of all script packages.
Required Permissions
The required permissions: Read groups, View Behaviors
Base Command
fidelis-endpoint-list-scripts
Input
| Argument Name | Description | Required |
| — | — | — |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Script.Description | String | The script description. |
| FidelisEndpoint.Script.ID | String | Script ID. |
| FidelisEndpoint.Script.Name | String | Script name. |
Command Example
##### Context Example
{
“FidelisEndpoint.Script”: [
{
“Name”: “Administrators”,
“Description”: “Lists all users with Administrator rights. Use the optional parameter to filter the results to usernames that contain the supplied text.”,
“ID”: “8d379688-dde1-451d-8fa2-4f29c84baf97”
},
{
“Name”: “Administrators”,
“Description”: “Lists all users with Administrator rights. Use the optional parameter to filter the results to usernames that contain the supplied text.”,
“ID”: “c533cf90-f015-4616-84fb-8836b32aa74b”
},
{
“Name”: “Agent Log”,
“Description”: “Returns log entries from the Fidelis Agent.”,
“ID”: “e73ffbba-14c1-4dd4-bb45-60d6906031c9”
},
{
“Name”: “Agent Log”,
“Description”: “Returns log entries from the Fidelis Agent.”,
“ID”: “f0572f26-4272-4d2c-8f6f-4a8dfa307904”
},
{
“Name”: “All User Accounts”,
“Description”: “Displays information about any created users on an endpoint. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column.”,
“ID”: “42787aa7-f721-49ad-ab2d-308f905986f3”
},
{
“Name”: “All User Accounts”,
“Description”: “Displays information about any created users on an endpoint. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column.”,
“ID”: “b44f4b11-2e76-44c8-9484-238fd3063aea”
},
{
“Name”: “All User Accounts”,
“Description”: “Displays information about any created users on an endpoint. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column.”,
“ID”: “3fe1ec01-b095-4a6a-8fcf-7d9e1df95284”
},
{
“Name”: “Services (WMI)”,
“Description”: “Obtain the list of services from the Windows Management Instrumentation (WMI).\r\nThe Service Name or Account Filter limits the results to services that have the matching name or account.”,
“ID”: “9622541e-2bca-46f5-b2a6-ef406babf9cd”
},
] } ```
Human Readable Output
Fidelis Endpoint scripts
| ID | Name | Description |
|---|---|---|
| 8d379688-dde1-451d-8fa2-4f29c84baf97 | Administrators | Lists all users with Administrator rights. Use the optional parameter to filter the results to usernames that contain the supplied text. |
| c533cf90-f015-4616-84fb-8836b32aa74b | Administrators | Lists all users with Administrator rights. Use the optional parameter to filter the results to usernames that contain the supplied text. |
| e73ffbba-14c1-4dd4-bb45-60d6906031c9 | Agent Log | Returns log entries from the Fidelis Agent. |
| f0572f26-4272-4d2c-8f6f-4a8dfa307904 | Agent Log | Returns log entries from the Fidelis Agent. |
| 42787aa7-f721-49ad-ab2d-308f905986f3 | All User Accounts | Displays information about any created users on an endpoint. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column. |
| b44f4b11-2e76-44c8-9484-238fd3063aea | All User Accounts | Displays information about any created users on an endpoint. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column. |
| 3fe1ec01-b095-4a6a-8fcf-7d9e1df95284 | All User Accounts | Displays information about any created users on an endpoint. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column. |
| 1a57a6ad-4dd7-4055-8def-8e423d949f3f | All User Accounts (WMI) | Lists all the user accounts. Use the optional parameter to filter the results to those that have a username that contains the supplied text |
| c8adc3bc-6345-473d-a8cc-c45a76f9d62c | AntiVirus Information | Shows the AntiVirus and AntiSpyware products installed on client computer and whether they are enabled and up-to-date. Provide the optional filter to only return products that contain the filter text. This script does not work on server class operating systems. |
| c9b37e1e-3ec6-49a3-9426-b90a90b55071 | ARP Cache | Displays information from the Address Resolution Protocol Cache. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column. |
| f3eb6edf-5764-4e11-8833-6da6b067e54e | ARP Cache | Displays information from the Address Resolution Protocol Cache. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column. |
9. fidelis-endpoint-get-script-manifest
Gets the script manifest.
Required Permissions
The required permissions: View Behaviors
Base Command
fidelis-endpoint-get-script-manifest
Input
| Argument Name | Description | Required |
|---|---|---|
| script_id | The script ID. Get the script ID from the list-scripts command. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Script.ResultColumns | String | The script results columns. |
| FidelisEndpoint.Script.Priority | String | Script priority. |
| FidelisEndpoint.Script.ImpersonationUser | String | Impersonation user. |
| FidelisEndpoint.Script.Name | String | Script name. |
| FidelisEndpoint.Script.Command | String | The script commands. |
| FidelisEndpoint.Script.Questions | String | Script questions. |
| FidelisEndpoint.Script.WizardOverridePassword | Boolean | Wizard override password. |
| FidelisEndpoint.Script.Platform | String | Scripts platforms (only true). |
| FidelisEndpoint.Script.ImpersonationPassword | String | Impersonation password. |
| FidelisEndpoint.Script.ID | String | Script ID. |
| FidelisEndpoint.Script.Description | String | The script description. |
| FidelisEndpoint.Script.TimeoutSeconds | Number | Script timeout in seconds. |
Command Example
!fidelis-endpoint-get-script-manifest script_id="2d32a530-0716-4542-afdc-8da3bd47d8bf"
Context Example
{
"FidelisEndpoint.Script": {
"Description": "Obtain the list of currently running processes.\r\nOptionally, information about open sockets, handles and loaded DLLs can be included.\r\nCerberus Stage One analysis verifies digital signatures of the processes and performs a risk assessment of known system calls assigning an aggregate score.\r\nThe filter field limits the results to processes that match the given text in any column.",
"TimeoutSeconds": 0,
"WizardOverridePassword": false,
"ImpersonationUser": null,
"ResultColumns": [
"__detail",
"PID",
"Parent PID",
"Name",
"User",
"MD5",
"SHA1",
"Path",
"Start Time",
"Working Directory",
"Command Line",
"Is Hidden"
],
"Priority": null,
"Platform": [
"windows32",
"windows64"
],
"ImpersonationPassword": null,
"Command": "Volatile.bat sockets {[T:B,V:true]Include Sockets} handles {[T:B,V:true]Include Handles} dlls {[T:B,V:true]Include DLLs} injected {[T:B,?]Check for injected DLLs} jam {[T:B,?]Perform Cerberus Stage 1 Analysis (approximately 5 seconds per process)} filter {[T:T,?] Filter}",
"Questions": [
{
"answer": "true",
"question": "Include Sockets",
"inputType": "checkbox",
"isOptional": false,
"paramNumber": 1
},
{
"answer": "true",
"question": "Include Handles",
"inputType": "checkbox",
"isOptional": false,
"paramNumber": 2
},
{
"answer": "true",
"question": "Include DLLs",
"inputType": "checkbox",
"isOptional": false,
"paramNumber": 3
},
{
"answer": "false",
"question": "Check for injected DLLs",
"inputType": "checkbox",
"isOptional": true,
"paramNumber": 4
},
{
"answer": "false",
"question": "Perform Cerberus Stage 1 Analysis (approximately 5 seconds per process)",
"inputType": "checkbox",
"isOptional": true,
"paramNumber": 5
},
{
"answer": null,
"question": " Filter",
"inputType": "text",
"isOptional": true,
"paramNumber": 6
}
],
"ID": "2d32a530-0716-4542-afdc-8da3bd47d8bf",
"Name": "Process List"
}
}
Human Readable Output
Fidelis Endpoint script manifest
| ID | Name | Description | Platform | Command | Questions | TimeoutSeconds | ResultColumns | WizardOverridePassword |
|---|---|---|---|---|---|---|---|---|
| 2d32a530-0716-4542-afdc-8da3bd47d8bf | Process List | Obtain the list of currently running processes. Optionally, information about open sockets, handles and loaded DLLs can be included. Cerberus Stage One analysis verifies digital signatures of the processes and performs a risk assessment of known system calls assigning an aggregate score.The filter field limits the results to processes that match the given text in any column. |
windows32,windows64 | Volatile.bat sockets {[T:B,V:true]Include Sockets} handles {[T:B,V:true]Include Handles} dlls {[T:B,V:true]Include DLLs} injected {[T:B,?]Check for injected DLLs} jam {[T:B,?]Perform Cerberus Stage 1 Analysis (approximately 5 seconds per process)} filter {[T:T,?] Filter} | {‘paramNumber’: 1, ‘question’: ‘Include Sockets’, ‘answer’: ‘true’, ‘isOptional’: False, ‘inputType’: ‘checkbox’}, {‘paramNumber’: 2, ‘question’: ‘Include Handles’, ‘answer’: ‘true’, ‘isOptional’: False, ‘inputType’: ‘checkbox’}, {‘paramNumber’: 3, ‘question’: ‘Include DLLs’, ‘answer’: ‘true’, ‘isOptional’: False, ‘inputType’: ‘checkbox’}, {‘paramNumber’: 4, ‘question’: ‘Check for injected DLLs’, ‘answer’: ‘false’, ‘isOptional’: True, ‘inputType’: ‘checkbox’}, {‘paramNumber’: 5, ‘question’: ‘Perform Cerberus Stage 1 Analysis (approximately 5 seconds per process)’, ‘answer’: ‘false’, ‘isOptional’: True, ‘inputType’: ‘checkbox’}, {‘paramNumber’: 6, ‘question’: ‘ Filter’, ‘answer’: None, ‘isOptional’: True, ‘inputType’: ‘text’} |
0 | __detail, PID, Parent PID, Name, User, MD5, SHA1, Path, Start Time, Working Directory, Command Line, Is Hidden |
false |
10. fidelis-endpoint-list-processes
Gets a list all processes according to the OS system.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-list-processes
Input
| Argument Name | Description | Required |
|---|---|---|
| endpoint_ip | The endpoint IP. Get the endpoint IP from the host-info command. | Optional |
| operating_system | Ths system OS. Can be “Windows”, “Linux”, or “macOS”. | Required |
| time_out | Script time out in seconds. The default is 300. | Optional |
| endpoint_name | The endpoint name. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Process.JobID | String | Job ID. |
| FidelisEndpoint.Process.ID | String | Script ID. |
Command Example
!fidelis-endpoint-list-processes operating_system=Windows endpoint_ip=2.2.2.2
Context Example
{
"FidelisEndpoint.Process": {
"ID": "2d32a530-0716-4542-afdc-8da3bd47d8bf",
"JobID": "71c6be70-fa49-40ba-8d0a-ab8a02118a19"
}
}
Human Readable Output
The job has been executed successfully.
Job ID: 71c6be70-fa49-40ba-8d0a-ab8a02118a19
11. fidelis-endpoint-get-script-result
Gets script job results.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-get-script-result
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The script execution job ID. Get the ID the following commands: script-execution, file-search, list-processes, kill-process-by-pid, delete-file, network-isolation, remove-network-isolation. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.ScriptResult.EndpointName | String | Endpoint name. |
| FidelisEndpoint.ScriptResult.ParentPID | String | Parent process ID. |
| FidelisEndpoint.ScriptResult.Path | String | File path. |
| FidelisEndpoint.ScriptResult.SHA1 | String | File SHA1 hash. |
| FidelisEndpoint.ScriptResult.PID | String | Process ID. |
| FidelisEndpoint.ScriptResult.Name | String | Process name. |
| FidelisEndpoint.ScriptResult.User | String | Script user. |
| FidelisEndpoint.ScriptResult.StartTime | Date | Script start time. |
| FidelisEndpoint.ScriptResult.EndpointID | String | Endpoint ID. |
| FidelisEndpoint.ScriptResult.Matches | Number | Script matches. |
| FidelisEndpoint.ScriptResult.IsHidden | String | Whether the endpoint is hidden. |
| FidelisEndpoint.ScriptResult.GroupID | String | Group ID. |
| FidelisEndpoint.ScriptResult.Tags | String | Script tags. |
| FidelisEndpoint.ScriptResult.ID | String | Script result ID. |
| FidelisEndpoint.ScriptResult.WorkingDirectory | String | Working directory. |
| FidelisEndpoint.ScriptResult.MD5 | String | File MD5 hash. |
| FidelisEndpoint.ScriptResult.CommandLine | String | Command line. |
Command Example
!fidelis-endpoint-get-script-result job_id=fc94568c-9a15-4fa2-af08-ab8a01f5e86c
Context Example
{
"FidelisEndpoint.ScriptResult": [
{
"SHA1": "0000000000000000000000000000000000000000",
"Name": "System",
"ParentPID": "0",
"Tags": [],
"Matches": 0,
"CommandLine": "",
"PID": "4",
"GroupID": "9F4354C1CEB3B925ADC6A6286FF5A23F7CF9D7B0",
"StartTime": "N/A",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"WorkingDirectory": "",
"Path": "",
"IsHidden": "false",
"ID": "7086ab52f0725e547095ff779e30153ae6088ccc",
"MD5": "00000000000000000000000000000000"
},
{
"SHA1": "0000000000000000000000000000000000000000",
"Name": "registry.exe",
"ParentPID": "4",
"Tags": [],
"Matches": 0,
"CommandLine": "",
"PID": "84",
"GroupID": "CE47F839D8D87C334A503491A4D60CDA15295071",
"StartTime": "N/A",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"WorkingDirectory": "",
"Path": "",
"IsHidden": "false",
"ID": "11ea7715d36598d0bc0aaa97ee3e95c26d293f4b",
"MD5": "00000000000000000000000000000000"
},
{
"SHA1": "0FA1562A56219B1FC005E24AC1D866F6E1AE7902",
"Name": "smss.exe",
"ParentPID": "4",
"Tags": [],
"Matches": 0,
"CommandLine": "",
"PID": "264",
"GroupID": "82D6263B1B8CDA7C62591267E414CA9E56BF603A",
"StartTime": "N/A",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"WorkingDirectory": "",
"Path": "C:\\Windows\\System32\\smss.exe",
"IsHidden": "false",
"ID": "863637a177dee43dfbcb0b479db1e5ec885d70e8",
"MD5": "2855A7D96CF37DF1960A6D8828A614CB"
},
{
"SHA1": "A04607D0B11D30B0CDB36739077E7F1B6C7D1FAE",
"Name": "protect.exe",
"ParentPID": "576",
"Tags": [],
"Matches": 0,
"CommandLine": "\"C:\\Program Files\\Fidelis\\Endpoint\\Platform\\services\\protect\\protect.exe\" -s",
"PID": "272",
"GroupID": "5D5334D2A0405C72C967B4D784E27AD222E7BDD9",
"StartTime": "2020-03-26T04:04:22.855396",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "SYSTEM",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"WorkingDirectory": "C:\\Windows\\system32\\",
"Path": "C:\\Program Files\\Fidelis\\Endpoint\\Platform\\services\\protect\\protect.exe",
"IsHidden": "false",
"ID": "4a598df8817b12552d3a485e23dac7f911536a5a",
"MD5": "40A35E6DC3ADE3F5CAA79A4C15CCF37C"
},
{
"SHA1": "A1385CE20AD79F55DF235EFFD9780C31442AA123",
"Name": "svchost.exe",
"ParentPID": "576",
"Tags": [],
"Matches": 0,
"CommandLine": "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService",
"PID": "304",
"GroupID": "8C6F410CBCE4C937FC8ED920462AD47CA49FCE0C",
"StartTime": "2020-03-12T03:58:08.237101",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "SYSTEM",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"WorkingDirectory": "C:\\Windows\\system32\\",
"Path": "C:\\Windows\\System32\\svchost.exe",
"IsHidden": "false",
"ID": "1d807600d7deef1f26d16ddc28ae6ca4ca656202",
"MD5": "3A0A29438052FAED8A2532DA50455876"
}
]
}
Human Readable Output
Fidelis Endpoint script job results
| ID | Name | EndpointID | EndpointName | PID | User | SHA1 | MD5 | Path | WorkingDirectory | StartTime |
|---|---|---|---|---|---|---|---|---|---|---|
| 7086ab52f0725e547095ff779e30153ae6088ccc | System | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 4 | 0000000000000000000000000000000000000000 | 00000000000000000000000000000000 | N/A | |||
| 11ea7715d36598d0bc0aaa97ee3e95c26d293f4b | registry.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 84 | 0000000000000000000000000000000000000000 | 00000000000000000000000000000000 | N/A | |||
| 863637a177dee43dfbcb0b479db1e5ec885d70e8 | smss.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 264 | 0FA1562A56219B1FC002E24AC8D866F6E1AE7902 | 2755A7D96CF37DF1960A6D8828A614CB | C:\Windows\System32\smss.exe | N/A | ||
| 4a598df8817b12552d3a485e23dac7f911536a5a | protect.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 272 | SYSTEM | A04607D0B11D30B0CDB36739088E8F1B6C7D1FAE | 40A35E6DC3ADE3F5CAA79A4C15CCF37C | C:\Program Files\Fidelis\Endpoint\Platform\services\protect\protect.exe | C:\Windows\system32\ | 2020-03-26T04:04:22.855396 |
| 1d807600d7deef1f26d16ddc28ae6ca4ca656202 | svchost.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 304 | SYSTEM | A1385CE20AD79F55DF235EFFD9780C31442AA234 | 8a0a29438052faed8a2532da50451234 | C:\Windows\System32\svchost.exe | C:\Windows\system32\ | 2020-03-12T03:58:08.237101 |
| b52743f524304f61a076feb040426c2931921adf | svchost.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 364 | LOCAL SERVICE | A1385CE20AD79F55DF235EFFD9780C31442AA234 | 8a0a29438052faed8a2532da50451234 | C:\Windows\System32\svchost.exe | C:\Windows\system32\ | 2020-03-12T03:58:08.526584 |
| 63cf4746e5a634fdb2ae8c9f4feca6b49377f1af | csrss.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 372 | 779B8AFC3FA2528B090F400EF3D592E0E2775955 | 7D64128BC1EECE41196858897596EBC8 | C:\Windows\System32\csrss.exe | N/A | ||
| 27e4f8301c0ce8d0dbe449561c0aae59a2fece82 | svchost.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 440 | LOCAL SERVICE | A1385CE20AD79F55DF235EFFD9780C31442AA234 | 8a0a29438052faed8a2532da50451234 | C:\Windows\system32\svchost.exe | C:\Windows\system32\ | 2020-03-12T03:58:08.540947 |
| d81492c785d46ab06e001d5fed4f8d5e491b02b5 | svchost.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 444 | LOCAL SERVICE | A1385CE20AD79F55DF235EFFD9780C31442AA234 | 8a0a29438052faed8a2532da50451234 | C:\Windows\system32\svchost.exe | C:\Windows\system32\ | 2020-03-12T03:58:08.526589 |
| f211cdabce3ea5a029ad2a63b803a9962e63af96 | wininit.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 448 | 389E257A924EA521E830C31712494D33B38841A8 | 4E20895E641F2C3E68AB3DB91A1A16F1 | C:\Windows\System32\wininit.exe | N/A | ||
| 395b84b288830e96cf91fa20f7c399d8a21f2d8f | csrss.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 456 | 779B8AFC3FA2528B090F400EF3D592E0E2775955 | 7D64128BC1EECE41196858897596EBC8 | C:\Windows\System32\csrss.exe | N/A |
12. fidelis-endpoint-kill-process
Terminates the process that matches the required parameter’s process ID.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-kill-process
Input
| Argument Name | Description | Required |
|---|---|---|
| endpoint_ip | The endpoint IP address. | Optional |
| time_out | Script time out (in seconds). The default is 300. | Optional |
| operating_system | System OS. Can be “Windows”, “Linux”, or “macOS”. | Required |
| pid | Process ID. Get the PID from the script-manifest command. | Required |
| endpoint_name | The name of the endpoint. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Process.JobID | String | Script job ID. |
| FidelisEndpoint.Process.ID | String | Script ID. |
Command Example
!fidelis-endpoint-kill-process operating_system=Windows pid=516 endpoint_ip=2.2.2.2
Context Example
{
"FidelisEndpoint.Process": {
"ID": "8d379688-dde1-451d-8fa2-4f29c84baf97",
"JobID": "25548787-e75c-4c55-96d5-ab8a0211a820"
}
}
Human Readable Output
The job has been executed successfully.
Job ID: 25548787-e75c-4c55-96d5-ab8a0211a820
13. fidelis-endpoint-delete-file
Deletes a file at the specified path.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-delete-file
Input
| Argument Name | Description | Required |
|---|---|---|
| endpoint_ip | Endpoint IP address. | Optional |
| time_out | Script time out (in seconds). The default is 300. | Optional |
| operating_system | System OS. Can be “Windows”, “Linux”, or “macOS”. | Required |
| file_path | The path of the file to delete. | Required |
| endpoint_name | The name of the endpoint. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Script.ID | String | Script ID. |
| FidelisEndpoint.Script.JobID | String | Script job ID. |
Command Example
!fidelis-endpoint-delete-file file_path=c:\\Users\\admin\\Documents\\test.txt operating_system=Windows endpoint_ip=2.2.2.2
Human Readable Output
The job has been executed successfully.
Job ID: 4317e979-81df-46d8-8eb1-ab8a023ef4d8
14. fidelis-endpoint-isolate-network
Quarantines an endpoint. While isolated, the endpoint’s network communication is restricted to only the allowed servers.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-isolate-network
Input
| Argument Name | Description | Required |
|---|---|---|
| endpoint_ip | The endpoint IP address to isolate. | Optional |
| time_out | Script timeout (in seconds). The default is 300. | Optional |
| operating_system | The system OS. Can be “Windows”, “Linux”, or “macOS”. | Required |
| allowed_server | The server IP address that can communicate with the isolated endpoint. For example: 2.2.2.2. | Required |
| endpoint_name | The name of the endpoint. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Isolation.ID | String | Script ID. |
| FidelisEndpoint.Isolation.JobID | String | Script job ID. |
Command Example
!fidelis-endpoint-isolate-network operating_system=Windows allowed_server=10.10.10.10 endpoint_ip=10.10.0.1
Human Readable Output
The job has been executed successfully.
Job ID: f25691bd-ba78-4f40-9a25-ab8a02420abc
15. fidelis-endpoint-remove-network-isolation
Removes the endpoint from isolation.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-remove-network-isolation
Input
| Argument Name | Description | Required |
|---|---|---|
| endpoint_ip | The isolated endpoint IP address. | Optional |
| time_out | Script timeout (in seconds). The default is 300. | Optional |
| operating_system | System OS. Can be “Windows”, “Linux”, or “macOS”. | Required |
| endpoint_name | The name of the endpoint. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Isolation.ID | String | Script ID. |
| FidelisEndpoint.Isolation.JobID | String | Script job ID. |
Command Example
!fidelis-endpoint-remove-network-isolation operating_system=Windows endpoint_ip=10.128.0.1
Human Readable Output
The job has been executed successfully.
Job ID: 7a0a3179-3bce-43d1-80c0-ab8a0242d147
16. fidelis-endpoint-script-job-status
Gets the script execution status.
Required Permissions
The required permissions: Scripts, View Executables, View Task Results
Base Command
fidelis-endpoint-script-job-status
Input
| Argument Name | Description | Required |
|---|---|---|
| job_result_id | The script execution job result ID. Get the ID from the following commands: script-execution, file-search, list-processes, kill-process-by-pid, delete-file, network-isolation, remove-network-isolation. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.ScriptResult.JobName | String | The job name. |
| FidelisEndpoint.ScriptResult.JobResultID | String | Job result ID. |
| FidelisEndpoint.ScriptResult.Name | String | Target name. |
| FidelisEndpoint.ScriptResult.Status | String | Script execution status. |
Command Example
!fidelis-endpoint-script-job-status job_result_id=fc94568c-9a15-4fa2-af08-ab8a01f5e86c
Context Example
{
"FidelisEndpoint.ScriptResult": [
{
"Status": "Completed",
"Name": "fidelis-endpoint-winserver2019",
"JobResultID": "fc94568c-9a15-4fa2-af08-ab8a01f5e86c",
"JobName": "Process List-03-26-2020 9.08.12"
}
]
}
Human Readable Output
Fidelis Endpoint script job status
| JobName | JobResultID | Name | Status |
|---|---|---|---|
| Process List-03-26-2020 9.08.12 | fc94568c-9a15-4fa2-af08-ab8a01f5e86c | fidelis-endpoint-winserver2019 | Completed |
17. fidelis-endpoint-execute-script
Executes a script package from Fidelis endpoint packages.
Required Permissions
The required permissions: Scripts, View Executables
Base Command
fidelis-endpoint-execute-script
Input
| Argument Name | Description | Required |
|---|---|---|
| script_id | Script ID. Get the script ID from the list-scripts command. | Required |
| time_out | Script time out (in seconds). The default is 300. | Optional |
| endpoint_ip | Endpoint IP address on which to run the script. | Optional |
| answer | The script to run. Get the answer from the script-manifest command. | Required |
| endpoint_name | The name of the endpoint. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Script.ID | String | Script ID. |
| FidelisEndpoint.Script.JobID | String | Script job ID. |
Command Example
!fidelis-endpoint-execute-script script_id="2d32a530-0716-4542-afdc-8da3bd47d8bf" time_out="300" endpoint_ip="2.2.2.2" answer="true"
Context Example
{
"FidelisEndpoint.Script": {
"ID": "2d32a530-0716-4542-afdc-8da3bd47d8bf",
"JobID": "8ac08ab1-e6f4-4aa1-9784-ab8a02115483"
}
}
Human Readable Output
The job has been executed successfully.
Job ID: 8ac08ab1-e6f4-4aa1-9784-ab8a02115483
18. fidelis-endpoint-query-file
Queries a file by file hash.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results.
Base Command
fidelis-endpoint-query-file
Input
| Argument Name | Description | Required |
|---|---|---|
| start_time | The start time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| end_time | The end time of the event in the system in UTC format. Supported values:”2019-10-21T23:45:00” (date). |
Optional |
| logic | The logic of the query. Can be “and” or “or”. | Required |
| file_hash | The MD5 file hash to search for. | Required |
| limit | The maximum number of results to return. The default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Query.ProcessStartTime | Date | The process start time. |
| FidelisEndpoint.Query.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Query.CertificateSubjectName | String | Certificate subject name. |
| FidelisEndpoint.Query.Size | Number | File size. |
| FidelisEndpoint.Query.FileExtension | String | File extension. |
| FidelisEndpoint.Query.Path | String | File path. |
| FidelisEndpoint.Query.CertificatePublisher | String | Certificate publisher. |
| FidelisEndpoint.Query.ParentID | String | Process parent ID. |
| FidelisEndpoint.Query.EventTime | Date | Event time. |
| FidelisEndpoint.Query.SignedTime | Date | Signed time. |
| FidelisEndpoint.Query.Name | String | File name. |
| FidelisEndpoint.Query.TargetID | String | Target ID. |
| FidelisEndpoint.Query.Hash | String | File hash. |
| FidelisEndpoint.Query.StartTime | Date | Event start time. |
| FidelisEndpoint.Query.HashSHA1 | String | File SHA1 hash. |
| FidelisEndpoint.Query.EventType | Number | Event type. |
| FidelisEndpoint.Query.HashSHA256 | String | File SHA256 hash. |
| FidelisEndpoint.Query.ParentName | String | Process parent name. |
| FidelisEndpoint.Query.FileType | Number | File type. |
| FidelisEndpoint.Query.Signature | Number | File signature. |
| FidelisEndpoint.Query.EventIndex | Number | Event index. |
| FidelisEndpoint.Query.FileCategory | Number | File category. |
| FidelisEndpoint.Query.CertificateIssuerName | String | Certificate issuer name. |
| FidelisEndpoint.Query.FileVersion | String | File version. |
| FidelisEndpoint.Query.IndexingTime | Date | Indexing time. |
| FidelisEndpoint.Query.EntityType | Number | Entity type. |
| File.Name | String | The full file name (including file extension). |
| File.Size | Number | The size of the file in bytes. |
| File.MD5 | String | The MD5 hash of the file. |
| File.Extension | String | The file extension, for example: “txt”. |
| File.Type | Number | The file type, as determined by libmagic (same as displayed in file entries). |
| File.Path | String | The path where the file is located. |
| File.Hostname | String | The name of the host where the file was found. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.FileVersion | String | The file version. |
Command Example
!fidelis-endpoint-query-file logic="and" file_hash="8a0a29438052faed8a2532da50451234"
Context Example
{
"FidelisEndpoint.Query": [
{
"EntityType": 1,
"TargetID": "aW9qfAMZ5a3",
"StartTime": "2020-03-26T09:02:26.511Z",
"FileExtension": "exe",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)",
"ProcessStartTime": "2020-03-26T09:02:26.511Z",
"IndexingTime": "2020-03-26T09:06:31.958Z",
"CertificateSubjectName": "Microsoft Windows Publisher",
"EventType": 2,
"ParentName": "svchost.exe",
"HashSHA1": "a1385ce20ad79f55df235effd9780c31442aa456",
"SignedTime": "1:29 9/15/2018",
"EventIndex": 1,
"Path": "C:\\Windows\\System32\\svchost.exe",
"EventTime": "2020-03-26T09:02:26.511Z",
"Name": "svchost.exe",
"CertificatePublisher": "Microsoft Corporation",
"FileType": "8",
"HashSHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020565ab6",
"EndpointName": "fidelis-endpoint-winserver2019",
"Signature": "16",
"Hash": "8a0a29438052faed8a2532da50455456",
"FileCategory": "776",
"ParentID": "rSdnlXD7OX6",
"CertificateIssuerName": "Microsoft Windows Production PCA 2011",
"Size": 51696
},
{
"EntityType": 1,
"TargetID": "aW9qfAMZ5a3",
"StartTime": "2020-03-26T08:02:26.197Z",
"FileExtension": "exe",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)",
"ProcessStartTime": "2020-03-26T08:02:26.197Z",
"IndexingTime": "2020-03-26T08:05:00.035Z",
"CertificateSubjectName": "Microsoft Windows Publisher",
"EventType": 2,
"ParentName": "svchost.exe",
"HashSHA1": "a1385ce20ad79f55df235effd9780c31442aa456",
"SignedTime": "1:29 9/15/2018",
"EventIndex": 1,
"Path": "C:\\Windows\\System32\\svchost.exe",
"EventTime": "2020-03-26T08:02:26.197Z",
"Name": "svchost.exe",
"CertificatePublisher": "Microsoft Corporation",
"FileType": "8",
"HashSHA256": "7fd065bac18c1234777ae44908101cdfed72d26fa741367f0ad4d02020787ab6",
"EndpointName": "fidelis-endpoint-winserver2019",
"Signature": "16",
"Hash": "8a0a29438052faed8a2532da12355756",
"FileCategory": "776",
"ParentID": "m31v1MqQ6",
"CertificateIssuerName": "Microsoft Windows Production PCA 2011",
"Size": 51696
},
{
"EntityType": 1,
"TargetID": "aW9qfAMZ5a3",
"StartTime": "2020-03-26T07:02:25.887Z",
"FileExtension": "exe",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)",
"ProcessStartTime": "2020-03-26T07:02:25.887Z",
"IndexingTime": "2020-03-26T07:08:28.331Z",
"CertificateSubjectName": "Microsoft Windows Publisher",
"EventType": 2,
"ParentName": "svchost.exe",
"HashSHA1": "a1385ce20ad79f55df235effd9780c31442aa456",
"SignedTime": "1:29 9/15/2018",
"EventIndex": 1,
"Path": "C:\\Windows\\System32\\svchost.exe",
"EventTime": "2020-03-26T07:02:25.887Z",
"Name": "svchost.exe",
"CertificatePublisher": "Microsoft Corporation",
"FileType": "8",
"HashSHA256": "7fd065bac18c5123777ae44908101cdfed72d26fa741367f0ad4d02020787ab6",
"EndpointName": "fidelis-endpoint-winserver2019",
"Signature": "16",
"Hash": "8a0a29438052faed8a2532da50455123",
"FileCategory": "776",
"ParentID": "fmz4un6Qzfd",
"CertificateIssuerName": "Microsoft Windows Production PCA 2011",
"Size": 51696
},
{
"EntityType": 1,
"TargetID": "aW9qfAMZ5a3",
"StartTime": "2020-03-26T06:15:07.125Z",
"FileExtension": "exe",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)",
"ProcessStartTime": "2020-03-26T06:15:07.125Z",
"IndexingTime": "2020-03-26T06:20:26.814Z",
"CertificateSubjectName": "Microsoft Windows Publisher",
"EventType": 2,
"ParentName": "svchost.exe",
"HashSHA1": "a1385ce20ad79f55df235effd9780c31442aa456",
"SignedTime": "1:29 9/15/2018",
"EventIndex": 1,
"Path": "C:\\Windows\\System32\\svchost.exe",
"EventTime": "2020-03-26T06:15:07.125Z",
"Name": "svchost.exe",
"CertificatePublisher": "Microsoft Corporation",
"FileType": "8",
"HashSHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6",
"EndpointName": "fidelis-endpoint-winserver2019",
"Signature": "16",
"Hash": "8a0a29438052faed8a2532da50455123",
"FileCategory": "776",
"ParentID": "fS3SPnQU5Xe",
"CertificateIssuerName": "Microsoft Windows Production PCA 2011",
"Size": 51696
},
{
"EntityType": 1,
"TargetID": "aW9qfAMZ5a3",
"StartTime": "2020-03-26T06:02:25.581Z",
"FileExtension": "exe",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)",
"ProcessStartTime": "2020-03-26T06:02:25.581Z",
"IndexingTime": "2020-03-26T06:05:26.740Z",
"CertificateSubjectName": "Microsoft Windows Publisher",
"EventType": 2,
"ParentName": "svchost.exe",
"HashSHA1": "a1385ce20ad79f55df235effd9780c31442aa456",
"SignedTime": "1:29 9/15/2018",
"EventIndex": 1,
"Path": "C:\\Windows\\System32\\svchost.exe",
"EventTime": "2020-03-26T06:02:25.581Z",
"Name": "svchost.exe",
"CertificatePublisher": "Microsoft Corporation",
"FileType": "8",
"HashSHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020232cb6",
"EndpointName": "fidelis-endpoint-winserver2019",
"Signature": "16",
"Hash": "8a0a29438052faed8a2532da50455123",
"FileCategory": "776",
"ParentID": "s8Iu12ulYKh",
"CertificateIssuerName": "Microsoft Windows Production PCA 2011",
"Size": 51696
}
],
"File": [
{
"SHA1": "a1385ce20ad79f55df235effd9780c31442aa456",
"SHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020232cb6",
"Name": "svchost.exe",
"Extension": "exe",
"Hostname": "fidelis-endpoint-winserver2019",
"Size": 51696,
"Path": "C:\\Windows\\System32\\svchost.exe",
"MD5": "8a0a29438052faed8a2532da50451234",
"Type": "8",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)"
},
{
"SHA1": "a1385ce20ad79f55df235effd9780c31442aa234",
"SHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6",
"Name": "svchost.exe",
"Extension": "exe",
"Hostname": "fidelis-endpoint-winserver2019",
"Size": 51696,
"Path": "C:\\Windows\\System32\\svchost.exe",
"MD5": "8a0a23438052faed8a2532da50455756",
"Type": "8",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)"
},
{
"SHA1": "a1385ce20ad79f55df235effd9780c31442aa234",
"SHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6",
"Name": "svchost.exe",
"Extension": "exe",
"Hostname": "fidelis-endpoint-winserver2019",
"Size": 51696,
"Path": "C:\\Windows\\System32\\svchost.exe",
"MD5": "8a0a29438052faed8a2532da50451234",
"Type": "8",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)"
},
{
"SHA1": "a1385ce20ad79f55df235effd9780c31442aa234",
"SHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6",
"Name": "svchost.exe",
"Extension": "exe",
"Hostname": "fidelis-endpoint-winserver2019",
"Size": 51696,
"Path": "C:\\Windows\\System32\\svchost.exe",
"MD5": "8a0a29438052faed8a2532da50451234",
"Type": "8",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)"
},
{
"SHA1": "a1385ce20ad79f55df235effd9780c31442aa234",
"SHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6",
"Name": "svchost.exe",
"Extension": "exe",
"Hostname": "fidelis-endpoint-winserver2019",
"Size": 51696,
"Path": "C:\\Windows\\System32\\svchost.exe",
"MD5": "8a0a29438052faed8a2532da50451234",
"Type": "8",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)"
},
]
}
Human Readable Output
Fidelis Endpoint file hash query results
| EndpointName | Name | Path | Hash | ProcessStartTime | ParentName | EventType |
|---|---|---|---|---|---|---|
| fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | 8a0a29438052faed8a2532da50451234 | 2020-03-26T09:02:26.511Z | svchost.exe | 2 |
| fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | 8a0a29438052faed8a2532da50451234 | 2020-03-26T08:02:26.197Z | svchost.exe | 2 |
| fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | 8a0a29438052faed8a2532da50451234 | 2020-03-26T07:02:25.887Z | svchost.exe | 2 |
| fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | 8a0a29438052faed8a2532da50451234 | 2020-03-26T06:15:07.125Z | svchost.exe | 2 |
| fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | 8a0a29438052faed8a2532da50451234 | 2020-03-26T06:02:25.581Z | svchost.exe | 2 |
| fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | 8a0a29438052faed8a2532da50451234 | 2020-03-26T05:02:25.266Z | svchost.exe | 2 |
| fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | 8a0a29438052faed8a2532da50451234 | 2020-03-26T04:54:08.244Z | svchost.exe | 2 |
19. fidelis-endpoint-query-process
Query process.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-query-process
Input
| Argument Name | Description | Required |
|---|---|---|
| start_time | The start time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| end_time | The end time of the event in the system in UTC format. Supported values:”2019-10-21T23:45:00” (date). |
Optional |
| logic | The logic of the query. Can be “and” or “or”. | Required |
| process_name | The process name to query. | Required |
| limit | The maximum number of results to return. The default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Query.ProcessStartTime | String | Process start time. |
| FidelisEndpoint.Query.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Query.Path | String | The path of the process. |
| FidelisEndpoint.Query.ParentID | String | Process parent ID. |
| FidelisEndpoint.Query.EventTime | Date | Event time. |
| FidelisEndpoint.Query.PID | String | Process ID. |
| FidelisEndpoint.Query.Name | String | Process name. |
| FidelisEndpoint.Query.User | String | The user of the system. |
| FidelisEndpoint.Query.TargetID | String | Process target ID. |
| FidelisEndpoint.Query.Hash | String | File hash. |
| FidelisEndpoint.Query.StartTime | Date | Process start time. |
| FidelisEndpoint.Query.EventType | Number | Event type. |
| FidelisEndpoint.Query.ParentName | String | Process parent name. |
| FidelisEndpoint.Query.IndexingTime | Date | Indexing time. |
| FidelisEndpoint.Query.EntityType | Number | Entity type. |
Command Example
!fidelis-endpoint-query-process logic="and" process_name="svchost.exe"
Context Example
{
"FidelisEndpoint.Query": [
{
"EsDocumentType": "processlog",
"EventTime": "2020-03-26T09:02:26.511Z",
"IndexingTime": "2020-03-26T09:06:31.958Z",
"Hash": "8a0a29438052faed8a2532da50451234",
"Name": "svchost.exe",
"ParentName": "services.exe",
"EsIndex": "eh_20200326_1585180800000_0",
"EventType": 0,
"TargetID": "rSdnlXD7OX6",
"EntityType": 0,
"PID": 4432,
"ProcessStartTime": "2020-03-26T09:02:26.511Z",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "NT AUTHORITY\\SYSTEM",
"StartTime": "2020-03-26T09:02:26.511Z",
"ParentID": "TG9An342Ym8",
"Path": "C:\\Windows\\System32\\svchost.exe"
},
{
"EsDocumentType": "processlog",
"EventTime": "2020-03-26T08:02:26.197Z",
"IndexingTime": "2020-03-26T08:05:00.035Z",
"Hash": "8a0a29438052faed8a2532da50451234",
"Name": "svchost.exe",
"ParentName": "services.exe",
"EsIndex": "eh_20200326_1585180800000_0",
"EventType": 0,
"TargetID": "m31v1MqQ6",
"EntityType": 0,
"PID": 2084,
"ProcessStartTime": "2020-03-26T08:02:26.197Z",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "NT AUTHORITY\\SYSTEM",
"StartTime": "2020-03-26T08:02:26.197Z",
"ParentID": "TG9An342Ym8",
"Path": "C:\\Windows\\System32\\svchost.exe"
},
{
"EsDocumentType": "processlog",
"EventTime": "2020-03-26T07:02:25.887Z",
"IndexingTime": "2020-03-26T07:08:28.331Z",
"Hash": "8a0a29438052faed8a2532da50451234",
"Name": "svchost.exe",
"ParentName": "services.exe",
"EsIndex": "eh_20200326_1585180800000_0",
"EventType": 0,
"TargetID": "fmz4un6Qzfd",
"EntityType": 0,
"PID": 1972,
"ProcessStartTime": "2020-03-26T07:02:25.887Z",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "NT AUTHORITY\\SYSTEM",
"StartTime": "2020-03-26T07:02:25.887Z",
"ParentID": "TG9An342Ym8",
"Path": "C:\\Windows\\System32\\svchost.exe"
},
{
"EsDocumentType": "processlog",
"EventTime": "2020-03-26T06:15:07.125Z",
"IndexingTime": "2020-03-26T06:20:26.814Z",
"Hash": "8a0a29438052faed8a2532da50451234",
"Name": "svchost.exe",
"ParentName": "services.exe",
"EsIndex": "eh_20200326_1585180800000_0",
"EventType": 0,
"TargetID": "fS3SPnQU5Xe",
"EntityType": 0,
"PID": 656,
"ProcessStartTime": "2020-03-26T06:15:07.125Z",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "NT AUTHORITY\\NETWORK SERVICE",
"StartTime": "2020-03-26T06:15:07.125Z",
"ParentID": "TG9An342Ym8",
"Path": "C:\\Windows\\System32\\svchost.exe"
},
{
"EsDocumentType": "processlog",
"EventTime": "2020-03-25T19:02:22.160Z",
"IndexingTime": "2020-03-25T19:06:37.610Z",
"Hash": "8a0a29438052faed8a2532da50451234",
"Name": "svchost.exe",
"ParentName": "services.exe",
"EsIndex": "eh_20200325_1585094400000_0",
"EventType": 0,
"TargetID": "byvPk5D9Mdd",
"EntityType": 0,
"PID": 2692,
"ProcessStartTime": "2020-03-25T19:02:22.160Z",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "NT AUTHORITY\\SYSTEM",
"StartTime": "2020-03-25T19:02:22.160Z",
"ParentID": "TG9An342Ym8",
"Path": "C:\\Windows\\System32\\svchost.exe"
}
]
}
Human Readable Output
Fidelis Endpoint process results
| PID | EndpointName | Name | Path | User | Hash | ProcessStartTime | Parameters | ParentName | EventType |
|---|---|---|---|---|---|---|---|---|---|
| 4432 | fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | NT AUTHORITY\SYSTEM | 8a0a29438052faed8a2532da50451234 | 2020-03-26T09:02:26.511Z | C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc | services.exe | 0 |
| 2084 | fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | NT AUTHORITY\SYSTEM | 8a0a29438052faed8a2532da50451234 | 2020-03-26T08:02:26.197Z | C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc | services.exe | 0 |
| 1972 | fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | NT AUTHORITY\SYSTEM | 8a0a29438052faed8a2532da50451234 | 2020-03-26T07:02:25.887Z | C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc | services.exe | 0 |
| 656 | fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | NT AUTHORITY\NETWORK SERVICE | 8a0a29438052faed8a2532da50451234 | 2020-03-26T06:15:07.125Z | C:\Windows\System32\svchost.exe -k NetworkService -p -s DoSvc | services.exe | 0 |
| 1400 | fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | NT AUTHORITY\SYSTEM | 8a0a29438052faed8a2532da50451234 | 2020-03-26T06:02:25.581Z | C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc | services.exe | 0 |
| 2800 | fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | NT AUTHORITY\SYSTEM | 8a0a29438052faed8a2532da50451234 | 2020-03-26T05:02:25.266Z | C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc | services.exe | 0 |
20. fidelis-endpoint-query-connection-by-remote-ip
Queries a connection by remote IP address.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-query-connection-by-remote-ip
Input
| Argument Name | Description | Required |
|---|---|---|
| start_time | The start time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| end_time | The end time of the event in the system in UTC format. Supported values:”2019-10-21T23:45:00” (date). |
Optional |
| logic | The logic of the query. Can be “and” or “or”. | Required |
| remote_ip | The remote IP address on which to query. | Required |
| limit | The maximum number of results to return. The default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Query.ProcessStartTime | Date | Process start time. |
| FidelisEndpoint.Query.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Query.ParentID | String | Process parent ID. |
| FidelisEndpoint.Query.EventTime | Date | Event time. |
| FidelisEndpoint.Query.RemotePort | Number | Remote port. |
| FidelisEndpoint.Query.LocalPort | Number | Local port. |
| FidelisEndpoint.Query.TargetID | String | Target ID. |
| FidelisEndpoint.Query.RemoteIP | String | Remote IP address. |
| FidelisEndpoint.Query.StartTime | Date | Event start time. |
| FidelisEndpoint.Query.EndpointID | String | Endpoint ID. |
| FidelisEndpoint.Query.NetworkDirection | Number | Network direction. |
| FidelisEndpoint.Query.LastEventTime | Date | Last event time. |
| FidelisEndpoint.Query.LocalIP | String | Local IP address. |
| FidelisEndpoint.Query.EventType | Number | Event type. |
| FidelisEndpoint.Query.ParentName | String | Parent name. |
| FidelisEndpoint.Query.FirstEventTime | Date | First event time. |
| FidelisEndpoint.Query.EventIndex | Number | Event Index. |
| FidelisEndpoint.Query.Protocol | String | Protocol. |
| FidelisEndpoint.Query.PPID | Number | Process parent ID. |
| FidelisEndpoint.Query.EntityType | Number | Entity type. |
| FidelisEndpoint.Query.ParentHashSHA1 | String | Parent SHA1 hash. |
Command Example
!fidelis-endpoint-query-connection-by-remote-ip logic=and remote_ip=10.10.0.1 limit=5
Context Example
{
"FidelisEndpoint.Query": [
{
"RemotePort": "53",
"EventTime": "2020-03-26T09:32:31.172Z",
"ParentName": "svchost.exe",
"Protocol": "UDP",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"LastEventTime": "2020-03-26T09:32:31.172Z",
"FirstEventTime": "2020-03-26T09:28:31.148Z",
"EventType": 3,
"EntityType": 3,
"TargetID": "O6ZdOEYU2z8",
"ProcessStartTime": "2020-03-12T03:58:09.962Z",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 10,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "0",
"PPID": 1196,
"parentHashSHA1": "a1385ce20ad79f55df235effd9780c31442aa234",
"LocalPort": "64669"
},
{
"RemotePort": "53",
"EventTime": "2020-03-26T09:32:31.169Z",
"ParentName": "svchost.exe",
"Protocol": "UDP",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"LastEventTime": "2020-03-26T09:32:31.172Z",
"FirstEventTime": "2020-03-26T09:28:31.148Z",
"EventType": 3,
"EntityType": 3,
"TargetID": "Do8ec6zGCEi",
"ProcessStartTime": "2020-03-12T03:58:09.962Z",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 9,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "2",
"PPID": 1196,
"parentHashSHA1": "a1385ce20ad79f55df235effd9780c31442aa234",
"LocalPort": "64669"
},
{
"RemotePort": "53",
"EventTime": "2020-03-26T09:32:14.522Z",
"ParentName": "svchost.exe",
"Protocol": "UDP",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"LastEventTime": "2020-03-26T09:32:31.172Z",
"FirstEventTime": "2020-03-26T09:28:31.148Z",
"EventType": 3,
"EntityType": 3,
"TargetID": "8825LGOTGzf",
"ProcessStartTime": "2020-03-12T03:58:09.962Z",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 8,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "0",
"PPID": 1196,
"parentHashSHA1": "a1385ce20ad79f55df235effd9780c31442aa234",
"LocalPort": "53557"
}
]
}
Human Readable Output
Fidelis Endpoint query results for connection by remote IP
| EndpointID | EndpointName | PPID | LocalIP | LocalPort | RemoteIP | RemotePort | ProcessStartTime | FirstEventTime | LastEventTime | Protocol | ParentHashSHA1 | ParentName | EventType |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 1196 | 2.2.2.2 | 64669 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | 2020-03-26T09:28:31.148Z | 2020-03-26T09:32:31.172Z | UDP | a1385ce20ad79f55df235effd9780c31442aa234 | svchost.exe | 3 |
| 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 1196 | 2.2.2.2 | 64669 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | 2020-03-26T09:28:31.148Z | 2020-03-26T09:32:31.172Z | UDP | a1385ce20ad79f55df235effd9780c31442aa234 | svchost.exe | 3 |
| 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 1196 | 2.2.2.2 | 53557 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | 2020-03-26T09:28:31.148Z | 2020-03-26T09:32:31.172Z | UDP | a1385ce20ad79f55df235effd9780c31442aa234 | svchost.exe | 3 |
| 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 1196 | 2.2.2.2 | 53557 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | 2020-03-26T09:28:31.148Z | 2020-03-26T09:32:31.172Z | UDP | a1385ce20ad79f55df235effd9780c31442aa234 | svchost.exe | 3 |
| 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 1196 | 2.2.2.2 | 60427 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | 2020-03-26T09:28:31.148Z | 2020-03-26T09:32:31.172Z | UDP | a1385ce20ad79f55df235effd9780c31442aa234 | svchost.exe | 3 |
| 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 1196 | 2.2.2.2 | 60427 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | 2020-03-26T09:28:31.148Z | 2020-03-26T09:32:31.172Z | UDP | a1385ce20ad79f55df235effd9780c31442aa234 | svchost.exe | 3 |
21. fidelis-endpoint-query-by-dns
Queries by DNS request.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-query-by-dns
Input
| Argument Name | Description | Required |
|---|---|---|
| start_time | The start time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| end_time | The end time of the event in the system in UTC format. Supported values:”2019-10-21T23:45:00” (date). |
Optional |
| logic | The logic of the query. Can be “and” or “or”. | Required |
| url | URL or domain on which to query. | Required |
| limit | The maximum number of results to return. The default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Query.ProcessStartTime | Date | Process start time. |
| FidelisEndpoint.Query.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Query.ParentID | String | Parent ID. |
| FidelisEndpoint.Query.EventTime | Date | Event time. |
| FidelisEndpoint.Query.RemotePort | Number | Remote port. |
| FidelisEndpoint.Query.DnsAnswer | String | The DNS answer. |
| FidelisEndpoint.Query.LocalPort | Number | Local port. |
| FidelisEndpoint.Query.TargetID | String | The target ID. |
| FidelisEndpoint.Query.RemoteIP | String | Remote IP address. |
| FidelisEndpoint.Query.DnsQuestion | String | The DNS question. |
| FidelisEndpoint.Query.StartTime | Date | Event start time. |
| FidelisEndpoint.Query.NetworkDirection | Number | Network direction. |
| FidelisEndpoint.Query.LocalIP | String | Local IP address. |
| FidelisEndpoint.Query.EventType | Number | Event type. |
| FidelisEndpoint.Query.EventIndex | Number | Event index. |
| FidelisEndpoint.Query.IndexingTime | Date | Indexing time. |
| FidelisEndpoint.Query.EntityType | Number | Entity type. |
Command Example
!fidelis-endpoint-query-by-dns start_time="2019-10-02T00:00:00.842Z" end_time="2020-03-08T15:50:05.552Z" logic="and" url="login.live.com"
Context Example
{
"FidelisEndpoint.Query": [
{
"RemotePort": "53",
"EventTime": "2020-03-08T06:13:14.009Z",
"IndexingTime": "2020-03-08T06:21:15.635Z",
"LocalPort": "49862",
"EventType": 17,
"EntityType": 6,
"TargetID": "UmDG80sJNc6",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 6,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"login.msa.msidentity.com\",\"IP\":\"\",\"TTL\":\"299\"},{\"name\":\"login.msa.msidentity.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"login.msa.akadns6.net\",\"IP\":\"\",\"TTL\":\"299\"},{\"name\":\"login.msa.akadns6.net\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"ipv4.login.msa.akadns6.net\",\"IP\":\"\",\"TTL\":\"299\"},{\"name\":\"ipv4.login.msa.akadns6.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"3.3.3.3\",\"TTL\":\"299\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-08T03:55:54.514Z",
"IndexingTime": "2020-03-08T04:03:12.475Z",
"LocalPort": "53712",
"EventType": 17,
"EntityType": 6,
"TargetID": "UmDG80sJNc6",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"login.msa.msidentity.com\",\"IP\":\"\",\"TTL\":\"51\"},{\"name\":\"login.msa.msidentity.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"lgin.msa.trafficmanager.net\",\"IP\":\"\",\"TTL\":\"51\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"2.2.2.2\",\"TTL\":\"59\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"3.3.3.3\",\"TTL\":\"59\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"4.4.4.4\",\"TTL\":\"59\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-08T03:11:13.833Z",
"IndexingTime": "2020-03-08T03:17:38.628Z",
"LocalPort": "61574",
"EventType": 17,
"EntityType": 6,
"TargetID": "UmDG80sJNc6",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 5,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"login.msa.msidentity.com\",\"IP\":\"\",\"TTL\":\"230\"},{\"name\":\"login.msa.msidentity.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"lgin.msa.trafficmanager.net\",\"IP\":\"\",\"TTL\":\"235\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"3.3.3.3\",\"TTL\":\"56\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"2.2.2.2\",\"TTL\":\"56\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"7.7.7.7\",\"TTL\":\"56\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-07T21:53:12.298Z",
"IndexingTime": "2020-03-07T21:57:29.402Z",
"LocalPort": "57803",
"EventType": 17,
"EntityType": 6,
"TargetID": "UmDG80sJNc6",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 4,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"login.msa.msidentity.com\",\"IP\":\"\",\"TTL\":\"16\"},{\"name\":\"login.msa.msidentity.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"lgin.msa.trafficmanager.net\",\"IP\":\"\",\"TTL\":\"197\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"3.3.3.3\",\"TTL\":\"59\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"2.2.2.2\",\"TTL\":\"59\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"7.7.7.7\",\"TTL\":\"59\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
}
]
}
Human Readable Output
Fidelis Endpoint query results for the DNS request
| EndpointName | LocalIP | LocalPort | RemoteIP | RemotePort | ProcessStartTime | DnsAnswer | EventType |
|---|---|---|---|---|---|---|---|
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 49862 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_answers”:[{“name”:”login.live.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.msidentity.com”,”IP”:””,”TTL”:”299”},{“name”:”login.msa.msidentity.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.akadns6.net”,”IP”:””,”TTL”:”299”},{“name”:”login.msa.akadns6.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”ipv4.login.msa.akadns6.net”,”IP”:””,”TTL”:”299”},{“name”:”ipv4.login.msa.akadns6.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”299”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 53712 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_answers”:[{“name”:”login.live.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.msidentity.com”,”IP”:””,”TTL”:”51”},{“name”:”login.msa.msidentity.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”lgin.msa.trafficmanager.net”,”IP”:””,”TTL”:”51”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”2.2.2.2”,”TTL”:”59”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”59”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”4.4.4.4”,”TTL”:”59”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 61574 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_answers”:[{“name”:”login.live.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.msidentity.com”,”IP”:””,”TTL”:”230”},{“name”:”login.msa.msidentity.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”lgin.msa.trafficmanager.net”,”IP”:””,”TTL”:”235”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”56”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”2.2.2.2”,”TTL”:”56”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”7.7.7.7”,”TTL”:”56”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 57803 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_answers”:[{“name”:”login.live.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.msidentity.com”,”IP”:””,”TTL”:”16”},{“name”:”login.msa.msidentity.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”lgin.msa.trafficmanager.net”,”IP”:””,”TTL”:”197”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”59”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”59”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”7.7.7.7”,”TTL”:”59”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 58656 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_answers”:[{“name”:”login.live.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.msidentity.com”,”IP”:””,”TTL”:”288”},{“name”:”login.msa.msidentity.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.akadns6.net”,”IP”:””,”TTL”:”288”},{“name”:”login.msa.akadns6.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”ipv4.login.msa.akadns6.net”,”IP”:””,”TTL”:”288”},{“name”:”ipv4.login.msa.akadns6.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”2.2.2.20”,”TTL”:”123”},{“name”:”ipv4.login.msa.akadns6.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”7.7.7.7”,”TTL”:”123”},{“name”:”ipv4.login.msa.akadns6.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”10.10.10.10”,”TTL”:”123”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 59564 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_answers”:[{“name”:”login.live.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.msidentity.com”,”IP”:””,”TTL”:”238”},{“name”:”login.msa.msidentity.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.akadns6.net”,”IP”:””,”TTL”:”238”},{“name”:”login.msa.akadns6.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”ipv4.login.msa.akadns6.net”,”IP”:””,”TTL”:”238”},{“name”:”ipv4.login.msa.akadns6.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”238”},{“name”:”ipv4.login.msa.akadns6.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”7.7.7.7”,”TTL”:”238”},{“name”:”ipv4.login.msa.akadns6.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”10.10.10.10”,”TTL”:”238”}]} | 17 |
22. fidelis-endpoint-query-dns-by-server-ip
Queries DNS by server IP address.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-query-dns-by-server-ip
Input
| Argument Name | Description | Required |
|---|---|---|
| start_time | The start time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| end_time | The end time of the event in the system in UTC format. Supported values:”2019-10-21T23:45:00” (date). |
Optional |
| logic | The logic of the query. Can be “and” or “or”. | Required |
| remote_ip | The remote IP on which to query. | Required |
| limit | The maximum number of results to return. The default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Query.ProcessStartTime | Date | Process start time. |
| FidelisEndpoint.Query.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Query.ParentID | String | Parent ID. |
| FidelisEndpoint.Query.EventTime | Date | Event time. |
| FidelisEndpoint.Query.RemotePort | Number | Remote port. |
| FidelisEndpoint.Query.DnsAnswer | String | The DNS answer. |
| FidelisEndpoint.Query.LocalPort | Number | Local port. |
| FidelisEndpoint.Query.TargetID | String | The target ID. |
| FidelisEndpoint.Query.RemoteIP | String | Remote IP address. |
| FidelisEndpoint.Query.DnsQuestion | String | The DNS question. |
| FidelisEndpoint.Query.StartTime | Date | Event start time. |
| FidelisEndpoint.Query.NetworkDirection | Number | Network direction. |
| FidelisEndpoint.Query.LocalIP | String | Local IP address. |
| FidelisEndpoint.Query.EventType | Number | Event type. |
| FidelisEndpoint.Query.EventIndex | Number | Event index. |
| FidelisEndpoint.Query.IndexingTime | Date | Indexing time. |
| FidelisEndpoint.Query.EntityType | Number | Entity type. |
Command Example
!fidelis-endpoint-query-dns-by-server-ip logic="or" remote_ip="10.10.0.1"
Context Example
{
"FidelisEndpoint.Query": [
{
"RemotePort": "53",
"EventTime": "2020-03-26T09:29:07.671Z",
"IndexingTime": "2020-03-26T09:36:32.819Z",
"LocalPort": "61597",
"EventType": 17,
"EntityType": 6,
"TargetID": "9anFqxCrJ3h",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"v10.events.data.microsoft.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 4,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"v10.events.data.microsoft.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"global.events.data.trafficmanager.net\",\"IP\":\"\",\"TTL\":\"1425\"},{\"name\":\"global.events.data.trafficmanager.net\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"skypedataprdcoleus06.cloudapp.net\",\"IP\":\"\",\"TTL\":\"45\"},{\"name\":\"skypedataprdcoleus06.cloudapp.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"10.10.10.10\",\"TTL\":\"5\"}]}",
"ProcessStartTime": "2020-03-12T03:58:09.962Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-26T09:14:07.314Z",
"IndexingTime": "2020-03-26T09:18:31.967Z",
"LocalPort": "55911",
"EventType": 17,
"EntityType": 6,
"TargetID": "9anFqxCrJ3h",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"v10.events.data.microsoft.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"v10.events.data.microsoft.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"global.events.data.trafficmanager.net\",\"IP\":\"\",\"TTL\":\"1390\"},{\"name\":\"global.events.data.trafficmanager.net\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"skypedataprdcolcus00.cloudapp.net\",\"IP\":\"\",\"TTL\":\"25\"},{\"name\":\"skypedataprdcolcus00.cloudapp.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"2.2.2.2\",\"TTL\":\"9\"}]}",
"ProcessStartTime": "2020-03-12T03:58:09.962Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-26T09:01:55.586Z",
"IndexingTime": "2020-03-26T09:06:31.755Z",
"LocalPort": "56095",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 4,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"144\"}]}",
"ProcessStartTime": "2020-03-12T03:58:09.962Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-26T08:59:06.523Z",
"IndexingTime": "2020-03-26T09:02:31.650Z",
"LocalPort": "61769",
"EventType": 17,
"EntityType": 6,
"TargetID": "9anFqxCrJ3h",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"v10.events.data.microsoft.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"v10.events.data.microsoft.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"global.events.data.trafficmanager.net\",\"IP\":\"\",\"TTL\":\"862\"},{\"name\":\"global.events.data.trafficmanager.net\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"skypedataprdc.cloudapp.net\",\"IP\":\"\",\"TTL\":\"19\"},{\"name\":\"skypedataprdcolase00.cloudapp.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"3.3.3.3\",\"TTL\":\"9\"}]}",
"ProcessStartTime": "2020-03-12T03:58:09.962Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-26T08:44:30.882Z",
"IndexingTime": "2020-03-26T08:50:31.264Z",
"LocalPort": "53940",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 5,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"274\"}]}",
"ProcessStartTime": "2020-03-12T03:58:09.962Z"
}
]
}
Human Readable Output
Fidelis Endpoint query results for the DNS request by server IP
| EndpointName | LocalIP | LocalPort | RemoteIP | RemotePort | ProcessStartTime | DnsAnswer | EventType |
|---|---|---|---|---|---|---|---|
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 61597 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”v10.events.data.microsoft.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”global.events.data.trafficmanager.net”,”IP”:””,”TTL”:”1425”},{“name”:”global.events.data.trafficmanager.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”skypedataprdcoleus06.cloudapp.net”,”IP”:””,”TTL”:”45”},{“name”:”skypedataprdcoleus06.cloudapp.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”2.2.2.2”,”TTL”:”5”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 55911 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”v10.events.data.microsoft.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”global.events.data.trafficmanager.net”,”IP”:””,”TTL”:”1390”},{“name”:”global.events.data.trafficmanager.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”skypedataprdcolcus00.cloudapp.net”,”IP”:””,”TTL”:”25”},{“name”:”skypedataprdcolcus00.cloudapp.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”9”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 56095 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”144”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 61769 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”v10.events.data.microsoft.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”global.events.data.trafficmanager.net”,”IP”:””,”TTL”:”862”},{“name”:”global.events.data.trafficmanager.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”skypedataprdcolase00.cloudapp.net”,”IP”:””,”TTL”:”19”},{“name”:”skypedataprdcolase00.cloudapp.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”4.4.4.4”,”TTL”:”9”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 53940 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”274”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 57260 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”v10.events.data.microsoft.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”global.events.data.trafficmanager.net”,”IP”:””,”TTL”:”1698”},{“name”:”global.events.data.trafficmanager.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”skypedataprdcolneu00.cloudapp.net”,”IP”:””,”TTL”:”21”},{“name”:”skypedataprdcolneu00.cloudapp.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”7.7.7.7”,”TTL”:”9”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 58832 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”206”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 60472 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”v10.events.data.microsoft.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”global.events.data.trafficmanager.net”,”IP”:””,”TTL”:”3334”},{“name”:”global.events.data.trafficmanager.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”skypedataprdcolweu05.cloudapp.net”,”IP”:””,”TTL”:”58”},{“name”:”skypedataprdcolweu05.cloudapp.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”10.10.0.1”,”TTL”:”8”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 54309 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”v10.events.data.microsoft.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”global.events.data.trafficmanager.net”,”IP”:””,”TTL”:”2327”},{“name”:”global.events.data.trafficmanager.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”skypedataprdcoluks05.cloudapp.net”,”IP”:””,”TTL”:”44”},{“name”:”skypedataprdcoluks05.cloudapp.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”10.10.0.1”,”TTL”:”7”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 61757 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”273”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 49681 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”v10.events.data.microsoft.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”global.events.data.trafficmanager.net”,”IP”:””,”TTL”:”798”},{“name”:”global.events.data.trafficmanager.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”skypedataprdcolwus08.cloudapp.net”,”IP”:””,”TTL”:”40”},{“name”:”fe2.update.microsoft.com.nsatc.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”10.10.0.1”,”TTL”:”175”}]} | 17 |
23. fidelis-endpoint-query-dns-by-source-ip
Queries DNS by source IP address.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-query-dns-by-source-ip
Input
| Argument Name | Description | Required |
|---|---|---|
| start_time | The start time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| end_time | The end time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| logic | The logic of the query. Can be “and” or “or”. | Required |
| source_ip | The source IP address to query. | Required |
| domain | The domain to query. | Optional |
| limit | The maximum number of results to return. The default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Query.ProcessStartTime | Date | Process start time. |
| FidelisEndpoint.Query.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Query.ParentID | String | Parent ID. |
| FidelisEndpoint.Query.EventTime | Date | Event time. |
| FidelisEndpoint.Query.RemotePort | Number | Remote port. |
| FidelisEndpoint.Query.DnsAnswer | String | The DNS answer. |
| FidelisEndpoint.Query.LocalPort | Number | Local port. |
| FidelisEndpoint.Query.TargetID | String | The target ID. |
| FidelisEndpoint.Query.RemoteIP | String | Remote IP address. |
| FidelisEndpoint.Query.DnsQuestion | String | The DNS question. |
| FidelisEndpoint.Query.StartTime | Date | Event start time. |
| FidelisEndpoint.Query.NetworkDirection | Number | Network direction. |
| FidelisEndpoint.Query.LocalIP | String | Local IP address. |
| FidelisEndpoint.Query.EventType | Number | Event type. |
| FidelisEndpoint.Query.EventIndex | Number | Event index. |
| FidelisEndpoint.Query.IndexingTime | Date | Indexing time. |
| FidelisEndpoint.Query.EntityType | Number | Entity type. |
Command Example
!fidelis-endpoint-query-dns-by-source-ip start_time="2020-01-01T00:00:00.842Z" end_time="2020-03-08T15:50:05.552Z" logic="or" source_ip="10.128.0.4" domain="logging.googleapis.com" limit=5
Context Example
{
"FidelisEndpoint.Query": [
{
"RemotePort": "53",
"EventTime": "2020-03-08T12:21:34.260Z",
"IndexingTime": "2020-03-08T12:26:25.293Z",
"LocalPort": "51663",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"87\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-08T12:18:33.199Z",
"IndexingTime": "2020-03-08T12:23:25.135Z",
"LocalPort": "65002",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"105\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-08T11:17:33.908Z",
"IndexingTime": "2020-03-08T11:25:23.700Z",
"LocalPort": "49412",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"253\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-08T11:05:33.831Z",
"IndexingTime": "2020-03-08T11:11:23.189Z",
"LocalPort": "63755",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"282\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-08T09:54:32.087Z",
"IndexingTime": "2020-03-08T09:59:21.585Z",
"LocalPort": "60331",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 5,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"61\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-08T09:53:33.246Z",
"IndexingTime": "2020-03-08T09:59:21.585Z",
"LocalPort": "58452",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"12\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
}
]
}
Human Readable Output
Fidelis Endpoint query results for the DNS request by source IP
| EndpointName | LocalIP | LocalPort | RemoteIP | RemotePort | ProcessStartTime | DnsQuestion | DnsAnswer |
|---|---|---|---|---|---|---|---|
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 51663 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_questions”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”}]} | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”6.6.6.6”,”TTL”:”87”}]} |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 65002 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_questions”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”}]} | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”6.6.6.6”,”TTL”:”105”}]} |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 49412 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_questions”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”}]} | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”6.6.6.6”,”TTL”:”253”}]} |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 63755 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_questions”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”}]} | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”6.6.6.6”,”TTL”:”282”}]} |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 60331 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_questions”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”}]} | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”6.6.6.6”,”TTL”:”61”}]} |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 58452 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_questions”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”}]} | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”6.6.6.6”,”TTL”:”12”}]} |
24. fidelis-endpoint-query-events
Queries events.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-query-events
Input
| Argument Name | Description | Required |
|---|---|---|
| start_time | The start time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| end_time | The end time of the event in the system in UTC format. Supported values:”2019-10-21T23:45:00” (date). |
Optional |
| logic | The logic of the query. Can be “and” or “or”. | Required |
| entity_type | Query entity type. Can be “antiMalware”, “dns”, “file”, “network”, “process”, “registry”, “remoteThread”, “script”, “usb”, or “windowsevent”. | Required |
| column | Column to query. For example: hash, name, remoteIP, dnsQuestion, localIP. | Required |
| value | The value to query. Can be an IP address, file hash, file path, and so on. | Required |
| operator | The operator, which describes how the “value” relates to the “field” (for example: “=”, “!=”, “>”, “<”). | Required |
| limit | The maximum number of results to return. The default is 50. | Optional |
| additional_filter | An additional filter to use in the query. For example: pid = 1234, pid > 1233. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Query.ProcessStartTime | Date | Process start time. |
| FidelisEndpoint.Query.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Query.Path | String | File path. |
| FidelisEndpoint.Query.ParentID | String | Parent ID. |
| FidelisEndpoint.Query.EventTime | Date | Event time. |
| FidelisEndpoint.Query..RemotePort | Number | Remote port. |
| FidelisEndpoint.Query.DnsAnswer | String | DNS answer. |
| FidelisEndpoint.Query.PID | Number | Process ID. |
| FidelisEndpoint.Query.Name | String | Process name. |
| FidelisEndpoint.Query.User | String | Endpoint user. |
| FidelisEndpoint.Query.LocalPort | Number | Local port. |
| FidelisEndpoint.Query.TargetID | String | Target ID. |
| FidelisEndpoint.Query.RemoteIP | String | Remote IP address. |
| FidelisEndpoint.Query.Hash | String | File hash. |
| FidelisEndpoint.Query.DnsQuestion | String | DNS question. |
| FidelisEndpoint.Query.StartTime | Date | Start time of the event. |
| FidelisEndpoint.Query.Entropy | Number | Entropy. |
| FidelisEndpoint.Query.LocalIP | String | Local IP address. |
| FidelisEndpoint.Query.EventType | Number | Event type. |
| FidelisEndpoint.Query.ParentName | String | Parent name. |
| FidelisEndpoint.Query.EventIndex | Number | Event index. |
| FidelisEndpoint.Query.IndexingTime | Date | Indexing time. |
| FidelisEndpoint.Query.EntityType | Number | Entity type. |
Command Example
!fidelis-endpoint-query-events column=name entity_type=process logic=or value=cmd.exe additional_filter="pid = 3276" operator="="
Context Example
{
"FidelisEndpoint.Query": [
{
"EntityType": 0,
"TargetID": "qgOl6OBq7v8",
"LocalIP": null,
"RemotePort": null,
"ProcessStartTime": "2020-03-26T09:25:53.122Z",
"IndexingTime": "2020-03-26T09:30:32.434Z",
"Hash": "975b45b669930b0cc773eaf2b412345f",
"LocalPort": null,
"EventType": 0,
"ParentName": "endpoint.exe",
"PID": 908,
"DnsQuestion": null,
"User": "NT AUTHORITY\\SYSTEM",
"EventIndex": null,
"Path": "C:\\Windows\\System32\\cmd.exe",
"DnsAnswer": null,
"RemoteIP": null,
"EventTime": "2020-03-26T09:25:53.122Z",
"Name": "cmd.exe",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-26T09:25:53.122Z",
"ParentID": "MKH6hK7yr75"
},
{
"EntityType": 0,
"TargetID": "w8qh7ogIf8l",
"LocalIP": null,
"RemotePort": null,
"ProcessStartTime": "2020-03-26T09:25:39.883Z",
"IndexingTime": "2020-03-26T09:30:32.878Z",
"Hash": "975b45b669930b0cc773eaf2b412345f",
"LocalPort": null,
"EventType": 0,
"ParentName": "endpoint.exe",
"PID": 3376,
"DnsQuestion": null,
"User": "NT AUTHORITY\\SYSTEM",
"EventIndex": null,
"Path": "C:\\Windows\\System32\\cmd.exe",
"DnsAnswer": null,
"RemoteIP": null,
"EventTime": "2020-03-26T09:25:39.883Z",
"Name": "cmd.exe",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-26T09:25:39.883Z",
"ParentID": "MKH6hK7yr75"
},
{
"EntityType": 0,
"TargetID": "SSDiQFEHvNg",
"LocalIP": null,
"RemotePort": null,
"ProcessStartTime": "2020-03-26T09:08:23.233Z",
"IndexingTime": "2020-03-26T09:12:32.225Z",
"Hash": "975b45b669930b0cc773eaf2b412345f",
"LocalPort": null,
"EventType": 0,
"ParentName": "endpoint.exe",
"PID": 2804,
"DnsQuestion": null,
"User": "NT AUTHORITY\\SYSTEM",
"EventIndex": null,
"Path": "C:\\Windows\\System32\\cmd.exe",
"DnsAnswer": null,
"RemoteIP": null,
"EventTime": "2020-03-26T09:08:23.233Z",
"Name": "cmd.exe",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-26T09:08:23.233Z",
"ParentID": "MKH6hK7yr75"
}
]
}
Human Readable Output
Fidelis Endpoint query events result
|PID|EndpointName|User|ProcessStartTime|ParentID|EventType|
|—|—|—|—|—|—|
| 908 | fidelis-endpoint-winserver2019 | NT AUTHORITY\SYSTEM | 2020-03-26T09:25:53.122Z | MKH6hK7yr75 | 0 |
| 3376 | fidelis-endpoint-winserver2019 | NT AUTHORITY\SYSTEM | 2020-03-26T09:25:39.883Z | MKH6hK7yr75 | 0 |
| 2804 | fidelis-endpoint-winserver2019 | NT AUTHORITY\SYSTEM | 2020-03-26T09:08:23.233Z | MKH6hK7yr75 | 0 |
24 Packs/FidelisEndpoint/pack_metadata.json
Configuration parameters
url— Server URL (e.g. https://abcde.fideliscloud.com/) (required)credentials— Username (required)incidentType— Incident typeincidentFetchInterval— Incidents Fetch IntervalisFetch— Fetch incidentsfetch_time— First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)fetch_limit— Fetch limit (minimum 5)insecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (24)
-
fidelis-endpoint-delete-fileDeletes a file at the specified path.
-
fidelis-endpoint-delete-file-search-jobRemoves the job to free up space on the server.
-
fidelis-endpoint-execute-scriptExecutes a script package from Fidelis endpoint packages.
-
fidelis-endpoint-file-searchSearches for files on multiple hosts, using file hash, file extension, file size, and other search criteria.
-
fidelis-endpoint-file-search-result-metadataGets the job results metadata. The maximum is 50 results.
-
fidelis-endpoint-file-search-statusGets the file search job status.
-
fidelis-endpoint-get-fileGets the file stream and download the file.
-
fidelis-endpoint-get-script-manifestGets the script manifest.
-
fidelis-endpoint-get-script-resultGets script job results.
-
fidelis-endpoint-host-infoSearches for endpoints based on an IP address or hostname.
-
fidelis-endpoint-isolate-networkQuarantines an endpoint. While isolated, the endpoint's network communication is restricted to only the allowed servers.
-
fidelis-endpoint-kill-processTerminates the process that matches the required parameter's process ID.
-
fidelis-endpoint-list-alertsReturns all alerts in the system.
-
fidelis-endpoint-list-processesGets a list all processes according to the OS system.
-
fidelis-endpoint-list-scriptsGets a list of all script packages.
-
fidelis-endpoint-query-by-dnsQueries by DNS request.
-
fidelis-endpoint-query-connection-by-remote-ipQueries a connection by remote IP address.
-
fidelis-endpoint-query-dns-by-server-ipQueries DNS by server IP address.
-
fidelis-endpoint-query-dns-by-source-ipQueries DNS by source IP address.
-
fidelis-endpoint-query-eventsQueries events.
-
fidelis-endpoint-query-fileQueries a file by file hash.
-
fidelis-endpoint-query-processQuery process.
-
fidelis-endpoint-remove-network-isolationRemoves the endpoint from isolation.
-
fidelis-endpoint-script-job-statusGets the script execution status.
import demistomock as demisto import urllib3 from CommonServerPython import * # noqa: E402 lgtm [py/polluting-import] from CommonServerUserPython import * # noqa: E402 lgtm [py/polluting-import] urllib3.disable_warnings() # List processes LIST_PROCESSES_WINDOWS = "2d32a530-0716-4542-afdc-8da3bd47d8bf" # disable-secrets-detection LIST_PROCESSES_LINUX = "5e58a0e9-450d-4394-8360-159d5e38c280" # disable-secrets-detection LIST_PROCESSES_MACOS = "020114c2-d000-4876-91b0-97f41a83b067" # disable-secrets-detection # Kill processes KILL_PROCESS_WINDOWS = "8d379688-dde1-451d-8fa2-4f29c84baf97" # disable-secrets-detection KILL_PROCESS_MAC_LINUX = "76577d3a-c1d7-4d10-af9e-5825c3f9d016" # disable-secrets-detection # Delete file DELETE_FILE_WINDOWS = "11cb4fae-5516-4391-8a3c-eb09793cd5dd" # disable-secrets-detection DELETE_FILE_MAC_LINUX = "bead9799-401d-4b9e-adca-cf41b20c9118" # disable-secrets-detection # Network isolation NETWORK_ISOLATION_WINDOWS = "1d01cc84-753d-4060-89a7-463567552a62" # disable-secrets-detection NETWORK_ISOLATION_MAC_LINUX = "fd09996a-ef56-49fb-b811-0e5da4bd07ca" # disable-secrets-detection # Remove network isolation REMOVE_NETWORK_ISOLATION_WINDOWS = "99bbaea5-df18-40cc-8759-b5fb61527d5a" # disable-secrets-detection REMOVE_NETWORK_ISOLATION_MAC_LINUX = "5e252298-4c50-4cdd-94c0-d6997b79157c" # disable-secrets-detection class Client(BaseClient): """ Client to use in the Fidelis Endpoint integration. Overrides BaseClient """ def __init__(self, server_url: str, username: str, password: str, verify: bool, proxy: bool): super().__init__(base_url=server_url, verify=verify, proxy=proxy) token = self._generate_token(username, password) self._headers = {"Authorization": f"Bearer {token}"} def _generate_token(self, username: str, password: str) -> str: """Generate a token Arguments: username {str} -- Fidelis username to retrieve token with password {str} -- Fidelis password to retrieve token with Returns: token valid for 10 minutes """ params = {"username": username, "password": password} response = self._http_request("GET", "/authenticate", params=params) if response.get("error"): raise Exception(response.get("error")) token = response.get("data", {}).get("token", "") return token def test_module_request(self): """Performs basic GET request to check if the API is reachable and authentication is successful. Returns: Response content """ suffix = "/alerts/getalertsV2" self._http_request("GET", suffix, params={"take": 1}) def list_alerts(self, limit: str = None, sort: str = None, start_date=None, end_date=None) -> dict: url_suffix = "/alerts/getalertsV2" params = assign_params(take=limit, sort=sort, startDate=start_date, endDate=end_date) return self._http_request("GET", url_suffix, params=params) def get_host_info(self, host_name: str, ip_address: str) -> dict: url_suffix = "/endpoints/v2/0/100/hostname Ascending" if host_name: field_name = "HostName" value = host_name elif ip_address: field_name = "IpAddress" value = ip_address else: field_name = "" value = "" demisto.debug(f"No host_name or ip_address -> {field_name=} {value=}") params = { "accessType": "3", "search": json.dumps({"searchFields": [{"fieldName": field_name, "values": [{"value": value}]}]}), } return self._http_request("GET", url_suffix, params=params) def search_file(self, host=None, md5=None, file_extension=None, file_path=None, file_size=None) -> dict: url_suffix = "/files/search" body = assign_params( hosts=host, md5Hashes=md5, fileExtensions=file_extension, filePathHints=file_path, fileSize=file_size ) return self._http_request("POST", url_suffix, json_data=body) def file_search_status(self, job_id: str = None, job_result_id: str = None) -> dict: url_suffix = f"/jobs/getjobstatus/{job_id}/{job_result_id}" return self._http_request("GET", url_suffix) def file_search_results_metadata(self, job_id: str = None, job_result_id: str = None) -> dict: url_suffix = f"/jobs/{job_id}/jobresults/{job_result_id}" return self._http_request("GET", url_suffix) def get_file(self, file_id: str = None) -> str | bytes: url_suffix = f"/files/{file_id}" return self._http_request("GET", url_suffix, resp_type="content") def delete_job(self, job_id: str = None) -> dict: url_suffix = f"/jobs/{job_id}" return self._http_request("DELETE", url_suffix) def list_scripts(self) -> dict: url_suffix = "/packages" return self._http_request("GET", url_suffix) def script_manifest(self, script_id: str = None) -> dict: url_suffix = f"/packages/{script_id}?type=Manifest" return self._http_request("GET", url_suffix) def execute_script( self, script_id: str = None, endpoint_ip: str = None, answer: str | int = "", time_out: int = None, additional_answer: None | str = None, ) -> dict: url_suffix = "/jobs/createTask" body = { "queueExpirationInhours": None, "wizardOverridePassword": False, "impersonationUser": None, "impersonationPassword": None, "priority": None, "timeoutInSeconds": time_out, "packageId": script_id, "endpoints": endpoint_ip, "isPlaybook": False, "taskOptions": [ { "integrationOutputFormat": None, "scriptId": script_id, "questions": [ {"paramNumber": 1, "answer": answer}, { "paramNumber": 2, "answer": additional_answer, }, ], } ], } return self._http_request("POST", url_suffix, json_data=body) def convert_ip_to_endpoint_id(self, ip: list = None) -> dict: url_suffix = "/endpoints/endpointidsbyip" body = ip return self._http_request("POST", url_suffix, json_data=body) def convert_name_to_endpoint_id(self, endpoint_name: list = None) -> dict: url_suffix = "/endpoints/endpointidsbyname" body = endpoint_name return self._http_request("POST", url_suffix, json_data=body) def list_process(self, script_id: str = None, time_out: int = None, endpoint_id: str = None) -> dict: url_suffix = "/jobs/createTask" body = { "queueExpirationInhours": None, "wizardOverridePassword": False, "impersonationUser": None, "impersonationPassword": None, "priority": None, "timeoutInSeconds": time_out, "packageId": script_id, "endpoints": endpoint_id, "isPlaybook": False, "taskOptions": [ { "integrationOutputFormat": None, "scriptId": script_id, "questions": [ { "paramNumber": 1, "answer": True, }, { "paramNumber": 2, "answer": True, }, {"paramNumber": 3, "answer": True}, ], } ], } return self._http_request("POST", url_suffix, json_data=body) def script_job_results(self, job_id: str = None) -> dict: url_suffix = f"/jobresults/{job_id}" return self._http_request("POST", url_suffix) def kill_process(self, script_id: str = None, pid: int = None, time_out: int = None, endpoint_ip=None) -> dict: url_suffix = "/jobs/createTask" body = { "queueExpirationInhours": None, "wizardOverridePassword": False, "impersonationUser": None, "impersonationPassword": None, "priority": None, "timeoutInSeconds": time_out, "packageId": script_id, "endpoints": endpoint_ip, "isPlaybook": False, "taskOptions": [ {"integrationOutputFormat": None, "scriptId": script_id, "questions": [{"paramNumber": 1, "answer": pid}]} ], } return self._http_request("POST", url_suffix, json_data=body) def delete_file(self, script_id: str = None, file_path: str = None, time_out: int = None, endpoint_ip=None) -> dict: url_suffix = "/jobs/createTask" body = { "queueExpirationInhours": None, "wizardOverridePassword": False, "impersonationUser": None, "impersonationPassword": None, "priority": None, "timeoutInSeconds": time_out, "packageId": script_id, "endpoints": endpoint_ip, "isPlaybook": False, "taskOptions": [ {"integrationOutputFormat": None, "scriptId": script_id, "questions": [{"paramNumber": 1, "answer": file_path}]} ], } return self._http_request("POST", url_suffix, json_data=body) def network_isolation( self, script_id: str = None, allowed_server: str = None, time_out: int = None, endpoint_ip=None ) -> dict: url_suffix = "/jobs/createTask" body = { "queueExpirationInhours": None, "wizardOverridePassword": False, "impersonationUser": None, "impersonationPassword": None, "priority": None, "timeoutInSeconds": time_out, "packageId": script_id, "endpoints": endpoint_ip, "isPlaybook": False, "taskOptions": [ { "integrationOutputFormat": None, "scriptId": script_id, "questions": [{"paramNumber": 1, "answer": allowed_server}], } ], } return self._http_request("POST", url_suffix, json_data=body) def remove_network_isolation(self, script_id: str = None, time_out: int = None, endpoint_ip: list = None) -> dict: url_suffix = "/jobs/createTask" body: dict = { "queueExpirationInhours": None, "wizardOverridePassword": False, "impersonationUser": None, "impersonationPassword": None, "priority": None, "timeoutInSeconds": time_out, "packageId": script_id, "endpoints": endpoint_ip, "isPlaybook": False, "taskOptions": [{"integrationOutputFormat": None, "scriptId": script_id, "questions": [{}]}], } return self._http_request("POST", url_suffix, json_data=body) def get_script_job_status(self, job_result_id: str = None) -> dict: url_suffix = f"/jobs/getjobtargets/{job_result_id}" return self._http_request("GET", url_suffix) def query_file_by_hash( self, limit: str = None, start_time: str = None, end_time: str = None, logic: str = None, file_hash: str = None ) -> dict: url_suffix = "/v2/events" params = assign_params(pageSize=limit) body = { "dateRange": {"start": start_time, "end": end_time}, "resultFields": [ "endpointName", "eventType", "processStartTime", "parentName", "pid", "name", "path", "user", "hash", "parameters", ], "criteriaV3": { "relationshipFilter": None, "entityType": "file", "filter": { "filterType": "composite", "logic": logic, "filters": [{"filterType": "criteria", "column": "hash", "operator": "=", "value": file_hash}], }, }, } response = self._http_request("POST", url_suffix, params=params, json_data=body) if response.get("error"): raise Exception(response.get("error")) return response def query_by_process_name( self, limit: str = None, start_time: str = None, end_time: str = None, logic: str = None, process_name: str = None ) -> dict: url_suffix = "/v2/events" params = assign_params(pageSize=limit) body = { "dateRange": {"start": start_time, "end": end_time}, "resultFields": [ "endpointName", "eventType", "processStartTime", "parentName", "pid", "name", "path", "user", "hash", "parameters", ], "criteriaV3": { "relationshipFilter": None, "entityType": "process", "filter": { "filterType": "composite", "logic": logic, "filters": [{"filterType": "criteria", "column": "name", "operator": "=", "value": process_name}], }, }, } response = self._http_request("POST", url_suffix, params=params, json_data=body) if response.get("error"): raise Exception(response.get("error")) return response def query_by_remote_ip( self, limit: str = None, start_time: str = None, end_time: str = None, logic: str = None, remote_ip: str = None ) -> dict: url_suffix = "/v2/events" params = assign_params(pageSize=limit) body = { "dateRange": {"start": start_time, "end": end_time}, "resultFields": [ "endpointName", "eventType", "endpointId", "parentName", "ppid", "user", "localIP", "localPort", "remoteIP", "remotePort", "processStartTime", "firstEventTime", "lastEventTime", "protocol", "parentHashSHA1", ], "criteriaV3": { "relationshipFilter": None, "entityType": "network", "filter": { "filterType": "composite", "logic": logic, "filters": [{"filterType": "criteria", "column": "remoteIP", "operator": "=", "value": remote_ip}], }, }, } response = self._http_request("POST", url_suffix, params=params, json_data=body) if response.get("error"): raise Exception(response.get("error")) return response def query_by_dns_request( self, limit: str = None, start_time: str = None, end_time: str = None, logic: str = None, url: str = None ) -> dict: url_suffix = "/v2/events" params = assign_params(pageSize=limit) body = { "dateRange": {"start": start_time, "end": end_time}, "resultFields": ["endpointName"], "criteriaV3": { "relationshipFilter": None, "entityType": "dns", "filter": { "filterType": "composite", "logic": logic, "filters": [{"filterType": "criteria", "column": "dnsQuestion", "operator": "=~", "value": url}], }, }, } response = self._http_request("POST", url_suffix, params=params, json_data=body) if response.get("error"): raise Exception(response.get("error")) return response def query_by_dns_server_ip( self, limit: str = None, start_time: str = None, end_time: str = None, logic: str = None, remote_ip: str = None ) -> dict: url_suffix = "/v2/events" params = assign_params(pageSize=limit) body = { "dateRange": {"start": start_time, "end": end_time}, "resultFields": ["endpointName"], "criteriaV3": { "relationshipFilter": None, "entityType": "dns", "filter": { "filterType": "composite", "logic": logic, "filters": [{"filterType": "criteria", "column": "remoteIP", "operator": "=", "value": remote_ip}], }, }, } response = self._http_request("POST", url_suffix, params=params, json_data=body) if response.get("error"): raise Exception(response.get("error")) return response def query_by_dns_source_ip( self, limit: str = None, start_time: str = None, end_time: str = None, logic: str = None, source_ip: str = None, domain: str = None, ) -> dict: url_suffix = "/v2/events" params = assign_params(pageSize=limit) body = { "dateRange": {"start": start_time, "end": end_time}, "resultFields": ["endpointName"], "criteriaV3": { "relationshipFilter": None, "entityType": "dns", "filter": { "filterType": "composite", "logic": logic, "filters": [ {"filterType": "criteria", "column": "dnsQuestion", "operator": "=~", "value": domain}, {"filterType": "criteria", "column": "localIP", "operator": "=", "value": source_ip}, ], }, }, } response = self._http_request("POST", url_suffix, params=params, json_data=body) if response.get("error"): raise Exception(response.get("error")) return response def query_events( self, limit: str = None, start_time: str = None, end_time: str = None, logic: str = None, column: str = None, value: str = None, entity_type: str = None, operator: str = None, additional_filter: dict = None, ) -> dict: url_suffix = "/v2/events" params = assign_params(pageSize=limit) body = { "dateRange": {"start": start_time, "end": end_time}, "resultFields": [ "endpointName", "eventType", "processStartTime", "parentName", "pid", "name", "path", "user", "hash", "parameters", ], "criteriaV3": { "relationshipFilter": None, "entityType": entity_type, "filter": { "filterType": "composite", "logic": logic, "filters": [{"filterType": "criteria", "column": column, "operator": operator, "value": value}], }, }, } if additional_filter: body["criteriaV3"]["filter"]["filters"].append(additional_filter) # type: ignore response = self._http_request("POST", url_suffix, params=params, json_data=body) if response.get("error"): raise Exception(response.get("error")) return response def get_endpoint_id(client: Client, endpoint_ip: list = None, endpoint_name: list = None): if endpoint_name and endpoint_ip: raise Exception("You must provide only one of the arguments endpoint_ip or endpoint_name") if not endpoint_ip and not endpoint_name: raise Exception("You must provide either endpoint_ip or endpoint_name") if endpoint_ip: endpoints = client.convert_ip_to_endpoint_id(endpoint_ip) endpoint_id = endpoints.get("data") elif endpoint_name: endpoints = client.convert_name_to_endpoint_id(endpoint_name) endpoint_id = endpoints.get("data") else: endpoint_id = {} demisto.debug(f"No endpoint_ip or endpoint_name -> {endpoint_id=}") return endpoint_id def test_module(client: Client, fetch_limit: str, *_) -> tuple[str, dict, dict]: """ Returning 'ok' indicates that the integration works like it is supposed to. Connection to the service is successful. """ client.test_module_request() if demisto.params().get("isFetch") and int(fetch_limit) < 5: return "Fetch limit must be at lest 5", {}, {} return "ok", {}, {} def list_alerts_command(client: Client, args: dict) -> tuple[str, dict, dict]: limit = args.get("limit", "50") sort = args.get("sort") start_date = args.get("start_date") end_date = args.get("end_date") headers = [ "ID", "Name", "EndpointName", "EndpointID", "Source", "ArtifactName", "IntelName", "Severity", "CreateDate", "AlertDate", ] contents = [] context = [] response = client.list_alerts(limit, sort, start_date, end_date) if not response.get("success"): raise Exception(response.get("error")) alerts = response.get("data", {}).get("entities", []) if not alerts: return "No alerts were found.", {}, {} for alert in alerts: contents.append( { "Name": alert.get("name"), "ID": alert.get("id"), "EndpointName": alert.get("endpointName"), "EndpointID": alert.get("endpointId"), "Source": alert.get("source"), "ArtifactName": alert.get("artifactName"), "IntelName": alert.get("intelName"), "Severity": alert.get("severity"), "CreateDate": alert.get("createDate"), } ) context.append( { "Name": alert.get("name"), "ID": alert.get("id"), "EndpointName": alert.get("endpointName"), "EndpointID": alert.get("endpointId"), "Source": alert.get("source"), "ArtifactName": alert.get("artifactName"), "IntelName": alert.get("intelName"), "Severity": alert.get("severity"), "CreateDate": alert.get("createDate"), "HasJob": alert.get("hasJob"), "Description": alert.get("description"), "IntelID": alert.get("intelId"), "SourceType": alert.get("sourceType"), "ValidatedDate": alert.get("validatedDate"), "EventID": alert.get("eventId"), "ActionsTaken": alert.get("actionsTaken"), "EventTime": alert.get("eventTime"), "ParentEventID": alert.get("parentEventId"), "EventType": alert.get("eventType"), "EventIndex": alert.get("eventIndex"), "Telemetry": alert.get("telemetry"), "ReportID": alert.get("reportId"), "InsertionDate": alert.get("insertionDate"), "AgentTag": alert.get("agentTag"), } ) entry_context = {"FidelisEndpoint.Alert(val.AlertID && val.AlertID === obj.AlertID)": context} human_readable = tableToMarkdown("Fidelis Endpoint Alerts", contents, headers, removeNull=True) return human_readable, entry_context, response def host_info_command(client: Client, args: dict) -> tuple[str, dict, dict]: ip_address = args.get("ip_address", "") host = args.get("host", "") if not host and not ip_address: raise Exception("You must provide either ip_address or host") contents = [] context_standards = [] headers = [ "ID", "HostName", "IpAddress", "OS", "MacAddress", "Isolated", "LastContactDate", "AgentInstalled", "AgentVersion", "OnNetwork", "AV_Enabled", "Groups", "ProcessorName", ] response = client.get_host_info(host, ip_address) if not response.get("success"): raise Exception(response.get("error")) hosts = response.get("data", {}) if not hosts: return "No hosts was found", {}, {} host_info = hosts.get("entities", []) if not host_info: return "No entities were found for the host", {}, {} for host in host_info: contents.append( { "Hostname": host.get("hostName"), "ID": host.get("id"), "IPAddress": host.get("ipAddress"), "OS": host.get("os"), "MacAddress": host.get("macAddress"), "LastContactDate": host.get("lastContactDate"), "AgentInstalled": host.get("agentInstalled"), "AgentVersion": host.get("agentVersion"), "AV_Enabled": host.get("aV_Enabled"), "Isolated": host.get("isolated"), "OnNetwork": host.get("onNetwork"), "Groups": host.get("groups"), "ProcessorName": host.get("processorName"), } ) context_standards.append( { "Hostname": host.get("hostName"), "ID": host.get("id"), "IPAddress": host.get("ipAddress"), "OS": host.get("os"), "MACAddress": host.get("macAddress"), "Processor": host.get("processorName"), } ) entry_context = { "FidelisEndpoint.Host(val.ID && val.ID === obj.ID)": contents, "Endpoint(val.ID && val.ID === obj.ID)": context_standards, } human_readable = tableToMarkdown("Fidelis Endpoint Host Info", contents, headers=headers, removeNull=True) return human_readable, entry_context, response def file_search(client: Client, args: dict) -> tuple[str, dict, dict]: """Search for files on multiple hosts, using file hash, extension, file size, and other search criteria.""" host = argToList(args.get("host", [""])) md5 = argToList(args.get("md5")) file_extension = argToList(args.get("file_extension")) file_path = argToList(args.get("file_path")) try: file_size = { "value": int(args.get("file_size")), # type: ignore "quantifier": "greaterThan", } except Exception as e: raise Exception(e) response = client.search_file(host, md5, file_extension, file_path, file_size) if not response.get("success"): raise Exception(response.get("error")) data = response.get("data", {}) contents = {"JobID": data.get("jobId"), "JobResultID": data.get("jobResultId")} entry_context = {"FidelisEndpoint.FileSearch(val.JobID && val.JobID === obj.JobID)": contents} human_readable = tableToMarkdown("Fidelis Endpoint file search", contents) return human_readable, entry_context, response def file_search_status(client: Client, args: dict) -> tuple[str, dict, dict]: """Get the file search job status""" job_id = args.get("job_id") job_result_id = args.get("job_result_id") response = client.file_search_status(job_id, job_result_id) if not response.get("success"): raise Exception(response.get("error")) data = response.get("data", {}) if not data: return "Could not find any data for this Job ID", {}, {} contents = {"JobID": job_id, "JobResultID": job_result_id, "Status": data.get("status", "Unclassified")} status = data.get("status") entry_context = {"FidelisEndpoint.FileSearch(val.JobID && val.JobID === obj.JobID)": contents} human_readable = f"Fidelis Endpoint file search status is: {status}" return human_readable, entry_context, response def file_search_reasult_metadata(client: Client, args: dict) -> tuple[str, dict, dict]: """Get the job results metadata""" job_id = args.get("job_id") job_result_id = args.get("job_result_id") headers = ["ID", "FileName", "FilePath", "MD5Hash", "FileSize", "HostName", "HostIP", "AgentID"] response = client.file_search_results_metadata(job_id, job_result_id) if not response.get("success"): return "Could not find results for this job ID.", {}, {} data = response.get("data", {}).get("jobResultInfos", []) if not data: return "No results found.\nCheck the job status, it might be still running.", {}, {} contents = {} file_standards = {} for item in data: if item.get("collectedFiles"): collected_files = item.get("collectedFiles", []) for obj in collected_files: contents = { "FileName": obj.get("name"), "ID": obj.get("id"), "MD5Hash": obj.get("mD5Hash"), "FilePath": obj.get("filePath"), "FileSize": obj.get("fileSize"), "HostName": item.get("hostName"), "HostIP": item.get("hostIP"), "AgentID": item.get("agentId"), } file_standards = { "Name": obj.get("name"), "MD5": obj.get("mD5Hash"), "Path": obj.get("filePath"), "Size": obj.get("fileSize"), "Hostname": item.get("hostName"), } entry_context = {"FidelisEndpoint.File(val.ID && val.ID === obj.ID)": contents, outputPaths["file"]: file_standards} human_readable = tableToMarkdown("Fidelis Endpoint file results metadata", contents, headers=headers, removeNull=True) return human_readable, entry_context, response def get_file_command(client: Client, args: dict): file_id: str = args.get("file_id", "") file_name: str = args.get("file_name", "") response = client.get_file(file_id) attachment_file = fileResult(file_name, response) return attachment_file def delete_file_search_job_command(client: Client, args: dict) -> tuple[str, dict, dict]: job_id = args.get("job_id") response = client.delete_job(job_id) if not response.get("success"): raise Exception(response.get("error")) return "The job was successfully deleted", {}, response def list_scripts_command(client: Client, *_) -> tuple[str, dict, dict]: headers = ["ID", "Name", "Description"] response = client.list_scripts() if not response.get("success"): raise Exception(response.get("error")) res = response.get("data", {}) scripts = res.get("scripts", []) if not scripts: return "No scripts were found.", {}, {} contents = [] for script in scripts: contents.append({"ID": script.get("id"), "Name": script.get("name"), "Description": script.get("description")}) entry_context = {"FidelisEndpoint.Script(val.ID && val.ID === obj.ID)": contents} human_readable = tableToMarkdown("Fidelis Endpoint scripts", contents, headers) return human_readable, entry_context, response def script_manifest_command(client: Client, args: dict) -> tuple[str, dict, dict]: script_id = args.get("script_id") headers = [ "ID", "Name", "Description", "Platform", "Command", "Questions", "Priority", "TimeoutSeconds", "ResultColumns", "ImpersonationUser", "ImpersonationPassword", "WizardOverridePassword", ] response = client.script_manifest(script_id) if not response.get("success"): raise Exception(response.get("error")) data = response.get("data", {}) platforms = [k for k, v in data.get("platforms", {}).items() if v] contents = { "ID": data.get("id"), "Name": data.get("name"), "Platform": platforms, "Description": data.get("description"), "Priority": data.get("priority"), "ResultColumns": data.get("resultColumns"), "TimeoutSeconds": data.get("timeoutSeconds"), "ImpersonationUser": data.get("impersonationUser"), "ImpersonationPassword": data.get("impersonationPassword"), "Command": data.get("command"), "WizardOverridePassword": data.get("wizardOverridePassword"), "Questions": data.get("questions"), } entry_context = {"FidelisEndpoint.Script(val.ID && val.ID === obj.ID)": contents} human_readable = tableToMarkdown("Fidelis Endpoint script manifest", contents, headers, removeNull=True) return human_readable, entry_context, response def execute_script_command(client: Client, args: dict) -> tuple[str, dict, dict]: script_id = args.get("script_id") time_out = args.get("time_out") endpoint_ip = argToList(args.get("endpoint_ip")) endpoint_name = argToList(args.get("endpoint_name")) answer = args.get("answer") or "" additional_answer = args.get("additional_answer", "") endpoint_id = get_endpoint_id(client, endpoint_ip, endpoint_name) response = client.execute_script(script_id, endpoint_id, answer, time_out, additional_answer) if not response.get("success"): raise Exception(response.get("error")) job_id = response.get("data") context = {"ID": script_id, "JobID": job_id} entry_context = {"FidelisEndpoint.Script(val.ID && val.ID === obj.ID)": context} return f"The job has been executed successfully. \n Job ID: {job_id}", entry_context, response def list_process_command(client: Client, args: dict) -> tuple[str, dict, dict]: endpoint_ip = argToList(args.get("endpoint_ip")) endpoint_name = argToList(args.get("endpoint_name")) endpoint_id = get_endpoint_id(client, endpoint_ip, endpoint_name) time_out = args.get("time_out") operating_system = args.get("operating_system") script_id = "" if operating_system == "Windows": script_id = LIST_PROCESSES_WINDOWS elif operating_system == "Linux": script_id = LIST_PROCESSES_LINUX elif operating_system == "macOS": script_id = LIST_PROCESSES_MACOS response = client.list_process(script_id, time_out, endpoint_id) if not response.get("success"): raise Exception(response.get("error")) job_id = response.get("data") context = {"ID": script_id, "JobID": job_id} entry_context = {"FidelisEndpoint.Process(val.ID && val.ID === obj.ID)": context} return f"The job has been executed successfully. \n Job ID: {job_id}", entry_context, response def get_script_result(client: Client, args: dict): job_id = args.get("job_id") headers = ["ID", "Name", "EndpointID", "EndpointName", "PID", "User", "SHA1", "MD5", "Path", "WorkingDirectory", "StartTime"] response = client.script_job_results(job_id) if not response.get("success"): raise Exception(response.get("error")) hits = response.get("data", {}).get("hits", {}).get("hits", []) if not hits: return "No results were found", {}, {} contents = [] context = [] for hit in hits: source_ = hit.get("_source", {}) contents.append( { "Path": source_.get("Path"), "User": source_.get("User"), "SHA1": source_.get("SHA1"), "WorkingDirectory": source_.get("Working Directory"), "EndpointID": source_.get("_EndpointId"), "PID": source_.get("PID"), "StartTime": source_.get("Start Time"), "EndpointName": source_.get("_EndpointName"), "Name": source_.get("Name"), "MD5": source_.get("MD5"), "ID": hit.get("_id"), } ) context.append( { "Path": source_.get("Path"), "User": source_.get("User"), "SHA1": source_.get("SHA1"), "IsHidden": source_.get("Is Hidden"), "WorkingDirectory": source_.get("Working Directory"), "EndpointID": source_.get("_EndpointId"), "PID": source_.get("PID"), "StartTime": source_.get("Start Time"), "EndpointName": source_.get("_EndpointName"), "Name": source_.get("Name"), "ParentPID": source_.get("Parent PID"), "CommandLine": source_.get("Command Line"), "GroupID": source_.get("_GroupID"), "MD5": source_.get("MD5"), "Matches": source_.get("Matches"), "ID": hit.get("_id"), "Tags": hit.get("tags"), } ) entry_context = {"FidelisEndpoint.ScriptResult(val.ID && val.ID === obj.ID)": context} human_readable = tableToMarkdown("Fidelis Endpoint script job results", contents, headers, removeNull=True) return human_readable, entry_context, response def kill_process_by_pid(client: Client, args: dict) -> tuple[str, dict, dict]: endpoint_ip = argToList(args.get("endpoint_ip")) endpoint_name = argToList(args.get("endpoint_name")) endpoint_id = get_endpoint_id(client, endpoint_ip, endpoint_name) time_out = args.get("time_out") operating_system = args.get("operating_system") pid = args.get("pid") script_id = "" if operating_system == "Windows": script_id = KILL_PROCESS_WINDOWS elif operating_system == "Linux" or operating_system == "macOS": script_id = KILL_PROCESS_MAC_LINUX response = client.kill_process(script_id, pid, time_out, endpoint_id) if not response.get("success"): raise Exception(response.get("error")) job_id = response.get("data") context = {"ID": script_id, "JobID": job_id} entry_context = {"FidelisEndpoint.Process(val.ID && val.ID === obj.ID)": context} return f"The job has been executed successfully. \n Job ID: {job_id}", entry_context, response def delete_file_command(client: Client, args: dict) -> tuple[str, dict, dict]: endpoint_ip = argToList(args.get("endpoint_ip")) endpoint_name = argToList(args.get("endpoint_name")) endpoint_id = get_endpoint_id(client, endpoint_ip, endpoint_name) time_out = args.get("time_out") operating_system = args.get("operating_system") file_path = args.get("file_path") script_id = "" if operating_system == "Windows": script_id = DELETE_FILE_WINDOWS elif operating_system == "Linux" or operating_system == "macOS": script_id = DELETE_FILE_MAC_LINUX response = client.delete_file(script_id, file_path, time_out, endpoint_id) if not response.get("success"): raise Exception(response.get("error")) job_id = response.get("data") context = {"ID": script_id, "JobID": job_id} entry_context = {"FidelisEndpoint.Script(val.ID && val.ID === obj.ID)": context} return f"The job has been executed successfully. \n Job ID: {job_id}", entry_context, response def network_isolation_command(client: Client, args: dict) -> tuple[str, dict, dict]: endpoint_ip = argToList(args.get("endpoint_ip")) endpoint_name = argToList(args.get("endpoint_name")) endpoint_id = get_endpoint_id(client, endpoint_ip, endpoint_name) time_out = args.get("time_out") operating_system = args.get("operating_system") allowed_server = args.get("allowed_server") script_id = "" if operating_system == "Windows": script_id = NETWORK_ISOLATION_WINDOWS elif operating_system == "Linux" or operating_system == "macOS": script_id = NETWORK_ISOLATION_MAC_LINUX response = client.network_isolation(script_id, allowed_server, time_out, endpoint_id) if not response.get("success"): raise Exception(response.get("error")) job_id = response.get("data") context = {"ID": script_id, "JobID": job_id} entry_context = {"FidelisEndpoint.Isolation(val.ID && val.ID === obj.ID)": context} return f"The job has been executed successfully. \n Job ID: {job_id}", entry_context, response def remove_network_isolation_command(client: Client, args: dict) -> tuple[str, dict, dict]: endpoint_ip = argToList(args.get("endpoint_ip")) endpoint_name = argToList(args.get("endpoint_name")) endpoint_id = get_endpoint_id(client, endpoint_ip, endpoint_name) time_out = args.get("time_out") operating_system = args.get("operating_system") script_id = "" if operating_system == "Windows": script_id = REMOVE_NETWORK_ISOLATION_WINDOWS elif operating_system in {"Linux", "macOS"}: script_id = REMOVE_NETWORK_ISOLATION_MAC_LINUX response = client.remove_network_isolation(script_id, time_out, endpoint_id) if not response.get("success"): raise Exception(response.get("error")) job_id = response.get("data") context = {"ID": script_id, "JobID": job_id} entry_context = {"FidelisEndpoint.Isolation(val.ID && val.ID === obj.ID)": context} return f"The job has been executed successfully. \n Job ID: {job_id}", entry_context, response def script_job_status(client: Client, args: dict) -> tuple[str, dict, dict]: job_result_id = args.get("job_result_id") contents = [] response = client.get_script_job_status(job_result_id) if not response.get("success"): raise Exception(response.get("error")) results = response.get("data", {}).get("targets", []) for result in results: contents.append( { "JobResultID": result.get("jobResultId"), "Name": result.get("name"), "Status": result.get("status"), "JobName": response.get("data", {}).get("jobName"), # type: ignore } ) entry_context = {"FidelisEndpoint.ScriptResult(val.JobResultID && val.JobResultID === obj.JobResultID)": contents} human_readable = tableToMarkdown("Fidelis Endpoint script job status", contents, removeNull=True) return human_readable, entry_context, response def query_file_by_hash_command(client: Client, args: dict) -> tuple[str, dict, dict]: start_time = args.get("start_time") end_time = args.get("end_time") logic = args.get("logic") file_hash = args.get("file_hash") limit = args.get("limit") if get_hash_type(file_hash) == "Unknown": raise Exception("Enter a valid hash format.") contents = [] context = [] file_standards = [] headers = ["PID", "EndpointName", "Name", "Path", "User", "Hash", "ProcessStartTime", "Parameters", "ParentName", "EventType"] response = client.query_file_by_hash(limit, start_time, end_time, logic, file_hash) if not response.get("success"): raise Exception(response.get("error")) res = response.get("data", {}) events = res.get("events", []) if not events: return f"No events were found for file_hash {file_hash}", {}, {} for event in events: contents.append( { "EndpointName": event.get("endpointName"), "EventType": event.get("eventType"), "ProcessStartTime": event.get("processStartTime"), "ParentName": event.get("parentName"), "PID": event.get("pid"), "Name": event.get("name"), "Path": event.get("path"), "User": event.get("user"), "Hash": event.get("hash"), "Parameters": event.get("parameters"), } ) context.append( { "EventTime": event.get("eventTime"), "EndpointName": event.get("endpointName"), "EventType": event.get("eventType"), "ParentID": event.get("parentId"), "TargetID": event.get("targetId"), "ParentName": event.get("parentName"), "Name": event.get("name"), "Path": event.get("path"), "Hash": event.get("hash"), "Size": event.get("size"), "FileVersion": event.get("fileVersion"), "Signature": event.get("signature"), "SignedTime": event.get("signedTime"), "CertificateSubjectName": event.get("certificateSubjectName"), "CertificateIssuerName": event.get("certificateIssuerName"), "CertificatePublisher": event.get("certificatePublisher"), "HashSHA1": event.get("hashSHA1"), "HashSHA256": event.get("hashSHA256"), "ProcessStartTime": event.get("processStartTime"), "EventIndex": event.get("eventIndex"), "IndexingTime": event.get("indexingTime"), "FileExtension": event.get("fileExtension"), "FileType": event.get("fileType"), "FileCategory": event.get("fileCategory"), "EntityType": event.get("entityType"), "StartTime": event.get("startTime"), } ) file_standards.append( { "Name": event.get("name"), "Size": event.get("size"), "MD5": event.get("hash"), "Extension": event.get("fileExtension"), "Type": event.get("fileType"), "Path": event.get("path"), "Hostname": event.get("endpointName"), "SHA1": event.get("hashSHA1"), "SHA256": event.get("hashSHA256"), "FileVersion": event.get("fileVersion"), } ) entry_context = {"FidelisEndpoint.Query(val.Hash && val.Hash === obj.Hash)": context, outputPaths["file"]: file_standards} human_readable = tableToMarkdown("Fidelis Endpoint file hash query results", contents, headers=headers, removeNull=True) return human_readable, entry_context, response def query_process_name_command(client: Client, args: dict) -> tuple[str, dict, dict]: start_time = args.get("start_time") end_time = args.get("end_time") logic = args.get("logic") process_name = args.get("process_name") limit = args.get("limit") headers = ["PID", "EndpointName", "Name", "Path", "User", "Hash", "ProcessStartTime", "Parameters", "ParentName", "EventType"] contents = [] context = [] response = client.query_by_process_name(limit, start_time, end_time, logic, process_name) if not response.get("success"): raise Exception(response.get("error")) res = response.get("data", {}) events = res.get("events", []) if not events: return f"No events were found for the process {process_name}", {}, {} for event in events: contents.append( { "EndpointName": event.get("endpointName"), "EventType": event.get("eventType"), "ProcessStartTime": event.get("processStartTime"), "ParentName": event.get("parentName"), "PID": event.get("pid"), "Name": event.get("name"), "Path": event.get("path"), "User": event.get("user"), "Hash": event.get("hash"), "Parameters": event.get("parameters"), } ) context.append( { "EsIndex": event.get("esIndex"), "EsDocumentType": event.get("esDocumentType"), "EventTime": event.get("eventTime"), "EndpointName": event.get("endpointName"), "EventType": event.get("eventType"), "ParentID": event.get("parentId"), "TargetID": event.get("targetId"), "PID": event.get("pid"), "ParentName": event.get("parentName"), "Name": event.get("name"), "Path": event.get("path"), "Hash": event.get("hash"), "User": event.get("user"), "ProcessStartTime": event.get("processStartTime"), "IndexingTime": event.get("indexingTime"), "EntityType": event.get("entityType"), "StartTime": event.get("startTime"), } ) entry_context = {"FidelisEndpoint.Query(val.PID && val.PID === obj.PID)": context} human_readable = tableToMarkdown("Fidelis Endpoint process results", contents, headers=headers, removeNull=True) return human_readable, entry_context, response def query_connection_by_remote_ip_command(client: Client, args: dict) -> tuple[str, dict, dict]: start_time = args.get("start_time") end_time = args.get("end_time") logic = args.get("logic") remote_ip = args.get("remote_ip") limit = args.get("limit") contents = [] context = [] headers = [ "EndpointID", "EndpointName", "PPID", "LocalIP", "LocalPort", "RemoteIP", "RemotePort", "ProcessStartTime", "FirstEventTime", "LastEventTime", "Protocol", "ParentHashSHA1", "ParentName", "EventType", ] response = client.query_by_remote_ip(limit, start_time, end_time, logic, remote_ip) if not response.get("success"): raise Exception(response.get("error")) res = response.get("data", {}) events = res.get("events", []) if not events: return f"No events were found for the IP address {remote_ip}", {}, {} for event in events: contents.append( { "EndpointName": event.get("endpointName"), "EventType": event.get("eventType"), "EndpointID": event.get("endpointId"), "ProcessStartTime": event.get("processStartTime"), "ParentName": event.get("parentName"), "PPID": event.get("ppid"), "LocalIP": event.get("localIP"), "LocalPort": event.get("localPort"), "RemoteIP": event.get("remoteIP"), "RemotePort": event.get("remotePort"), "FirstEventTime": event.get("firstEventTime"), "LastEventTime": event.get("lastEventTime"), "Protocol": event.get("protocol"), "ParentHashSHA1": event.get("parentHashSHA1"), } ) context.append( { "EventTime": event.get("eventTime"), "EndpointName": event.get("endpointName"), "EventType": event.get("eventType"), "EndpointID": event.get("endpointId"), "ParentID": event.get("parentId"), "TargetID": event.get("targetId"), "PPID": event.get("ppid"), "ParentName": event.get("parentName"), "LocalIP": event.get("localIP"), "LocalPort": event.get("localPort"), "RemoteIP": event.get("remoteIP"), "RemotePort": event.get("remotePort"), "ProcessStartTime": event.get("processStartTime"), "FirstEventTime": event.get("firstEventTime"), "LastEventTime": event.get("lastEventTime"), "Protocol": event.get("protocol"), "EventIndex": event.get("eventIndex"), "NetworkDirection": event.get("networkDirection"), "EntityType": event.get("entityType"), "StartTime": event.get("startTime"), "parentHashSHA1": event.get("parentHashSHA1"), } ) entry_context = {"FidelisEndpoint.Query(val.PPID && val.PPID === obj.PPID)": context} human_readable = tableToMarkdown( "Fidelis Endpoint query results for connection by remote IP", contents, headers=headers, removeNull=True ) return human_readable, entry_context, response def query_dns_request_command(client: Client, args: dict) -> tuple[str, dict, dict]: start_time = args.get("start_time") end_time = args.get("end_time") logic = args.get("logic") url = args.get("url") limit = args.get("limit") contents = [] context = [] headers = ["EndpointName", "LocalIP", "LocalPort", "RemoteIP", "RemotePort", "ProcessStartTime", "DnsAnswer", "EventType"] response = client.query_by_dns_request(limit, start_time, end_time, logic, url) if not response.get("success"): raise Exception(response.get("error")) res = response.get("data", {}) events = res.get("events", []) if not events: return f"No events were found for the URL {url}", {}, {} for event in events: contents.append( { "EndpointName": event.get("endpointName"), "EventType": event.get("eventType"), "DnsAnswer": event.get("dnsAnswer"), "ProcessStartTime": event.get("processStartTime"), "LocalIP": event.get("localIP"), "LocalPort": event.get("localPort"), "RemoteIP": event.get("remoteIP"), "RemotePort": event.get("remotePort"), } ) context.append( { "EventTime": event.get("eventTime"), "EndpointName": event.get("endpointName"), "EventType": event.get("eventType"), "ParentID": event.get("parentId"), "TargetID": event.get("targetId"), "LocalIP": event.get("localIP"), "LocalPort": event.get("localPort"), "RemoteIP": event.get("remoteIP"), "RemotePort": event.get("remotePort"), "DnsQuestion": event.get("dnsQuestion"), "DnsAnswer": event.get("dnsAnswer"), "ProcessStartTime": event.get("processStartTime"), "EventIndex": event.get("eventIndex"), "IndexingTime": event.get("indexingTime"), "NetworkDirection": event.get("networkDirection"), "EntityType": event.get("entityType"), "StartTime": event.get("startTime"), } ) entry_context = {"FidelisEndpoint.Query(val.ParentID && val.ParentID === obj.ParentID)": context} human_readable = tableToMarkdown( "Fidelis Endpoint query results for the DNS request", contents, headers=headers, removeNull=True ) return human_readable, entry_context, response def query_by_server_ip_command(client: Client, args: dict) -> tuple[str, dict, dict]: start_time = args.get("start_time") end_time = args.get("end_time") logic = args.get("logic") remote_ip = args.get("remote_ip") limit = args.get("limit") contents = [] context = [] headers = ["EndpointName", "LocalIP", "LocalPort", "RemoteIP", "RemotePort", "ProcessStartTime", "DnsAnswer", "EventType"] response = client.query_by_dns_server_ip(limit, start_time, end_time, logic, remote_ip) if not response.get("success"): raise Exception(response.get("error")) res = response.get("data", {}) events = res.get("events", []) if not events: return f"No events were found for the IP address {remote_ip}", {}, {} for event in events: contents.append( { "EndpointName": event.get("endpointName"), "EventType": event.get("eventType"), "DnsAnswer": event.get("dnsAnswer"), "ProcessStartTime": event.get("processStartTime"), "LocalIP": event.get("localIP"), "LocalPort": event.get("localPort"), "RemoteIP": event.get("remoteIP"), "RemotePort": event.get("remotePort"), } ) context.append( { "EventTime": event.get("eventTime"), "EndpointName": event.get("endpointName"), "EventType": event.get("eventType"), "ParentID": event.get("parentId"), "TargetID": event.get("targetId"), "LocalIP": event.get("localIP"), "LocalPort": event.get("localPort"), "RemoteIP": event.get("remoteIP"), "RemotePort": event.get("remotePort"), "DnsQuestion": event.get("dnsQuestion"), "DnsAnswer": event.get("dnsAnswer"), "ProcessStartTime": event.get("processStartTime"), "EventIndex": event.get("eventIndex"), "IndexingTime": event.get("indexingTime"), "NetworkDirection": event.get("networkDirection"), "EntityType": event.get("entityType"), "StartTime": event.get("startTime"), } ) entry_context = {"FidelisEndpoint.Query(val.TargetID && val.TargetID === obj.TargetID)": context} human_readable = tableToMarkdown( "Fidelis Endpoint query results for the DNS request by server IP", contents, headers=headers, removeNull=True ) return human_readable, entry_context, response def query_by_source_ip(client: Client, args: dict) -> tuple[str, dict, dict]: start_time = args.get("start_time") end_time = args.get("end_time") logic = args.get("logic") source_ip = args.get("source_ip") domain = args.get("domain", "") limit = args.get("limit") contents = [] context = [] headers = ["EndpointName", "LocalIP", "LocalPort", "RemoteIP", "RemotePort", "ProcessStartTime", "DnsQuestion", "DnsAnswer"] response = client.query_by_dns_source_ip(limit, start_time, end_time, logic, source_ip, domain) if not response.get("success"): raise Exception(response.get("error")) res = response.get("data", {}) events = res.get("events", []) if not events: return "No events were found", {}, {} for event in events: contents.append( { "EndpointName": event.get("endpointName"), "ProcessStartTime": event.get("processStartTime"), "LocalIP": event.get("localIP"), "LocalPort": event.get("localPort"), "RemoteIP": event.get("remoteIP"), "RemotePort": event.get("remotePort"), "DnsQuestion": event.get("dnsQuestion"), "DnsAnswer": event.get("dnsAnswer"), } ) context.append( { "EventTime": event.get("eventTime"), "EndpointName": event.get("endpointName"), "EventType": event.get("eventType"), "ParentID": event.get("parentId"), "TargetID": event.get("targetId"), "LocalIP": event.get("localIP"), "LocalPort": event.get("localPort"), "RemoteIP": event.get("remoteIP"), "RemotePort": event.get("remotePort"), "DnsQuestion": event.get("dnsQuestion"), "DnsAnswer": event.get("dnsAnswer"), "ProcessStartTime": event.get("processStartTime"), "EventIndex": event.get("eventIndex"), "IndexingTime": event.get("indexingTime"), "NetworkDirection": event.get("networkDirection"), "EntityType": event.get("entityType"), "StartTime": event.get("startTime"), } ) entry_context = {"FidelisEndpoint.Query(val.TargetID && val.TargetID === obj.TargetID)": context} human_readable = tableToMarkdown( "Fidelis Endpoint query results for the DNS request by source IP", contents, headers=headers, removeNull=True ) return human_readable, entry_context, response def query_events_command(client: Client, args: dict) -> tuple[str, dict, dict]: start_time = args.get("start_time") end_time = args.get("end_time") logic = args.get("logic") entity_type = args.get("entity_type") column = args.get("column") value = args.get("value") operator = args.get("operator") limit = args.get("limit") additional_filter_string = args.get("additional_filter") additional_filter = None if additional_filter_string: additional_filter_split = additional_filter_string.split() if len(additional_filter_split) == 3: additional_filter = { "filterType": "criteria", "column": additional_filter_split[0], "operator": additional_filter_split[1], "value": additional_filter_split[2], } else: raise Exception("Make sure that the additional_filter argument is in valid format.\n For Example: pid = 1234") contents = [] context = [] headers = [ "PID", "EndpointName", "User", "ProcessStartTime", "LocalIP", "LocalPort", "RemoteIP", "RemotePort", "ParentID", "EventType", ] response = client.query_events(limit, start_time, end_time, logic, column, value, entity_type, operator, additional_filter) if not response.get("success"): raise Exception(response.get("error")) res = response.get("data", {}) events = res.get("events", []) if not events: return "No events were found", {}, {} for event in events: contents.append( { "EndpointName": event.get("endpointName"), "EventType": event.get("eventType"), "ParentID": event.get("parentId"), "PID": event.get("pid"), "User": event.get("user"), "ProcessStartTime": event.get("processStartTime"), "LocalIP": event.get("localIP"), "LocalPort": event.get("localPort"), "RemoteIP": event.get("remoteIP"), "RemotePort": event.get("remotePort"), } ) context.append( { "EventTime": event.get("eventTime"), "EndpointName": event.get("endpointName"), "EventType": event.get("eventType"), "ParentID": event.get("parentId"), "TargetID": event.get("targetId"), "PID": event.get("pid"), "ParentName": event.get("parentName"), "Name": event.get("name"), "Path": event.get("path"), "Hash": event.get("hash"), "User": event.get("user"), "LocalIP": event.get("localIP"), "LocalPort": event.get("localPort"), "RemoteIP": event.get("remoteIP"), "RemotePort": event.get("remotePort"), "DnsQuestion": event.get("dnsQuestion"), "DnsAnswer": event.get("dnsAnswer"), "ProcessStartTime": event.get("processStartTime"), "EventIndex": event.get("eventIndex"), "IndexingTime": event.get("indexingTime"), "EntityType": event.get("entityType"), "StartTime": event.get("startTime"), } ) entry_context = {"FidelisEndpoint.Query(val.PID && val.PID === obj.PID)": context} human_readable = tableToMarkdown("Fidelis Endpoint query events result", contents, headers=headers, removeNull=True) return human_readable, entry_context, response def fetch_incidents(client: Client, fetch_time: str, fetch_limit: str, last_run: dict) -> tuple[list, dict]: last_fetched_alert_create_time = last_run.get("last_fetched_alert_create_time") last_fetched_alert_id = last_run.get("last_fetched_alert_id", "") if not last_fetched_alert_create_time: last_fetched_alert_create_time, _ = parse_date_range(fetch_time, date_format="%Y-%m-%dT%H:%M:%S.000Z") last_fetched_alert_id = "0" latest_alert_create_date = last_fetched_alert_create_time latest_alert_id = last_fetched_alert_id incidents = [] response = client.list_alerts(limit=fetch_limit, sort="createDate Ascending", start_date=last_fetched_alert_create_time) alerts = response.get("data", {}).get("entities", []) for alert in alerts: alert_id = alert.get("id") if alert_id <= int(last_fetched_alert_id): # got an alert we already fetched, skipping it continue alert_id = str(alert_id) alert_create_date = alert.get("createDate") incident = {"name": f"Fidelis Endpoint alert {alert_id}", "occurred": alert_create_date, "rawJSON": json.dumps(alert)} incidents.append(incident) latest_alert_create_date = alert_create_date latest_alert_id = alert_id return incidents, {"last_fetched_alert_create_time": latest_alert_create_date, "last_fetched_alert_id": latest_alert_id} def main(): """ PARSE AND VALIDATE INTEGRATION PARAMS """ username = demisto.params().get("credentials").get("identifier") password = demisto.params().get("credentials").get("password") # get the service API url base_url = urljoin(demisto.params().get("url"), "/Endpoint/api") verify_certificate = not demisto.params().get("insecure", False) proxy = demisto.params().get("proxy", False) LOG(f"Command being called is {demisto.command()}") try: client = Client(base_url, username=username, password=password, verify=verify_certificate, proxy=proxy) if demisto.command() == "test-module": # This is the call made when pressing the integration Test button. fetch_limit = demisto.params().get("fetch_limit") return_outputs(*test_module(client, fetch_limit)) elif demisto.command() == "fetch-incidents": fetch_time = demisto.params().get("fetch_time", "3 days") fetch_limit = demisto.params().get("fetch_limit", "50") incidents, last_run = fetch_incidents(client, fetch_time, fetch_limit, last_run=demisto.getLastRun()) # type: ignore demisto.incidents(incidents) demisto.setLastRun(last_run) elif demisto.command() == "fidelis-endpoint-list-alerts": return_outputs(*list_alerts_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-host-info": return_outputs(*host_info_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-file-search": return_outputs(*file_search(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-file-search-status": return_outputs(*file_search_status(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-file-search-result-metadata": return_outputs(*file_search_reasult_metadata(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-get-file": demisto.results(get_file_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-delete-file-search-job": return_outputs(*delete_file_search_job_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-list-scripts": return_outputs(*list_scripts_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-get-script-manifest": return_outputs(*script_manifest_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-list-processes": return_outputs(*list_process_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-get-script-result": return_outputs(*get_script_result(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-kill-process": return_outputs(*kill_process_by_pid(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-delete-file": return_outputs(*delete_file_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-isolate-network": return_outputs(*network_isolation_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-remove-network-isolation": return_outputs(*remove_network_isolation_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-script-job-status": return_outputs(*script_job_status(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-execute-script": return_outputs(*execute_script_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-query-file": return_outputs(*query_file_by_hash_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-query-process": return_outputs(*query_process_name_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-query-connection-by-remote-ip": return_outputs(*query_connection_by_remote_ip_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-query-by-dns": return_outputs(*query_dns_request_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-query-dns-by-server-ip": return_outputs(*query_by_server_ip_command(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-query-dns-by-source-ip": return_outputs(*query_by_source_ip(client, demisto.args())) elif demisto.command() == "fidelis-endpoint-query-events": return_outputs(*query_events_command(client, demisto.args())) # Log exceptions except Exception as e: err_msg = str(e) if "password=" in err_msg: err_msg = re.sub(r"password=([^\s]*)\s", "password=**** ", err_msg) return_error(f"Failed to execute {demisto.command()} command. Error: {err_msg}") if __name__ in ("__main__", "__builtin__", "builtins"): main()