Fidelis EDR
Use the Fidelis Endpoint integration for advanced endpoint detection and response (EDR) across Windows, Mac and Linux OSes for faster threat remediation.
Endpoint · Fidelis Endpoint
Details
| ID | Fidelis EDR |
|---|---|
| Provider | Skyview Capital |
| Category | Endpoint |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Overview
Use the Fidelis Endpoint integration for advanced endpoint detection and response (EDR) across Windows, Mac and Linux OSes for faster threat remediation.
This integration was integrated and tested with version 9.2 of Fidelis EDR.
The account must have appropriate permissions to execute API calls. While you could use an administrator account, use an account designated for executing API calls.
To Get the appropriate permissions navigate to Configuration > Roles > Create a role > Permissions
Use Cases
- Fetch Alerts
- Get Alert Details
- Download File to Cortex XSOAR
- Execute Script on Endpoint
- query / search the Logs on Fidelis Console
- Navigate to Settings > Integrations > Servers & Services.
- Search for Fidelis EDR.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Server URL (e.g.
https://abcde.fideliscloud.com/) - Username
- Incident type
- Fetch incidents
- First fetch timestamp (“number time unit”, e.g., 12 hours, 7 days, 3 months, 1 year)
- Fetch limit (minimum 5)
- Trust any certificate (not secure)
- Use system proxy settings
- Click Test to validate the URLs, token, and connection.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
- fidelis-endpoint-list-alerts
- fidelis-endpoint-host-info
- fidelis-endpoint-file-search
- fidelis-endpoint-file-search-status
- fidelis-endpoint-file-search-result-metadata
- fidelis-endpoint-get-file
- fidelis-endpoint-delete-file-search-job
- fidelis-endpoint-list-scripts
- fidelis-endpoint-get-script-manifest
- fidelis-endpoint-list-processes
- fidelis-endpoint-get-script-result
- fidelis-endpoint-kill-process
- fidelis-endpoint-delete-file
- fidelis-endpoint-isolate-network
- fidelis-endpoint-remove-network-isolation
- fidelis-endpoint-script-job-status
- fidelis-endpoint-execute-script
- fidelis-endpoint-query-file
- fidelis-endpoint-query-process
- fidelis-endpoint-query-connection-by-remote-ip
- fidelis-endpoint-query-by-dns
- fidelis-endpoint-query-dns-by-server-ip
- fidelis-endpoint-query-dns-by-source-ip
- fidelis-endpoint-query-events
1. fidelis-endpoint-list-alerts
Returns all alerts in the system.
Required Permissions
The required permissions: View Alerts
Base Command
fidelis-endpoint-list-alerts
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | The maximum number of alerts to return. | Optional |
| sort | Sorts the result before applying take and skip. Can be any property name of the alert object. For example: “insertionDate Descending” |
Optional |
| start_date | The start of the time range of returned values in UTC format. For example: 0001-01-01T00:00:00Z | Optional |
| end_date | The end of the time range of returned values in UTC format. For example: 0001-01-01T00:00:00Z | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Alert.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Alert.IntelName | String | Intel name. |
| FidelisEndpoint.Alert.HasJob | Boolean | Whether the alert has an open job. |
| FidelisEndpoint.Alert.EventTime | Date | Alert event time. |
| FidelisEndpoint.Alert.ActionsTaken | String | The actions taken for this alert. |
| FidelisEndpoint.Alert.CreateDate | Date | Alert creation date. |
| FidelisEndpoint.Alert.ParentEventID | String | Parent event ID. |
| FidelisEndpoint.Alert.Name | String | Alert name. |
| FidelisEndpoint.Alert.ReportID | String | Report ID. |
| FidelisEndpoint.Alert.EndpointID | String | Endpoint ID. |
| FidelisEndpoint.Alert.IntelID | String | Intel ID. |
| FidelisEndpoint.Alert.Name | String | Alert Name. |
| FidelisEndpoint.Alert.EventType | Number | Event Type. |
| FidelisEndpoint.Alert.EventID | String | Event ID. |
| FidelisEndpoint.Alert.SourceType | Number | Source type. |
| FidelisEndpoint.Alert.AgentTag | String | Agent tag. |
| FidelisEndpoint.Alert.EventIndex | Number | Event index. |
| FidelisEndpoint.Alert.Telemetry | String | Telemetry data. |
| FidelisEndpoint.Alert.Source | String | Alert source. |
| FidelisEndpoint.Alert.ID | Number | Alert ID. |
| FidelisEndpoint.Alert.ValidatedDate | Date | Validation date. |
| FidelisEndpoint.Alert.Description | String | Alert description. |
| FidelisEndpoint.Alert.InsertionDate | Date | Alert insertion date. |
| FidelisEndpoint.Alert.Severity | Number | Alert severity. |
| FidelisEndpoint.Alert.ArtifactName | String | Artifact name. |
Command Example
!fidelis-endpoint-list-alerts limit="5"
Context Example
{
"FidelisEndpoint.Alert": [
{
"Severity": 2,
"IntelName": null,
"Telemetry": null,
"Source": "Installed Software CVE",
"InsertionDate": "2020-03-21T00:06:38.940Z",
"IntelID": null,
"HasJob": false,
"Description": "2 new vulnerable software installed today:\n\n[[!0::rsyslog:8.24.0:]]\r\nHighest Severity: High\r\nEndpoints: 1\r\n\u2022 [[!0::rsyslog:8.24.0:CVE-2017-12588]] - High\r\nThe zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a format string attack with unspecified impact.\r\n\u2022 [[!0::rsyslog:8.24.0:CVE-2018-16881]] - Medium\r\nA denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0 are vulnerable.\r\n\r\n[[!0::binutils:2.27:]]\r\nHighest Severity: Medium\r\nEndpoints: 1\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12448]] - Medium\r\nThe bfd_cache_close function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a heap use after free and possibly achieve code execution via a crafted nested archive file. This issue occurs...\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12449]] - Medium\r\nThe _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12450]] - Medium\r\nThe alpha_vms_object_p function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted vms alpha file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12451]] - Medium\r\nThe _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds stack read via a crafted COFF image file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12452]] - Medium\r\nThe bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted mach-o file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12453]] - Medium\r\nThe _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12454]] - Medium\r\nThe _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12455]] - Medium\r\nThe evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12456]] - Medium\r\nThe read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12457]] - Medium\r\nThe bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a NULL dereference via a crafted file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12458]] - Medium\r\nThe nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted nlm file.\r\n\u2022 [[!0::binutils:2.27:CVE-2017-12459]] - Medium\r\nThe bfd_mach_o_read_symtab_strtab function in bfd/mach-o.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted mach-o file.\r\n\u2022 [[!0::binutils:2.27:CVE-2018-19931]] - Medium\r\nAn issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted.\r\n\u2022 [[!0::binutils:2.27:CVE-2018-1000876]] - Medium\r\nbinutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be...\r\n\u2022 [[!0::binutils:2.27:CVE-2018-19932]] - Medium\r\nAn issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c.\r\n\u2022 [[!0::binutils:2.27:CVE-2018-20671]] - Medium\r\nload_specific_debug_section in objdump.c in GNU Binutils through 2.31.1 contains an integer overflow vulnerability that can trigger a heap-based buffer overflow via a crafted section size.\r\n\u2022 [[!0::binutils:2.27:CVE-2019-1010204]] - Medium\r\nGNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an...\r\n\r\n",
"EventType": null,
"EventIndex": null,
"ArtifactName": null,
"CreateDate": "2020-03-19T23:59:59.999Z",
"EventTime": null,
"Name": "Vulnerable Software Installed - 3/19/2020",
"ParentEventID": null,
"EndpointName": "fidelis-endpoint.windows",
"ReportID": null,
"ActionsTaken": null,
"ID": 437,
"EventID": null,
"ValidatedDate": null,
"SourceType": 19,
"AgentTag": null,
"EndpointID": "70815600-2b9c-4cbe-971f-ab5601ed1ce1"
},
{
"Severity": 3,
"IntelName": "CVE-2013-1753",
"Telemetry": null,
"Source": "Installed Software CVE",
"InsertionDate": "2020-03-12T09:21:27.021Z",
"IntelID": null,
"HasJob": false,
"Description": "python - 2.7.5\n\nThe gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request.",
"EventType": null,
"EventIndex": null,
"ArtifactName": null,
"CreateDate": "2020-03-12T09:21:27.021Z",
"EventTime": null,
"Name": "Vulnerable Software - CVE-2013-1777",
"ParentEventID": null,
"EndpointName": "fidelis-endpoint.windows",
"ReportID": null,
"ActionsTaken": null,
"ID": 436,
"EventID": null,
"ValidatedDate": null,
"SourceType": 19,
"AgentTag": null,
"EndpointID": "70815600-2b9c-4cbe-971f-ab5601ed1ce1"
},
{
"Severity": 4,
"IntelName": "CVE-2020-10029",
"Telemetry": null,
"Source": "Installed Software CVE",
"InsertionDate": "2020-03-07T09:21:24.356Z",
"IntelID": null,
"HasJob": false,
"Description": "glibc - 2.17\n\nThe GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.",
"EventType": null,
"EventIndex": null,
"ArtifactName": null,
"CreateDate": "2020-03-07T09:21:24.356Z",
"EventTime": null,
"Name": "Vulnerable Software - CVE-2020-10029",
"ParentEventID": null,
"EndpointName": "fidelis-endpoint.windows",
"ReportID": null,
"ActionsTaken": null,
"ID": 435,
"EventID": null,
"ValidatedDate": null,
"SourceType": 19,
"AgentTag": null,
"EndpointID": "70815600-2b9c-4cbe-971f-ab5601ed1ce1"
},
{
"Severity": 2,
"IntelName": "CVE-2015-8710",
"Telemetry": null,
"Source": "Installed Software CVE",
"InsertionDate": "2020-02-27T09:21:03.253Z",
"IntelID": null,
"HasJob": false,
"Description": "libxml2 - 2.9.1\n\nThe htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.",
"EventType": null,
"EventIndex": null,
"ArtifactName": null,
"CreateDate": "2020-02-27T09:21:03.253Z",
"EventTime": null,
"Name": "Vulnerable Software - CVE-2015-8710",
"ParentEventID": null,
"EndpointName": "fidelis-endpoint.windows",
"ReportID": null,
"ActionsTaken": null,
"ID": 434,
"EventID": null,
"ValidatedDate": null,
"SourceType": 19,
"AgentTag": null,
"EndpointID": "70815600-2b9c-4cbe-971f-ab5601ed1ce1"
},
{
"Severity": 2,
"IntelName": "CVE-2014-4650",
"Telemetry": null,
"Source": "Installed Software CVE",
"InsertionDate": "2020-02-27T09:21:03.253Z",
"IntelID": null,
"HasJob": false,
"Description": "python - 2.7.5\n\nThe CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.",
"EventType": null,
"EventIndex": null,
"ArtifactName": null,
"CreateDate": "2020-02-27T09:21:03.253Z",
"EventTime": null,
"Name": "Vulnerable Software - CVE-2014-4444",
"ParentEventID": null,
"EndpointName": "fidelis-endpoint.windows",
"ReportID": null,
"ActionsTaken": null,
"ID": 433,
"EventID": null,
"ValidatedDate": null,
"SourceType": 19,
"AgentTag": null,
"EndpointID": "70815600-2b9c-4cbe-971f-ab5601ed1ce1"
}
]
}
Human Readable Output
Fidelis Endpoint Alerts
| ID | Name | EndpointName | EndpointID | Source | IntelName | Severity | CreateDate |
|---|---|---|---|---|---|---|---|
| 437 | Vulnerable Software Installed - 3/19/2020 | fidelis-endpoint.windows | 70815600-2b9c-4cbe-971f-ab5601ed1ce1 | Installed Software CVE | 2 | 2020-03-19T23:59:59.999Z | |
| 436 | Vulnerable Software - CVE-2013-1777 | fidelis-endpoint.windows | 70815600-2b9c-4cbe-971f-ab5601ed1ce1 | Installed Software CVE | CVE-2013-1753 | 3 | 2020-03-12T09:21:27.021Z |
| 435 | Vulnerable Software - CVE-2020-10029 | fidelis-endpoint.windows | 70815600-2b9c-4cbe-971f-ab5601ed1ce1 | Installed Software CVE | CVE-2020-10029 | 4 | 2020-03-07T09:21:24.356Z |
| 434 | Vulnerable Software - CVE-2015-8710 | fidelis-endpoint.windows | 70815600-2b9c-4cbe-971f-ab5601ed1ce1 | Installed Software CVE | CVE-2015-8710 | 2 | 2020-02-27T09:21:03.253Z |
| 433 | Vulnerable Software - CVE-2014-4444 | fidelis-endpoint.windows | 70815600-2b9c-4cbe-971f-ab5601ed1ce1 | Installed Software CVE | CVE-2014-4650 | 2 | 2020-02-27T09:21:03.253Z |
2. fidelis-endpoint-host-info
Searches for endpoints based on an IP address or hostname.
Base Command
fidelis-endpoint-host-info
Input
| Argument Name | Description | Required |
|---|---|---|
| ip_address | The IP address to search for. | Optional |
| host | The host name to search for. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Host.AgentVersion | String | The agent version. |
| FidelisEndpoint.Host.MacAddress | String | Host MAC address. |
| FidelisEndpoint.Host.OS | String | Endpoint OS. |
| FidelisEndpoint.Host.IPAddress | String | Endpoint IP address. |
| FidelisEndpoint.Host.Isolated | Boolean | Whether the endpoint is isolated. |
| FidelisEndpoint.Host.AV_Enabled | Boolean | Whether AV is enabled. |
| FidelisEndpoint.Host.Hostname | String | Host name. |
| FidelisEndpoint.Host.AgentInstalled | Boolean | Whether an agent was installed. |
| FidelisEndpoint.Host.Groups | String | Endpoint groups. |
| FidelisEndpoint.Host.LastContactDate | Date | Host last contact date. |
| FidelisEndpoint.Host.ID | String | Host ID. |
| FidelisEndpoint.Host.ProcessorName | String | Processor name. |
| FidelisEndpoint.Host.OnNetwork | Boolean | Whether the host is on the network. |
Command Example
!fidelis-endpoint-host-info ip_address="2.2.2.2"
Context Example
{
"Endpoint": [
{
"MACAddress": "23:01:0a:50:00:02",
"IPAddress": "2.2.2.2",
"Hostname": "fidelis-endpoint.windows",
"Processor": "Intel(R) Xeon(R) CPU @ 2.30GHz",
"OS": "CentOS Linux 7 (Core) Linux x64",
"ID": "70815600-2b9c-4cbe-971f-ab5601ed1ce1"
}
],
"FidelisEndpoint.Host": [
{
"AV_Enabled": true,
"LastContactDate": "2020-03-26T04:35:02.2887847",
"OS": "CentOS Linux 7 (Core) Linux x64",
"Hostname": "fidelis-endpoint.windows",
"Isolated": false,
"MacAddress": "23:01:0a:50:00:02",
"AgentVersion": "9.2.4.31",
"Groups": null,
"AgentInstalled": true,
"OnNetwork": true,
"ProcessorName": "Intel(R) Xeon(R) CPU @ 2.30GHz",
"IPAddress": "2.2.2.2",
"ID": "70815600-2b9c-4cbe-971f-ab5601ed1ce1"
}
]
}
Human Readable Output
Fidelis Endpoint Host Info
| ID | OS | MacAddress | Isolated | LastContactDate | AgentInstalled | AgentVersion | OnNetwork | AV_Enabled | ProcessorName |
|---|---|---|---|---|---|---|---|---|---|
| 70815600-2b9c-4cbe-971f-ab5601ed1ce1 | CentOS Linux 7 (Core) Linux x64 | 23:01:0a:50:00:02 | false | 2020-03-26T04:35:02.2887847 | true | 9.2.4.31 | true | true | Intel(R) Xeon(R) CPU @ 2.30GHz |
3. fidelis-endpoint-file-search
Searches for files on multiple hosts, using file hash, file extension, file size, and other search criteria.
Required Permissions
The required permissions: Scripts, View Executables
Base Command
fidelis-endpoint-file-search
Input
| Argument Name | Description | Required |
|---|---|---|
| host | A comma-separated list of hosts in which to search for the specified file. | Optional |
| md5 | A comma-separated list MD5 hashes to search for. Get the hashes from the queries commands. | Required |
| file_extension | The file extension. | Optional |
| file_path | The file path (recommended to lower the search time). | Optional |
| file_size | The file size greater than. The default is 100. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.FileSearch.JobID | String | The job ID. |
| FidelisEndpoint.FileSearch.JobResultID | String | The job result ID. |
Command Example
!fidelis-endpoint-file-search host="2.2.2.2" md5="098f6bcd4621d373cade4e832347b4f6" file_extension=".txt" file_size="0"
Context Example
{
"FidelisEndpoint.FileSearch": {
"JobResultID": "e93e848a-2462-4933-b442-ab8a02118111",
"JobID": "fcb3b94c-7344-4c30-a47b-93f90bd2385e"
}
}
Human Readable Output
Fidelis Endpoint file search
| JobID | JobResultID |
|---|---|
| fcb3b94c-7344-4c30-a47b-93f90bd2385e | e93e848a-2462-4933-b442-ab8a02118111 |
4. fidelis-endpoint-file-search-status
Gets the file search job status.
Required Permissions
The required permissions: View Executables
Base Command
fidelis-endpoint-file-search-status
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The job ID. Get the ID from the file-search command. | Required |
| job_result_id | The job result ID. Get the ID from the file-search command. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.FileSearch.JobID | String | The file search job ID. |
| FidelisEndpoint.FileSearch.JobResultID | String | Job result ID. |
| FidelisEndpoint.FileSearch.Status | String | Job status. |
Command Example
!fidelis-endpoint-file-search-status job_id=a345056b-b290-4746-b953-0822dab381ae job_result_id=0b7161ed-ffe9-4b87-b009-ab8a02034e0e
Context Example
{
"FidelisEndpoint.FileSearch": {
"Status": "Completed",
"JobResultID": "0b7161ed-ffe9-4b87-b009-ab8a02034e0e",
"JobID": "a345056b-b290-4746-b953-0822dab381ae"
}
}
Human Readable Output
Fidelis Endpoint file search status is: Completed
5. fidelis-endpoint-file-search-result-metadata
Gets the job results metadata. The maximum is 50 results.
Required Permissions
The required permissions: View Executables
Base Command
fidelis-endpoint-file-search-result-metadata
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The job ID. Get the job ID from the file-search command. | Required |
| job_result_id | The job result ID. Get the job result ID from the file-search command. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.File.AgentID | String | Agent ID. |
| FidelisEndpoint.File.FileName | String | File name. |
| FidelisEndpoint.File.FilePath | String | File path. |
| FidelisEndpoint.File.FileSize | Number | File size. |
| FidelisEndpoint.File.HostIP | String | Host IP address. |
| FidelisEndpoint.File.HostName | String | Host name. |
| FidelisEndpoint.File.ID | String | File ID. |
| FidelisEndpoint.File.MD5Hash | String | File MD5 hash. |
| File.Path | String | The file path. |
| File.Hostname | String | The name of the host where the file was found. |
| File.MD5 | String | The MD5 hash of the file. |
| File.Name | String | The full file name (including file extension). |
| File.Size | Number | The size of the file in bytes. |
Command Example
!fidelis-endpoint-file-search-result-metadata job_id=a345056b-b290-4746-b953-0822dab381ae job_result_id=0b7161ed-ffe9-4b87-b009-ab8a02034e0e
Context Example
{
"FidelisEndpoint.File": {
"MD5Hash": "098f6bcd4621d373cade4e832347b4f6",
"FilePath": "Users\\admin\\Documents\\test.txt",
"HostName": "fidelis-endpoint-winserver2019",
"FileName": "test.txt",
"FileSize": 4,
"HostIP": "2.2.2.2",
"AgentID": "4088e5f0-0d18-4daa-a1a3-e0becc34c803",
"ID": "eyJOYW1lIjoidGVzdC50eHQiLCJQYXRoIjoiL3Jlc3VsdHMvMGI3MTYxZWQtZmZlOS00Yjg3LWIwMDktYWI4YTAyMDM0ZTBlL2IyUnZPVFl5YjFSUGNqRnZSRTkwYlU1aWQxQnJUemRUZDJkTUwzUmFNbUZWY21wMlJrRjFhRXRwTUQwPSJ90"
},
"File": {
"Size": 4,
"Path": "Users\\admin\\Documents\\test.txt",
"Hostname": "fidelis-endpoint-winserver2019",
"Name": "test.txt",
"MD5": "098f6bcd4621d373cade4e832347b4f6"
}
}
Human Readable Output
Fidelis Endpoint file results metadata
| ID | FileName | FilePath | MD5Hash | FileSize | HostName | HostIP | AgentID |
|---|---|---|---|---|---|---|---|
| eyJOYW1lIjoidGVzdC50eHQiLCJQYXRoIjoiL3Jlc3VsdHMvMGI3MTYxZWQtZmZlOS00Yjg3LWIwMDktYWI4YTAyMDM0ZTBlL2IyUnZPVFl5YjFSUGNqRnZSRTkwYlU1aWQxQnJUemRUZDJkTUwzUmFNbUZWY21wMlJrRjFhRXRwTUQwPSJ90 | test.txt | Users\admin\Documents\test.txt | 098f6bcd4621d373cade4e832347b4f6 | 4 | fidelis-endpoint-winserver2019 | 2.2.2.2 | 4088e5f0-0d18-4daa-a1a3-e0becc34c803 |
6. fidelis-endpoint-get-file
Gets the file stream and download the file.
Required Permissions
The required permissions: Scripts, View Executables
Base Command
fidelis-endpoint-get-file
Input
| Argument Name | Description | Required |
|---|---|---|
| file_id | The file ID. Get the ID from the file-search-result-metadata command. | Required |
| file_name | The file name to download (including extension). Get the file name from the file-search-result-metadata command. command). | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| File.Size | Number | The size of the file in bytes. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.Name | String | The full file name (including file extension). |
| File.SSDeep | String | The ssdeep hash of the file (same as displayed in file entries). |
| File.EntryID | String | The ID for locating the file in the War Room. |
| File.Info | String | The file information. |
| File.Type | String | The file type, as determined by libmagic (same as displayed in file entries). |
| File.MD5 | String | The MD5 hash of the file. |
Command Example
!fidelis-endpoint-get-file file_id=eyJOYW1lIjoidGVzdC50eHQiLCJQYXRoIjoiL3Jlc3VsdHMvMGI3MTYxZWQtZmZlOS00Yjg3LWIwMDktYWI4YTAyMDM0ZTBlL2IyUnZPVFl5YjFSUGNqRnZSRTkwYlU1aWQxQnJUemRUZDJkTUwzUmFNbUZWY21wMlJrRjFhRXRwTUQwPSJ90 file_name=test.txt
Human Readable Output
Return the file to download
7. fidelis-endpoint-delete-file-search-job
Removes the job to free up space on the server.
Required Permissions
The required permissions: Scripts, View Executables, Delete Executables
Base Command
fidelis-endpoint-delete-file-search-job
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The job ID. Get the job ID from the file-search command. | Required |
Context Output
There is no context output for this command.
Command Example
!fidelis-endpoint-delete-file-search-job job_id=a345056b-b290-4746-b953-0822dab381ae
Human Readable Output
The job was successfully deleted
8. fidelis-endpoint-list-scripts
Gets a list of all script packages.
Required Permissions
The required permissions: Read groups, View Behaviors
Base Command
fidelis-endpoint-list-scripts
Input
| Argument Name | Description | Required |
| — | — | — |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Script.Description | String | The script description. |
| FidelisEndpoint.Script.ID | String | Script ID. |
| FidelisEndpoint.Script.Name | String | Script name. |
Command Example
##### Context Example
{
“FidelisEndpoint.Script”: [
{
“Name”: “Administrators”,
“Description”: “Lists all users with Administrator rights. Use the optional parameter to filter the results to usernames that contain the supplied text.”,
“ID”: “8d379688-dde1-451d-8fa2-4f29c84baf97”
},
{
“Name”: “Administrators”,
“Description”: “Lists all users with Administrator rights. Use the optional parameter to filter the results to usernames that contain the supplied text.”,
“ID”: “c533cf90-f015-4616-84fb-8836b32aa74b”
},
{
“Name”: “Agent Log”,
“Description”: “Returns log entries from the Fidelis Agent.”,
“ID”: “e73ffbba-14c1-4dd4-bb45-60d6906031c9”
},
{
“Name”: “Agent Log”,
“Description”: “Returns log entries from the Fidelis Agent.”,
“ID”: “f0572f26-4272-4d2c-8f6f-4a8dfa307904”
},
{
“Name”: “All User Accounts”,
“Description”: “Displays information about any created users on an endpoint. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column.”,
“ID”: “42787aa7-f721-49ad-ab2d-308f905986f3”
},
{
“Name”: “All User Accounts”,
“Description”: “Displays information about any created users on an endpoint. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column.”,
“ID”: “b44f4b11-2e76-44c8-9484-238fd3063aea”
},
{
“Name”: “All User Accounts”,
“Description”: “Displays information about any created users on an endpoint. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column.”,
“ID”: “3fe1ec01-b095-4a6a-8fcf-7d9e1df95284”
},
{
“Name”: “Services (WMI)”,
“Description”: “Obtain the list of services from the Windows Management Instrumentation (WMI).\r\nThe Service Name or Account Filter limits the results to services that have the matching name or account.”,
“ID”: “9622541e-2bca-46f5-b2a6-ef406babf9cd”
},
] } ```
Human Readable Output
Fidelis Endpoint scripts
| ID | Name | Description |
|---|---|---|
| 8d379688-dde1-451d-8fa2-4f29c84baf97 | Administrators | Lists all users with Administrator rights. Use the optional parameter to filter the results to usernames that contain the supplied text. |
| c533cf90-f015-4616-84fb-8836b32aa74b | Administrators | Lists all users with Administrator rights. Use the optional parameter to filter the results to usernames that contain the supplied text. |
| e73ffbba-14c1-4dd4-bb45-60d6906031c9 | Agent Log | Returns log entries from the Fidelis Agent. |
| f0572f26-4272-4d2c-8f6f-4a8dfa307904 | Agent Log | Returns log entries from the Fidelis Agent. |
| 42787aa7-f721-49ad-ab2d-308f905986f3 | All User Accounts | Displays information about any created users on an endpoint. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column. |
| b44f4b11-2e76-44c8-9484-238fd3063aea | All User Accounts | Displays information about any created users on an endpoint. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column. |
| 3fe1ec01-b095-4a6a-8fcf-7d9e1df95284 | All User Accounts | Displays information about any created users on an endpoint. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column. |
| 1a57a6ad-4dd7-4055-8def-8e423d949f3f | All User Accounts (WMI) | Lists all the user accounts. Use the optional parameter to filter the results to those that have a username that contains the supplied text |
| c8adc3bc-6345-473d-a8cc-c45a76f9d62c | AntiVirus Information | Shows the AntiVirus and AntiSpyware products installed on client computer and whether they are enabled and up-to-date. Provide the optional filter to only return products that contain the filter text. This script does not work on server class operating systems. |
| c9b37e1e-3ec6-49a3-9426-b90a90b55071 | ARP Cache | Displays information from the Address Resolution Protocol Cache. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column. |
| f3eb6edf-5764-4e11-8833-6da6b067e54e | ARP Cache | Displays information from the Address Resolution Protocol Cache. Use the Optional Question box to filter the results by the specified text–results returned include data containing that value in any column. |
9. fidelis-endpoint-get-script-manifest
Gets the script manifest.
Required Permissions
The required permissions: View Behaviors
Base Command
fidelis-endpoint-get-script-manifest
Input
| Argument Name | Description | Required |
|---|---|---|
| script_id | The script ID. Get the script ID from the list-scripts command. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Script.ResultColumns | String | The script results columns. |
| FidelisEndpoint.Script.Priority | String | Script priority. |
| FidelisEndpoint.Script.ImpersonationUser | String | Impersonation user. |
| FidelisEndpoint.Script.Name | String | Script name. |
| FidelisEndpoint.Script.Command | String | The script commands. |
| FidelisEndpoint.Script.Questions | String | Script questions. |
| FidelisEndpoint.Script.WizardOverridePassword | Boolean | Wizard override password. |
| FidelisEndpoint.Script.Platform | String | Scripts platforms (only true). |
| FidelisEndpoint.Script.ImpersonationPassword | String | Impersonation password. |
| FidelisEndpoint.Script.ID | String | Script ID. |
| FidelisEndpoint.Script.Description | String | The script description. |
| FidelisEndpoint.Script.TimeoutSeconds | Number | Script timeout in seconds. |
Command Example
!fidelis-endpoint-get-script-manifest script_id="2d32a530-0716-4542-afdc-8da3bd47d8bf"
Context Example
{
"FidelisEndpoint.Script": {
"Description": "Obtain the list of currently running processes.\r\nOptionally, information about open sockets, handles and loaded DLLs can be included.\r\nCerberus Stage One analysis verifies digital signatures of the processes and performs a risk assessment of known system calls assigning an aggregate score.\r\nThe filter field limits the results to processes that match the given text in any column.",
"TimeoutSeconds": 0,
"WizardOverridePassword": false,
"ImpersonationUser": null,
"ResultColumns": [
"__detail",
"PID",
"Parent PID",
"Name",
"User",
"MD5",
"SHA1",
"Path",
"Start Time",
"Working Directory",
"Command Line",
"Is Hidden"
],
"Priority": null,
"Platform": [
"windows32",
"windows64"
],
"ImpersonationPassword": null,
"Command": "Volatile.bat sockets {[T:B,V:true]Include Sockets} handles {[T:B,V:true]Include Handles} dlls {[T:B,V:true]Include DLLs} injected {[T:B,?]Check for injected DLLs} jam {[T:B,?]Perform Cerberus Stage 1 Analysis (approximately 5 seconds per process)} filter {[T:T,?] Filter}",
"Questions": [
{
"answer": "true",
"question": "Include Sockets",
"inputType": "checkbox",
"isOptional": false,
"paramNumber": 1
},
{
"answer": "true",
"question": "Include Handles",
"inputType": "checkbox",
"isOptional": false,
"paramNumber": 2
},
{
"answer": "true",
"question": "Include DLLs",
"inputType": "checkbox",
"isOptional": false,
"paramNumber": 3
},
{
"answer": "false",
"question": "Check for injected DLLs",
"inputType": "checkbox",
"isOptional": true,
"paramNumber": 4
},
{
"answer": "false",
"question": "Perform Cerberus Stage 1 Analysis (approximately 5 seconds per process)",
"inputType": "checkbox",
"isOptional": true,
"paramNumber": 5
},
{
"answer": null,
"question": " Filter",
"inputType": "text",
"isOptional": true,
"paramNumber": 6
}
],
"ID": "2d32a530-0716-4542-afdc-8da3bd47d8bf",
"Name": "Process List"
}
}
Human Readable Output
Fidelis Endpoint script manifest
| ID | Name | Description | Platform | Command | Questions | TimeoutSeconds | ResultColumns | WizardOverridePassword |
|---|---|---|---|---|---|---|---|---|
| 2d32a530-0716-4542-afdc-8da3bd47d8bf | Process List | Obtain the list of currently running processes. Optionally, information about open sockets, handles and loaded DLLs can be included. Cerberus Stage One analysis verifies digital signatures of the processes and performs a risk assessment of known system calls assigning an aggregate score.The filter field limits the results to processes that match the given text in any column. |
windows32,windows64 | Volatile.bat sockets {[T:B,V:true]Include Sockets} handles {[T:B,V:true]Include Handles} dlls {[T:B,V:true]Include DLLs} injected {[T:B,?]Check for injected DLLs} jam {[T:B,?]Perform Cerberus Stage 1 Analysis (approximately 5 seconds per process)} filter {[T:T,?] Filter} | {‘paramNumber’: 1, ‘question’: ‘Include Sockets’, ‘answer’: ‘true’, ‘isOptional’: False, ‘inputType’: ‘checkbox’}, {‘paramNumber’: 2, ‘question’: ‘Include Handles’, ‘answer’: ‘true’, ‘isOptional’: False, ‘inputType’: ‘checkbox’}, {‘paramNumber’: 3, ‘question’: ‘Include DLLs’, ‘answer’: ‘true’, ‘isOptional’: False, ‘inputType’: ‘checkbox’}, {‘paramNumber’: 4, ‘question’: ‘Check for injected DLLs’, ‘answer’: ‘false’, ‘isOptional’: True, ‘inputType’: ‘checkbox’}, {‘paramNumber’: 5, ‘question’: ‘Perform Cerberus Stage 1 Analysis (approximately 5 seconds per process)’, ‘answer’: ‘false’, ‘isOptional’: True, ‘inputType’: ‘checkbox’}, {‘paramNumber’: 6, ‘question’: ‘ Filter’, ‘answer’: None, ‘isOptional’: True, ‘inputType’: ‘text’} |
0 | __detail, PID, Parent PID, Name, User, MD5, SHA1, Path, Start Time, Working Directory, Command Line, Is Hidden |
false |
10. fidelis-endpoint-list-processes
Gets a list all processes according to the OS system.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-list-processes
Input
| Argument Name | Description | Required |
|---|---|---|
| endpoint_ip | The endpoint IP. Get the endpoint IP from the host-info command. | Optional |
| operating_system | Ths system OS. Can be “Windows”, “Linux”, or “macOS”. | Required |
| time_out | Script time out in seconds. The default is 300. | Optional |
| endpoint_name | The endpoint name. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Process.JobID | String | Job ID. |
| FidelisEndpoint.Process.ID | String | Script ID. |
Command Example
!fidelis-endpoint-list-processes operating_system=Windows endpoint_ip=2.2.2.2
Context Example
{
"FidelisEndpoint.Process": {
"ID": "2d32a530-0716-4542-afdc-8da3bd47d8bf",
"JobID": "71c6be70-fa49-40ba-8d0a-ab8a02118a19"
}
}
Human Readable Output
The job has been executed successfully.
Job ID: 71c6be70-fa49-40ba-8d0a-ab8a02118a19
11. fidelis-endpoint-get-script-result
Gets script job results.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-get-script-result
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The script execution job ID. Get the ID the following commands: script-execution, file-search, list-processes, kill-process-by-pid, delete-file, network-isolation, remove-network-isolation. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.ScriptResult.EndpointName | String | Endpoint name. |
| FidelisEndpoint.ScriptResult.ParentPID | String | Parent process ID. |
| FidelisEndpoint.ScriptResult.Path | String | File path. |
| FidelisEndpoint.ScriptResult.SHA1 | String | File SHA1 hash. |
| FidelisEndpoint.ScriptResult.PID | String | Process ID. |
| FidelisEndpoint.ScriptResult.Name | String | Process name. |
| FidelisEndpoint.ScriptResult.User | String | Script user. |
| FidelisEndpoint.ScriptResult.StartTime | Date | Script start time. |
| FidelisEndpoint.ScriptResult.EndpointID | String | Endpoint ID. |
| FidelisEndpoint.ScriptResult.Matches | Number | Script matches. |
| FidelisEndpoint.ScriptResult.IsHidden | String | Whether the endpoint is hidden. |
| FidelisEndpoint.ScriptResult.GroupID | String | Group ID. |
| FidelisEndpoint.ScriptResult.Tags | String | Script tags. |
| FidelisEndpoint.ScriptResult.ID | String | Script result ID. |
| FidelisEndpoint.ScriptResult.WorkingDirectory | String | Working directory. |
| FidelisEndpoint.ScriptResult.MD5 | String | File MD5 hash. |
| FidelisEndpoint.ScriptResult.CommandLine | String | Command line. |
Command Example
!fidelis-endpoint-get-script-result job_id=fc94568c-9a15-4fa2-af08-ab8a01f5e86c
Context Example
{
"FidelisEndpoint.ScriptResult": [
{
"SHA1": "0000000000000000000000000000000000000000",
"Name": "System",
"ParentPID": "0",
"Tags": [],
"Matches": 0,
"CommandLine": "",
"PID": "4",
"GroupID": "9F4354C1CEB3B925ADC6A6286FF5A23F7CF9D7B0",
"StartTime": "N/A",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"WorkingDirectory": "",
"Path": "",
"IsHidden": "false",
"ID": "7086ab52f0725e547095ff779e30153ae6088ccc",
"MD5": "00000000000000000000000000000000"
},
{
"SHA1": "0000000000000000000000000000000000000000",
"Name": "registry.exe",
"ParentPID": "4",
"Tags": [],
"Matches": 0,
"CommandLine": "",
"PID": "84",
"GroupID": "CE47F839D8D87C334A503491A4D60CDA15295071",
"StartTime": "N/A",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"WorkingDirectory": "",
"Path": "",
"IsHidden": "false",
"ID": "11ea7715d36598d0bc0aaa97ee3e95c26d293f4b",
"MD5": "00000000000000000000000000000000"
},
{
"SHA1": "0FA1562A56219B1FC005E24AC1D866F6E1AE7902",
"Name": "smss.exe",
"ParentPID": "4",
"Tags": [],
"Matches": 0,
"CommandLine": "",
"PID": "264",
"GroupID": "82D6263B1B8CDA7C62591267E414CA9E56BF603A",
"StartTime": "N/A",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"WorkingDirectory": "",
"Path": "C:\\Windows\\System32\\smss.exe",
"IsHidden": "false",
"ID": "863637a177dee43dfbcb0b479db1e5ec885d70e8",
"MD5": "2855A7D96CF37DF1960A6D8828A614CB"
},
{
"SHA1": "A04607D0B11D30B0CDB36739077E7F1B6C7D1FAE",
"Name": "protect.exe",
"ParentPID": "576",
"Tags": [],
"Matches": 0,
"CommandLine": "\"C:\\Program Files\\Fidelis\\Endpoint\\Platform\\services\\protect\\protect.exe\" -s",
"PID": "272",
"GroupID": "5D5334D2A0405C72C967B4D784E27AD222E7BDD9",
"StartTime": "2020-03-26T04:04:22.855396",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "SYSTEM",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"WorkingDirectory": "C:\\Windows\\system32\\",
"Path": "C:\\Program Files\\Fidelis\\Endpoint\\Platform\\services\\protect\\protect.exe",
"IsHidden": "false",
"ID": "4a598df8817b12552d3a485e23dac7f911536a5a",
"MD5": "40A35E6DC3ADE3F5CAA79A4C15CCF37C"
},
{
"SHA1": "A1385CE20AD79F55DF235EFFD9780C31442AA123",
"Name": "svchost.exe",
"ParentPID": "576",
"Tags": [],
"Matches": 0,
"CommandLine": "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService",
"PID": "304",
"GroupID": "8C6F410CBCE4C937FC8ED920462AD47CA49FCE0C",
"StartTime": "2020-03-12T03:58:08.237101",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "SYSTEM",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"WorkingDirectory": "C:\\Windows\\system32\\",
"Path": "C:\\Windows\\System32\\svchost.exe",
"IsHidden": "false",
"ID": "1d807600d7deef1f26d16ddc28ae6ca4ca656202",
"MD5": "3A0A29438052FAED8A2532DA50455876"
}
]
}
Human Readable Output
Fidelis Endpoint script job results
| ID | Name | EndpointID | EndpointName | PID | User | SHA1 | MD5 | Path | WorkingDirectory | StartTime |
|---|---|---|---|---|---|---|---|---|---|---|
| 7086ab52f0725e547095ff779e30153ae6088ccc | System | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 4 | 0000000000000000000000000000000000000000 | 00000000000000000000000000000000 | N/A | |||
| 11ea7715d36598d0bc0aaa97ee3e95c26d293f4b | registry.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 84 | 0000000000000000000000000000000000000000 | 00000000000000000000000000000000 | N/A | |||
| 863637a177dee43dfbcb0b479db1e5ec885d70e8 | smss.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 264 | 0FA1562A56219B1FC002E24AC8D866F6E1AE7902 | 2755A7D96CF37DF1960A6D8828A614CB | C:\Windows\System32\smss.exe | N/A | ||
| 4a598df8817b12552d3a485e23dac7f911536a5a | protect.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 272 | SYSTEM | A04607D0B11D30B0CDB36739088E8F1B6C7D1FAE | 40A35E6DC3ADE3F5CAA79A4C15CCF37C | C:\Program Files\Fidelis\Endpoint\Platform\services\protect\protect.exe | C:\Windows\system32\ | 2020-03-26T04:04:22.855396 |
| 1d807600d7deef1f26d16ddc28ae6ca4ca656202 | svchost.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 304 | SYSTEM | A1385CE20AD79F55DF235EFFD9780C31442AA234 | 8a0a29438052faed8a2532da50451234 | C:\Windows\System32\svchost.exe | C:\Windows\system32\ | 2020-03-12T03:58:08.237101 |
| b52743f524304f61a076feb040426c2931921adf | svchost.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 364 | LOCAL SERVICE | A1385CE20AD79F55DF235EFFD9780C31442AA234 | 8a0a29438052faed8a2532da50451234 | C:\Windows\System32\svchost.exe | C:\Windows\system32\ | 2020-03-12T03:58:08.526584 |
| 63cf4746e5a634fdb2ae8c9f4feca6b49377f1af | csrss.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 372 | 779B8AFC3FA2528B090F400EF3D592E0E2775955 | 7D64128BC1EECE41196858897596EBC8 | C:\Windows\System32\csrss.exe | N/A | ||
| 27e4f8301c0ce8d0dbe449561c0aae59a2fece82 | svchost.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 440 | LOCAL SERVICE | A1385CE20AD79F55DF235EFFD9780C31442AA234 | 8a0a29438052faed8a2532da50451234 | C:\Windows\system32\svchost.exe | C:\Windows\system32\ | 2020-03-12T03:58:08.540947 |
| d81492c785d46ab06e001d5fed4f8d5e491b02b5 | svchost.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 444 | LOCAL SERVICE | A1385CE20AD79F55DF235EFFD9780C31442AA234 | 8a0a29438052faed8a2532da50451234 | C:\Windows\system32\svchost.exe | C:\Windows\system32\ | 2020-03-12T03:58:08.526589 |
| f211cdabce3ea5a029ad2a63b803a9962e63af96 | wininit.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 448 | 389E257A924EA521E830C31712494D33B38841A8 | 4E20895E641F2C3E68AB3DB91A1A16F1 | C:\Windows\System32\wininit.exe | N/A | ||
| 395b84b288830e96cf91fa20f7c399d8a21f2d8f | csrss.exe | 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 456 | 779B8AFC3FA2528B090F400EF3D592E0E2775955 | 7D64128BC1EECE41196858897596EBC8 | C:\Windows\System32\csrss.exe | N/A |
12. fidelis-endpoint-kill-process
Terminates the process that matches the required parameter’s process ID.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-kill-process
Input
| Argument Name | Description | Required |
|---|---|---|
| endpoint_ip | The endpoint IP address. | Optional |
| time_out | Script time out (in seconds). The default is 300. | Optional |
| operating_system | System OS. Can be “Windows”, “Linux”, or “macOS”. | Required |
| pid | Process ID. Get the PID from the script-manifest command. | Required |
| endpoint_name | The name of the endpoint. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Process.JobID | String | Script job ID. |
| FidelisEndpoint.Process.ID | String | Script ID. |
Command Example
!fidelis-endpoint-kill-process operating_system=Windows pid=516 endpoint_ip=2.2.2.2
Context Example
{
"FidelisEndpoint.Process": {
"ID": "8d379688-dde1-451d-8fa2-4f29c84baf97",
"JobID": "25548787-e75c-4c55-96d5-ab8a0211a820"
}
}
Human Readable Output
The job has been executed successfully.
Job ID: 25548787-e75c-4c55-96d5-ab8a0211a820
13. fidelis-endpoint-delete-file
Deletes a file at the specified path.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-delete-file
Input
| Argument Name | Description | Required |
|---|---|---|
| endpoint_ip | Endpoint IP address. | Optional |
| time_out | Script time out (in seconds). The default is 300. | Optional |
| operating_system | System OS. Can be “Windows”, “Linux”, or “macOS”. | Required |
| file_path | The path of the file to delete. | Required |
| endpoint_name | The name of the endpoint. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Script.ID | String | Script ID. |
| FidelisEndpoint.Script.JobID | String | Script job ID. |
Command Example
!fidelis-endpoint-delete-file file_path=c:\\Users\\admin\\Documents\\test.txt operating_system=Windows endpoint_ip=2.2.2.2
Human Readable Output
The job has been executed successfully.
Job ID: 4317e979-81df-46d8-8eb1-ab8a023ef4d8
14. fidelis-endpoint-isolate-network
Quarantines an endpoint. While isolated, the endpoint’s network communication is restricted to only the allowed servers.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-isolate-network
Input
| Argument Name | Description | Required |
|---|---|---|
| endpoint_ip | The endpoint IP address to isolate. | Optional |
| time_out | Script timeout (in seconds). The default is 300. | Optional |
| operating_system | The system OS. Can be “Windows”, “Linux”, or “macOS”. | Required |
| allowed_server | The server IP address that can communicate with the isolated endpoint. For example: 2.2.2.2. | Required |
| endpoint_name | The name of the endpoint. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Isolation.ID | String | Script ID. |
| FidelisEndpoint.Isolation.JobID | String | Script job ID. |
Command Example
!fidelis-endpoint-isolate-network operating_system=Windows allowed_server=10.10.10.10 endpoint_ip=10.10.0.1
Human Readable Output
The job has been executed successfully.
Job ID: f25691bd-ba78-4f40-9a25-ab8a02420abc
15. fidelis-endpoint-remove-network-isolation
Removes the endpoint from isolation.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-remove-network-isolation
Input
| Argument Name | Description | Required |
|---|---|---|
| endpoint_ip | The isolated endpoint IP address. | Optional |
| time_out | Script timeout (in seconds). The default is 300. | Optional |
| operating_system | System OS. Can be “Windows”, “Linux”, or “macOS”. | Required |
| endpoint_name | The name of the endpoint. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Isolation.ID | String | Script ID. |
| FidelisEndpoint.Isolation.JobID | String | Script job ID. |
Command Example
!fidelis-endpoint-remove-network-isolation operating_system=Windows endpoint_ip=10.128.0.1
Human Readable Output
The job has been executed successfully.
Job ID: 7a0a3179-3bce-43d1-80c0-ab8a0242d147
16. fidelis-endpoint-script-job-status
Gets the script execution status.
Required Permissions
The required permissions: Scripts, View Executables, View Task Results
Base Command
fidelis-endpoint-script-job-status
Input
| Argument Name | Description | Required |
|---|---|---|
| job_result_id | The script execution job result ID. Get the ID from the following commands: script-execution, file-search, list-processes, kill-process-by-pid, delete-file, network-isolation, remove-network-isolation. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.ScriptResult.JobName | String | The job name. |
| FidelisEndpoint.ScriptResult.JobResultID | String | Job result ID. |
| FidelisEndpoint.ScriptResult.Name | String | Target name. |
| FidelisEndpoint.ScriptResult.Status | String | Script execution status. |
Command Example
!fidelis-endpoint-script-job-status job_result_id=fc94568c-9a15-4fa2-af08-ab8a01f5e86c
Context Example
{
"FidelisEndpoint.ScriptResult": [
{
"Status": "Completed",
"Name": "fidelis-endpoint-winserver2019",
"JobResultID": "fc94568c-9a15-4fa2-af08-ab8a01f5e86c",
"JobName": "Process List-03-26-2020 9.08.12"
}
]
}
Human Readable Output
Fidelis Endpoint script job status
| JobName | JobResultID | Name | Status |
|---|---|---|---|
| Process List-03-26-2020 9.08.12 | fc94568c-9a15-4fa2-af08-ab8a01f5e86c | fidelis-endpoint-winserver2019 | Completed |
17. fidelis-endpoint-execute-script
Executes a script package from Fidelis endpoint packages.
Required Permissions
The required permissions: Scripts, View Executables
Base Command
fidelis-endpoint-execute-script
Input
| Argument Name | Description | Required |
|---|---|---|
| script_id | Script ID. Get the script ID from the list-scripts command. | Required |
| time_out | Script time out (in seconds). The default is 300. | Optional |
| endpoint_ip | Endpoint IP address on which to run the script. | Optional |
| answer | The script to run. Get the answer from the script-manifest command. | Required |
| endpoint_name | The name of the endpoint. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Script.ID | String | Script ID. |
| FidelisEndpoint.Script.JobID | String | Script job ID. |
Command Example
!fidelis-endpoint-execute-script script_id="2d32a530-0716-4542-afdc-8da3bd47d8bf" time_out="300" endpoint_ip="2.2.2.2" answer="true"
Context Example
{
"FidelisEndpoint.Script": {
"ID": "2d32a530-0716-4542-afdc-8da3bd47d8bf",
"JobID": "8ac08ab1-e6f4-4aa1-9784-ab8a02115483"
}
}
Human Readable Output
The job has been executed successfully.
Job ID: 8ac08ab1-e6f4-4aa1-9784-ab8a02115483
18. fidelis-endpoint-query-file
Queries a file by file hash.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results.
Base Command
fidelis-endpoint-query-file
Input
| Argument Name | Description | Required |
|---|---|---|
| start_time | The start time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| end_time | The end time of the event in the system in UTC format. Supported values:”2019-10-21T23:45:00” (date). |
Optional |
| logic | The logic of the query. Can be “and” or “or”. | Required |
| file_hash | The MD5 file hash to search for. | Required |
| limit | The maximum number of results to return. The default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Query.ProcessStartTime | Date | The process start time. |
| FidelisEndpoint.Query.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Query.CertificateSubjectName | String | Certificate subject name. |
| FidelisEndpoint.Query.Size | Number | File size. |
| FidelisEndpoint.Query.FileExtension | String | File extension. |
| FidelisEndpoint.Query.Path | String | File path. |
| FidelisEndpoint.Query.CertificatePublisher | String | Certificate publisher. |
| FidelisEndpoint.Query.ParentID | String | Process parent ID. |
| FidelisEndpoint.Query.EventTime | Date | Event time. |
| FidelisEndpoint.Query.SignedTime | Date | Signed time. |
| FidelisEndpoint.Query.Name | String | File name. |
| FidelisEndpoint.Query.TargetID | String | Target ID. |
| FidelisEndpoint.Query.Hash | String | File hash. |
| FidelisEndpoint.Query.StartTime | Date | Event start time. |
| FidelisEndpoint.Query.HashSHA1 | String | File SHA1 hash. |
| FidelisEndpoint.Query.EventType | Number | Event type. |
| FidelisEndpoint.Query.HashSHA256 | String | File SHA256 hash. |
| FidelisEndpoint.Query.ParentName | String | Process parent name. |
| FidelisEndpoint.Query.FileType | Number | File type. |
| FidelisEndpoint.Query.Signature | Number | File signature. |
| FidelisEndpoint.Query.EventIndex | Number | Event index. |
| FidelisEndpoint.Query.FileCategory | Number | File category. |
| FidelisEndpoint.Query.CertificateIssuerName | String | Certificate issuer name. |
| FidelisEndpoint.Query.FileVersion | String | File version. |
| FidelisEndpoint.Query.IndexingTime | Date | Indexing time. |
| FidelisEndpoint.Query.EntityType | Number | Entity type. |
| File.Name | String | The full file name (including file extension). |
| File.Size | Number | The size of the file in bytes. |
| File.MD5 | String | The MD5 hash of the file. |
| File.Extension | String | The file extension, for example: “txt”. |
| File.Type | Number | The file type, as determined by libmagic (same as displayed in file entries). |
| File.Path | String | The path where the file is located. |
| File.Hostname | String | The name of the host where the file was found. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.FileVersion | String | The file version. |
Command Example
!fidelis-endpoint-query-file logic="and" file_hash="8a0a29438052faed8a2532da50451234"
Context Example
{
"FidelisEndpoint.Query": [
{
"EntityType": 1,
"TargetID": "aW9qfAMZ5a3",
"StartTime": "2020-03-26T09:02:26.511Z",
"FileExtension": "exe",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)",
"ProcessStartTime": "2020-03-26T09:02:26.511Z",
"IndexingTime": "2020-03-26T09:06:31.958Z",
"CertificateSubjectName": "Microsoft Windows Publisher",
"EventType": 2,
"ParentName": "svchost.exe",
"HashSHA1": "a1385ce20ad79f55df235effd9780c31442aa456",
"SignedTime": "1:29 9/15/2018",
"EventIndex": 1,
"Path": "C:\\Windows\\System32\\svchost.exe",
"EventTime": "2020-03-26T09:02:26.511Z",
"Name": "svchost.exe",
"CertificatePublisher": "Microsoft Corporation",
"FileType": "8",
"HashSHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020565ab6",
"EndpointName": "fidelis-endpoint-winserver2019",
"Signature": "16",
"Hash": "8a0a29438052faed8a2532da50455456",
"FileCategory": "776",
"ParentID": "rSdnlXD7OX6",
"CertificateIssuerName": "Microsoft Windows Production PCA 2011",
"Size": 51696
},
{
"EntityType": 1,
"TargetID": "aW9qfAMZ5a3",
"StartTime": "2020-03-26T08:02:26.197Z",
"FileExtension": "exe",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)",
"ProcessStartTime": "2020-03-26T08:02:26.197Z",
"IndexingTime": "2020-03-26T08:05:00.035Z",
"CertificateSubjectName": "Microsoft Windows Publisher",
"EventType": 2,
"ParentName": "svchost.exe",
"HashSHA1": "a1385ce20ad79f55df235effd9780c31442aa456",
"SignedTime": "1:29 9/15/2018",
"EventIndex": 1,
"Path": "C:\\Windows\\System32\\svchost.exe",
"EventTime": "2020-03-26T08:02:26.197Z",
"Name": "svchost.exe",
"CertificatePublisher": "Microsoft Corporation",
"FileType": "8",
"HashSHA256": "7fd065bac18c1234777ae44908101cdfed72d26fa741367f0ad4d02020787ab6",
"EndpointName": "fidelis-endpoint-winserver2019",
"Signature": "16",
"Hash": "8a0a29438052faed8a2532da12355756",
"FileCategory": "776",
"ParentID": "m31v1MqQ6",
"CertificateIssuerName": "Microsoft Windows Production PCA 2011",
"Size": 51696
},
{
"EntityType": 1,
"TargetID": "aW9qfAMZ5a3",
"StartTime": "2020-03-26T07:02:25.887Z",
"FileExtension": "exe",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)",
"ProcessStartTime": "2020-03-26T07:02:25.887Z",
"IndexingTime": "2020-03-26T07:08:28.331Z",
"CertificateSubjectName": "Microsoft Windows Publisher",
"EventType": 2,
"ParentName": "svchost.exe",
"HashSHA1": "a1385ce20ad79f55df235effd9780c31442aa456",
"SignedTime": "1:29 9/15/2018",
"EventIndex": 1,
"Path": "C:\\Windows\\System32\\svchost.exe",
"EventTime": "2020-03-26T07:02:25.887Z",
"Name": "svchost.exe",
"CertificatePublisher": "Microsoft Corporation",
"FileType": "8",
"HashSHA256": "7fd065bac18c5123777ae44908101cdfed72d26fa741367f0ad4d02020787ab6",
"EndpointName": "fidelis-endpoint-winserver2019",
"Signature": "16",
"Hash": "8a0a29438052faed8a2532da50455123",
"FileCategory": "776",
"ParentID": "fmz4un6Qzfd",
"CertificateIssuerName": "Microsoft Windows Production PCA 2011",
"Size": 51696
},
{
"EntityType": 1,
"TargetID": "aW9qfAMZ5a3",
"StartTime": "2020-03-26T06:15:07.125Z",
"FileExtension": "exe",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)",
"ProcessStartTime": "2020-03-26T06:15:07.125Z",
"IndexingTime": "2020-03-26T06:20:26.814Z",
"CertificateSubjectName": "Microsoft Windows Publisher",
"EventType": 2,
"ParentName": "svchost.exe",
"HashSHA1": "a1385ce20ad79f55df235effd9780c31442aa456",
"SignedTime": "1:29 9/15/2018",
"EventIndex": 1,
"Path": "C:\\Windows\\System32\\svchost.exe",
"EventTime": "2020-03-26T06:15:07.125Z",
"Name": "svchost.exe",
"CertificatePublisher": "Microsoft Corporation",
"FileType": "8",
"HashSHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6",
"EndpointName": "fidelis-endpoint-winserver2019",
"Signature": "16",
"Hash": "8a0a29438052faed8a2532da50455123",
"FileCategory": "776",
"ParentID": "fS3SPnQU5Xe",
"CertificateIssuerName": "Microsoft Windows Production PCA 2011",
"Size": 51696
},
{
"EntityType": 1,
"TargetID": "aW9qfAMZ5a3",
"StartTime": "2020-03-26T06:02:25.581Z",
"FileExtension": "exe",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)",
"ProcessStartTime": "2020-03-26T06:02:25.581Z",
"IndexingTime": "2020-03-26T06:05:26.740Z",
"CertificateSubjectName": "Microsoft Windows Publisher",
"EventType": 2,
"ParentName": "svchost.exe",
"HashSHA1": "a1385ce20ad79f55df235effd9780c31442aa456",
"SignedTime": "1:29 9/15/2018",
"EventIndex": 1,
"Path": "C:\\Windows\\System32\\svchost.exe",
"EventTime": "2020-03-26T06:02:25.581Z",
"Name": "svchost.exe",
"CertificatePublisher": "Microsoft Corporation",
"FileType": "8",
"HashSHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020232cb6",
"EndpointName": "fidelis-endpoint-winserver2019",
"Signature": "16",
"Hash": "8a0a29438052faed8a2532da50455123",
"FileCategory": "776",
"ParentID": "s8Iu12ulYKh",
"CertificateIssuerName": "Microsoft Windows Production PCA 2011",
"Size": 51696
}
],
"File": [
{
"SHA1": "a1385ce20ad79f55df235effd9780c31442aa456",
"SHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020232cb6",
"Name": "svchost.exe",
"Extension": "exe",
"Hostname": "fidelis-endpoint-winserver2019",
"Size": 51696,
"Path": "C:\\Windows\\System32\\svchost.exe",
"MD5": "8a0a29438052faed8a2532da50451234",
"Type": "8",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)"
},
{
"SHA1": "a1385ce20ad79f55df235effd9780c31442aa234",
"SHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6",
"Name": "svchost.exe",
"Extension": "exe",
"Hostname": "fidelis-endpoint-winserver2019",
"Size": 51696,
"Path": "C:\\Windows\\System32\\svchost.exe",
"MD5": "8a0a23438052faed8a2532da50455756",
"Type": "8",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)"
},
{
"SHA1": "a1385ce20ad79f55df235effd9780c31442aa234",
"SHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6",
"Name": "svchost.exe",
"Extension": "exe",
"Hostname": "fidelis-endpoint-winserver2019",
"Size": 51696,
"Path": "C:\\Windows\\System32\\svchost.exe",
"MD5": "8a0a29438052faed8a2532da50451234",
"Type": "8",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)"
},
{
"SHA1": "a1385ce20ad79f55df235effd9780c31442aa234",
"SHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6",
"Name": "svchost.exe",
"Extension": "exe",
"Hostname": "fidelis-endpoint-winserver2019",
"Size": 51696,
"Path": "C:\\Windows\\System32\\svchost.exe",
"MD5": "8a0a29438052faed8a2532da50451234",
"Type": "8",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)"
},
{
"SHA1": "a1385ce20ad79f55df235effd9780c31442aa234",
"SHA256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6",
"Name": "svchost.exe",
"Extension": "exe",
"Hostname": "fidelis-endpoint-winserver2019",
"Size": 51696,
"Path": "C:\\Windows\\System32\\svchost.exe",
"MD5": "8a0a29438052faed8a2532da50451234",
"Type": "8",
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)"
},
]
}
Human Readable Output
Fidelis Endpoint file hash query results
| EndpointName | Name | Path | Hash | ProcessStartTime | ParentName | EventType |
|---|---|---|---|---|---|---|
| fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | 8a0a29438052faed8a2532da50451234 | 2020-03-26T09:02:26.511Z | svchost.exe | 2 |
| fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | 8a0a29438052faed8a2532da50451234 | 2020-03-26T08:02:26.197Z | svchost.exe | 2 |
| fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | 8a0a29438052faed8a2532da50451234 | 2020-03-26T07:02:25.887Z | svchost.exe | 2 |
| fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | 8a0a29438052faed8a2532da50451234 | 2020-03-26T06:15:07.125Z | svchost.exe | 2 |
| fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | 8a0a29438052faed8a2532da50451234 | 2020-03-26T06:02:25.581Z | svchost.exe | 2 |
| fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | 8a0a29438052faed8a2532da50451234 | 2020-03-26T05:02:25.266Z | svchost.exe | 2 |
| fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | 8a0a29438052faed8a2532da50451234 | 2020-03-26T04:54:08.244Z | svchost.exe | 2 |
19. fidelis-endpoint-query-process
Query process.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-query-process
Input
| Argument Name | Description | Required |
|---|---|---|
| start_time | The start time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| end_time | The end time of the event in the system in UTC format. Supported values:”2019-10-21T23:45:00” (date). |
Optional |
| logic | The logic of the query. Can be “and” or “or”. | Required |
| process_name | The process name to query. | Required |
| limit | The maximum number of results to return. The default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Query.ProcessStartTime | String | Process start time. |
| FidelisEndpoint.Query.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Query.Path | String | The path of the process. |
| FidelisEndpoint.Query.ParentID | String | Process parent ID. |
| FidelisEndpoint.Query.EventTime | Date | Event time. |
| FidelisEndpoint.Query.PID | String | Process ID. |
| FidelisEndpoint.Query.Name | String | Process name. |
| FidelisEndpoint.Query.User | String | The user of the system. |
| FidelisEndpoint.Query.TargetID | String | Process target ID. |
| FidelisEndpoint.Query.Hash | String | File hash. |
| FidelisEndpoint.Query.StartTime | Date | Process start time. |
| FidelisEndpoint.Query.EventType | Number | Event type. |
| FidelisEndpoint.Query.ParentName | String | Process parent name. |
| FidelisEndpoint.Query.IndexingTime | Date | Indexing time. |
| FidelisEndpoint.Query.EntityType | Number | Entity type. |
Command Example
!fidelis-endpoint-query-process logic="and" process_name="svchost.exe"
Context Example
{
"FidelisEndpoint.Query": [
{
"EsDocumentType": "processlog",
"EventTime": "2020-03-26T09:02:26.511Z",
"IndexingTime": "2020-03-26T09:06:31.958Z",
"Hash": "8a0a29438052faed8a2532da50451234",
"Name": "svchost.exe",
"ParentName": "services.exe",
"EsIndex": "eh_20200326_1585180800000_0",
"EventType": 0,
"TargetID": "rSdnlXD7OX6",
"EntityType": 0,
"PID": 4432,
"ProcessStartTime": "2020-03-26T09:02:26.511Z",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "NT AUTHORITY\\SYSTEM",
"StartTime": "2020-03-26T09:02:26.511Z",
"ParentID": "TG9An342Ym8",
"Path": "C:\\Windows\\System32\\svchost.exe"
},
{
"EsDocumentType": "processlog",
"EventTime": "2020-03-26T08:02:26.197Z",
"IndexingTime": "2020-03-26T08:05:00.035Z",
"Hash": "8a0a29438052faed8a2532da50451234",
"Name": "svchost.exe",
"ParentName": "services.exe",
"EsIndex": "eh_20200326_1585180800000_0",
"EventType": 0,
"TargetID": "m31v1MqQ6",
"EntityType": 0,
"PID": 2084,
"ProcessStartTime": "2020-03-26T08:02:26.197Z",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "NT AUTHORITY\\SYSTEM",
"StartTime": "2020-03-26T08:02:26.197Z",
"ParentID": "TG9An342Ym8",
"Path": "C:\\Windows\\System32\\svchost.exe"
},
{
"EsDocumentType": "processlog",
"EventTime": "2020-03-26T07:02:25.887Z",
"IndexingTime": "2020-03-26T07:08:28.331Z",
"Hash": "8a0a29438052faed8a2532da50451234",
"Name": "svchost.exe",
"ParentName": "services.exe",
"EsIndex": "eh_20200326_1585180800000_0",
"EventType": 0,
"TargetID": "fmz4un6Qzfd",
"EntityType": 0,
"PID": 1972,
"ProcessStartTime": "2020-03-26T07:02:25.887Z",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "NT AUTHORITY\\SYSTEM",
"StartTime": "2020-03-26T07:02:25.887Z",
"ParentID": "TG9An342Ym8",
"Path": "C:\\Windows\\System32\\svchost.exe"
},
{
"EsDocumentType": "processlog",
"EventTime": "2020-03-26T06:15:07.125Z",
"IndexingTime": "2020-03-26T06:20:26.814Z",
"Hash": "8a0a29438052faed8a2532da50451234",
"Name": "svchost.exe",
"ParentName": "services.exe",
"EsIndex": "eh_20200326_1585180800000_0",
"EventType": 0,
"TargetID": "fS3SPnQU5Xe",
"EntityType": 0,
"PID": 656,
"ProcessStartTime": "2020-03-26T06:15:07.125Z",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "NT AUTHORITY\\NETWORK SERVICE",
"StartTime": "2020-03-26T06:15:07.125Z",
"ParentID": "TG9An342Ym8",
"Path": "C:\\Windows\\System32\\svchost.exe"
},
{
"EsDocumentType": "processlog",
"EventTime": "2020-03-25T19:02:22.160Z",
"IndexingTime": "2020-03-25T19:06:37.610Z",
"Hash": "8a0a29438052faed8a2532da50451234",
"Name": "svchost.exe",
"ParentName": "services.exe",
"EsIndex": "eh_20200325_1585094400000_0",
"EventType": 0,
"TargetID": "byvPk5D9Mdd",
"EntityType": 0,
"PID": 2692,
"ProcessStartTime": "2020-03-25T19:02:22.160Z",
"EndpointName": "fidelis-endpoint-winserver2019",
"User": "NT AUTHORITY\\SYSTEM",
"StartTime": "2020-03-25T19:02:22.160Z",
"ParentID": "TG9An342Ym8",
"Path": "C:\\Windows\\System32\\svchost.exe"
}
]
}
Human Readable Output
Fidelis Endpoint process results
| PID | EndpointName | Name | Path | User | Hash | ProcessStartTime | Parameters | ParentName | EventType |
|---|---|---|---|---|---|---|---|---|---|
| 4432 | fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | NT AUTHORITY\SYSTEM | 8a0a29438052faed8a2532da50451234 | 2020-03-26T09:02:26.511Z | C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc | services.exe | 0 |
| 2084 | fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | NT AUTHORITY\SYSTEM | 8a0a29438052faed8a2532da50451234 | 2020-03-26T08:02:26.197Z | C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc | services.exe | 0 |
| 1972 | fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | NT AUTHORITY\SYSTEM | 8a0a29438052faed8a2532da50451234 | 2020-03-26T07:02:25.887Z | C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc | services.exe | 0 |
| 656 | fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | NT AUTHORITY\NETWORK SERVICE | 8a0a29438052faed8a2532da50451234 | 2020-03-26T06:15:07.125Z | C:\Windows\System32\svchost.exe -k NetworkService -p -s DoSvc | services.exe | 0 |
| 1400 | fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | NT AUTHORITY\SYSTEM | 8a0a29438052faed8a2532da50451234 | 2020-03-26T06:02:25.581Z | C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc | services.exe | 0 |
| 2800 | fidelis-endpoint-winserver2019 | svchost.exe | C:\Windows\System32\svchost.exe | NT AUTHORITY\SYSTEM | 8a0a29438052faed8a2532da50451234 | 2020-03-26T05:02:25.266Z | C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc | services.exe | 0 |
20. fidelis-endpoint-query-connection-by-remote-ip
Queries a connection by remote IP address.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-query-connection-by-remote-ip
Input
| Argument Name | Description | Required |
|---|---|---|
| start_time | The start time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| end_time | The end time of the event in the system in UTC format. Supported values:”2019-10-21T23:45:00” (date). |
Optional |
| logic | The logic of the query. Can be “and” or “or”. | Required |
| remote_ip | The remote IP address on which to query. | Required |
| limit | The maximum number of results to return. The default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Query.ProcessStartTime | Date | Process start time. |
| FidelisEndpoint.Query.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Query.ParentID | String | Process parent ID. |
| FidelisEndpoint.Query.EventTime | Date | Event time. |
| FidelisEndpoint.Query.RemotePort | Number | Remote port. |
| FidelisEndpoint.Query.LocalPort | Number | Local port. |
| FidelisEndpoint.Query.TargetID | String | Target ID. |
| FidelisEndpoint.Query.RemoteIP | String | Remote IP address. |
| FidelisEndpoint.Query.StartTime | Date | Event start time. |
| FidelisEndpoint.Query.EndpointID | String | Endpoint ID. |
| FidelisEndpoint.Query.NetworkDirection | Number | Network direction. |
| FidelisEndpoint.Query.LastEventTime | Date | Last event time. |
| FidelisEndpoint.Query.LocalIP | String | Local IP address. |
| FidelisEndpoint.Query.EventType | Number | Event type. |
| FidelisEndpoint.Query.ParentName | String | Parent name. |
| FidelisEndpoint.Query.FirstEventTime | Date | First event time. |
| FidelisEndpoint.Query.EventIndex | Number | Event Index. |
| FidelisEndpoint.Query.Protocol | String | Protocol. |
| FidelisEndpoint.Query.PPID | Number | Process parent ID. |
| FidelisEndpoint.Query.EntityType | Number | Entity type. |
| FidelisEndpoint.Query.ParentHashSHA1 | String | Parent SHA1 hash. |
Command Example
!fidelis-endpoint-query-connection-by-remote-ip logic=and remote_ip=10.10.0.1 limit=5
Context Example
{
"FidelisEndpoint.Query": [
{
"RemotePort": "53",
"EventTime": "2020-03-26T09:32:31.172Z",
"ParentName": "svchost.exe",
"Protocol": "UDP",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"LastEventTime": "2020-03-26T09:32:31.172Z",
"FirstEventTime": "2020-03-26T09:28:31.148Z",
"EventType": 3,
"EntityType": 3,
"TargetID": "O6ZdOEYU2z8",
"ProcessStartTime": "2020-03-12T03:58:09.962Z",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 10,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "0",
"PPID": 1196,
"parentHashSHA1": "a1385ce20ad79f55df235effd9780c31442aa234",
"LocalPort": "64669"
},
{
"RemotePort": "53",
"EventTime": "2020-03-26T09:32:31.169Z",
"ParentName": "svchost.exe",
"Protocol": "UDP",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"LastEventTime": "2020-03-26T09:32:31.172Z",
"FirstEventTime": "2020-03-26T09:28:31.148Z",
"EventType": 3,
"EntityType": 3,
"TargetID": "Do8ec6zGCEi",
"ProcessStartTime": "2020-03-12T03:58:09.962Z",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 9,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "2",
"PPID": 1196,
"parentHashSHA1": "a1385ce20ad79f55df235effd9780c31442aa234",
"LocalPort": "64669"
},
{
"RemotePort": "53",
"EventTime": "2020-03-26T09:32:14.522Z",
"ParentName": "svchost.exe",
"Protocol": "UDP",
"EndpointID": "3494cb0f-67ba-41bc-9190-ab5d015dd57c",
"LastEventTime": "2020-03-26T09:32:31.172Z",
"FirstEventTime": "2020-03-26T09:28:31.148Z",
"EventType": 3,
"EntityType": 3,
"TargetID": "8825LGOTGzf",
"ProcessStartTime": "2020-03-12T03:58:09.962Z",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 8,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "0",
"PPID": 1196,
"parentHashSHA1": "a1385ce20ad79f55df235effd9780c31442aa234",
"LocalPort": "53557"
}
]
}
Human Readable Output
Fidelis Endpoint query results for connection by remote IP
| EndpointID | EndpointName | PPID | LocalIP | LocalPort | RemoteIP | RemotePort | ProcessStartTime | FirstEventTime | LastEventTime | Protocol | ParentHashSHA1 | ParentName | EventType |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 1196 | 2.2.2.2 | 64669 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | 2020-03-26T09:28:31.148Z | 2020-03-26T09:32:31.172Z | UDP | a1385ce20ad79f55df235effd9780c31442aa234 | svchost.exe | 3 |
| 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 1196 | 2.2.2.2 | 64669 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | 2020-03-26T09:28:31.148Z | 2020-03-26T09:32:31.172Z | UDP | a1385ce20ad79f55df235effd9780c31442aa234 | svchost.exe | 3 |
| 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 1196 | 2.2.2.2 | 53557 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | 2020-03-26T09:28:31.148Z | 2020-03-26T09:32:31.172Z | UDP | a1385ce20ad79f55df235effd9780c31442aa234 | svchost.exe | 3 |
| 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 1196 | 2.2.2.2 | 53557 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | 2020-03-26T09:28:31.148Z | 2020-03-26T09:32:31.172Z | UDP | a1385ce20ad79f55df235effd9780c31442aa234 | svchost.exe | 3 |
| 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 1196 | 2.2.2.2 | 60427 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | 2020-03-26T09:28:31.148Z | 2020-03-26T09:32:31.172Z | UDP | a1385ce20ad79f55df235effd9780c31442aa234 | svchost.exe | 3 |
| 3494cb0f-67ba-41bc-9190-ab5d015dd57c | fidelis-endpoint-winserver2019 | 1196 | 2.2.2.2 | 60427 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | 2020-03-26T09:28:31.148Z | 2020-03-26T09:32:31.172Z | UDP | a1385ce20ad79f55df235effd9780c31442aa234 | svchost.exe | 3 |
21. fidelis-endpoint-query-by-dns
Queries by DNS request.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-query-by-dns
Input
| Argument Name | Description | Required |
|---|---|---|
| start_time | The start time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| end_time | The end time of the event in the system in UTC format. Supported values:”2019-10-21T23:45:00” (date). |
Optional |
| logic | The logic of the query. Can be “and” or “or”. | Required |
| url | URL or domain on which to query. | Required |
| limit | The maximum number of results to return. The default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Query.ProcessStartTime | Date | Process start time. |
| FidelisEndpoint.Query.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Query.ParentID | String | Parent ID. |
| FidelisEndpoint.Query.EventTime | Date | Event time. |
| FidelisEndpoint.Query.RemotePort | Number | Remote port. |
| FidelisEndpoint.Query.DnsAnswer | String | The DNS answer. |
| FidelisEndpoint.Query.LocalPort | Number | Local port. |
| FidelisEndpoint.Query.TargetID | String | The target ID. |
| FidelisEndpoint.Query.RemoteIP | String | Remote IP address. |
| FidelisEndpoint.Query.DnsQuestion | String | The DNS question. |
| FidelisEndpoint.Query.StartTime | Date | Event start time. |
| FidelisEndpoint.Query.NetworkDirection | Number | Network direction. |
| FidelisEndpoint.Query.LocalIP | String | Local IP address. |
| FidelisEndpoint.Query.EventType | Number | Event type. |
| FidelisEndpoint.Query.EventIndex | Number | Event index. |
| FidelisEndpoint.Query.IndexingTime | Date | Indexing time. |
| FidelisEndpoint.Query.EntityType | Number | Entity type. |
Command Example
!fidelis-endpoint-query-by-dns start_time="2019-10-02T00:00:00.842Z" end_time="2020-03-08T15:50:05.552Z" logic="and" url="login.live.com"
Context Example
{
"FidelisEndpoint.Query": [
{
"RemotePort": "53",
"EventTime": "2020-03-08T06:13:14.009Z",
"IndexingTime": "2020-03-08T06:21:15.635Z",
"LocalPort": "49862",
"EventType": 17,
"EntityType": 6,
"TargetID": "UmDG80sJNc6",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 6,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"login.msa.msidentity.com\",\"IP\":\"\",\"TTL\":\"299\"},{\"name\":\"login.msa.msidentity.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"login.msa.akadns6.net\",\"IP\":\"\",\"TTL\":\"299\"},{\"name\":\"login.msa.akadns6.net\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"ipv4.login.msa.akadns6.net\",\"IP\":\"\",\"TTL\":\"299\"},{\"name\":\"ipv4.login.msa.akadns6.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"3.3.3.3\",\"TTL\":\"299\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-08T03:55:54.514Z",
"IndexingTime": "2020-03-08T04:03:12.475Z",
"LocalPort": "53712",
"EventType": 17,
"EntityType": 6,
"TargetID": "UmDG80sJNc6",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"login.msa.msidentity.com\",\"IP\":\"\",\"TTL\":\"51\"},{\"name\":\"login.msa.msidentity.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"lgin.msa.trafficmanager.net\",\"IP\":\"\",\"TTL\":\"51\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"2.2.2.2\",\"TTL\":\"59\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"3.3.3.3\",\"TTL\":\"59\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"4.4.4.4\",\"TTL\":\"59\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-08T03:11:13.833Z",
"IndexingTime": "2020-03-08T03:17:38.628Z",
"LocalPort": "61574",
"EventType": 17,
"EntityType": 6,
"TargetID": "UmDG80sJNc6",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 5,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"login.msa.msidentity.com\",\"IP\":\"\",\"TTL\":\"230\"},{\"name\":\"login.msa.msidentity.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"lgin.msa.trafficmanager.net\",\"IP\":\"\",\"TTL\":\"235\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"3.3.3.3\",\"TTL\":\"56\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"2.2.2.2\",\"TTL\":\"56\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"7.7.7.7\",\"TTL\":\"56\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-07T21:53:12.298Z",
"IndexingTime": "2020-03-07T21:57:29.402Z",
"LocalPort": "57803",
"EventType": 17,
"EntityType": 6,
"TargetID": "UmDG80sJNc6",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 4,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"login.live.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"login.msa.msidentity.com\",\"IP\":\"\",\"TTL\":\"16\"},{\"name\":\"login.msa.msidentity.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"lgin.msa.trafficmanager.net\",\"IP\":\"\",\"TTL\":\"197\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"3.3.3.3\",\"TTL\":\"59\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"2.2.2.2\",\"TTL\":\"59\"},{\"name\":\"lgin.msa.trafficmanager.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"7.7.7.7\",\"TTL\":\"59\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
}
]
}
Human Readable Output
Fidelis Endpoint query results for the DNS request
| EndpointName | LocalIP | LocalPort | RemoteIP | RemotePort | ProcessStartTime | DnsAnswer | EventType |
|---|---|---|---|---|---|---|---|
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 49862 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_answers”:[{“name”:”login.live.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.msidentity.com”,”IP”:””,”TTL”:”299”},{“name”:”login.msa.msidentity.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.akadns6.net”,”IP”:””,”TTL”:”299”},{“name”:”login.msa.akadns6.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”ipv4.login.msa.akadns6.net”,”IP”:””,”TTL”:”299”},{“name”:”ipv4.login.msa.akadns6.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”299”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 53712 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_answers”:[{“name”:”login.live.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.msidentity.com”,”IP”:””,”TTL”:”51”},{“name”:”login.msa.msidentity.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”lgin.msa.trafficmanager.net”,”IP”:””,”TTL”:”51”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”2.2.2.2”,”TTL”:”59”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”59”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”4.4.4.4”,”TTL”:”59”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 61574 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_answers”:[{“name”:”login.live.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.msidentity.com”,”IP”:””,”TTL”:”230”},{“name”:”login.msa.msidentity.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”lgin.msa.trafficmanager.net”,”IP”:””,”TTL”:”235”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”56”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”2.2.2.2”,”TTL”:”56”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”7.7.7.7”,”TTL”:”56”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 57803 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_answers”:[{“name”:”login.live.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.msidentity.com”,”IP”:””,”TTL”:”16”},{“name”:”login.msa.msidentity.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”lgin.msa.trafficmanager.net”,”IP”:””,”TTL”:”197”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”59”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”59”},{“name”:”lgin.msa.trafficmanager.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”7.7.7.7”,”TTL”:”59”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 58656 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_answers”:[{“name”:”login.live.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.msidentity.com”,”IP”:””,”TTL”:”288”},{“name”:”login.msa.msidentity.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.akadns6.net”,”IP”:””,”TTL”:”288”},{“name”:”login.msa.akadns6.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”ipv4.login.msa.akadns6.net”,”IP”:””,”TTL”:”288”},{“name”:”ipv4.login.msa.akadns6.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”2.2.2.20”,”TTL”:”123”},{“name”:”ipv4.login.msa.akadns6.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”7.7.7.7”,”TTL”:”123”},{“name”:”ipv4.login.msa.akadns6.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”10.10.10.10”,”TTL”:”123”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 59564 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_answers”:[{“name”:”login.live.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.msidentity.com”,”IP”:””,”TTL”:”238”},{“name”:”login.msa.msidentity.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”login.msa.akadns6.net”,”IP”:””,”TTL”:”238”},{“name”:”login.msa.akadns6.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”ipv4.login.msa.akadns6.net”,”IP”:””,”TTL”:”238”},{“name”:”ipv4.login.msa.akadns6.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”238”},{“name”:”ipv4.login.msa.akadns6.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”7.7.7.7”,”TTL”:”238”},{“name”:”ipv4.login.msa.akadns6.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”10.10.10.10”,”TTL”:”238”}]} | 17 |
22. fidelis-endpoint-query-dns-by-server-ip
Queries DNS by server IP address.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-query-dns-by-server-ip
Input
| Argument Name | Description | Required |
|---|---|---|
| start_time | The start time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| end_time | The end time of the event in the system in UTC format. Supported values:”2019-10-21T23:45:00” (date). |
Optional |
| logic | The logic of the query. Can be “and” or “or”. | Required |
| remote_ip | The remote IP on which to query. | Required |
| limit | The maximum number of results to return. The default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Query.ProcessStartTime | Date | Process start time. |
| FidelisEndpoint.Query.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Query.ParentID | String | Parent ID. |
| FidelisEndpoint.Query.EventTime | Date | Event time. |
| FidelisEndpoint.Query.RemotePort | Number | Remote port. |
| FidelisEndpoint.Query.DnsAnswer | String | The DNS answer. |
| FidelisEndpoint.Query.LocalPort | Number | Local port. |
| FidelisEndpoint.Query.TargetID | String | The target ID. |
| FidelisEndpoint.Query.RemoteIP | String | Remote IP address. |
| FidelisEndpoint.Query.DnsQuestion | String | The DNS question. |
| FidelisEndpoint.Query.StartTime | Date | Event start time. |
| FidelisEndpoint.Query.NetworkDirection | Number | Network direction. |
| FidelisEndpoint.Query.LocalIP | String | Local IP address. |
| FidelisEndpoint.Query.EventType | Number | Event type. |
| FidelisEndpoint.Query.EventIndex | Number | Event index. |
| FidelisEndpoint.Query.IndexingTime | Date | Indexing time. |
| FidelisEndpoint.Query.EntityType | Number | Entity type. |
Command Example
!fidelis-endpoint-query-dns-by-server-ip logic="or" remote_ip="10.10.0.1"
Context Example
{
"FidelisEndpoint.Query": [
{
"RemotePort": "53",
"EventTime": "2020-03-26T09:29:07.671Z",
"IndexingTime": "2020-03-26T09:36:32.819Z",
"LocalPort": "61597",
"EventType": 17,
"EntityType": 6,
"TargetID": "9anFqxCrJ3h",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"v10.events.data.microsoft.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 4,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"v10.events.data.microsoft.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"global.events.data.trafficmanager.net\",\"IP\":\"\",\"TTL\":\"1425\"},{\"name\":\"global.events.data.trafficmanager.net\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"skypedataprdcoleus06.cloudapp.net\",\"IP\":\"\",\"TTL\":\"45\"},{\"name\":\"skypedataprdcoleus06.cloudapp.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"10.10.10.10\",\"TTL\":\"5\"}]}",
"ProcessStartTime": "2020-03-12T03:58:09.962Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-26T09:14:07.314Z",
"IndexingTime": "2020-03-26T09:18:31.967Z",
"LocalPort": "55911",
"EventType": 17,
"EntityType": 6,
"TargetID": "9anFqxCrJ3h",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"v10.events.data.microsoft.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"v10.events.data.microsoft.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"global.events.data.trafficmanager.net\",\"IP\":\"\",\"TTL\":\"1390\"},{\"name\":\"global.events.data.trafficmanager.net\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"skypedataprdcolcus00.cloudapp.net\",\"IP\":\"\",\"TTL\":\"25\"},{\"name\":\"skypedataprdcolcus00.cloudapp.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"2.2.2.2\",\"TTL\":\"9\"}]}",
"ProcessStartTime": "2020-03-12T03:58:09.962Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-26T09:01:55.586Z",
"IndexingTime": "2020-03-26T09:06:31.755Z",
"LocalPort": "56095",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 4,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"144\"}]}",
"ProcessStartTime": "2020-03-12T03:58:09.962Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-26T08:59:06.523Z",
"IndexingTime": "2020-03-26T09:02:31.650Z",
"LocalPort": "61769",
"EventType": 17,
"EntityType": 6,
"TargetID": "9anFqxCrJ3h",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"v10.events.data.microsoft.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"v10.events.data.microsoft.com\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"global.events.data.trafficmanager.net\",\"IP\":\"\",\"TTL\":\"862\"},{\"name\":\"global.events.data.trafficmanager.net\",\"class\":\"IN\",\"type\":\"CNAME\",\"alias\":\"skypedataprdc.cloudapp.net\",\"IP\":\"\",\"TTL\":\"19\"},{\"name\":\"skypedataprdcolase00.cloudapp.net\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"3.3.3.3\",\"TTL\":\"9\"}]}",
"ProcessStartTime": "2020-03-12T03:58:09.962Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-26T08:44:30.882Z",
"IndexingTime": "2020-03-26T08:50:31.264Z",
"LocalPort": "53940",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-12T03:58:09.962Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 5,
"ParentID": "jE4aX1xPk1i",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"274\"}]}",
"ProcessStartTime": "2020-03-12T03:58:09.962Z"
}
]
}
Human Readable Output
Fidelis Endpoint query results for the DNS request by server IP
| EndpointName | LocalIP | LocalPort | RemoteIP | RemotePort | ProcessStartTime | DnsAnswer | EventType |
|---|---|---|---|---|---|---|---|
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 61597 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”v10.events.data.microsoft.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”global.events.data.trafficmanager.net”,”IP”:””,”TTL”:”1425”},{“name”:”global.events.data.trafficmanager.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”skypedataprdcoleus06.cloudapp.net”,”IP”:””,”TTL”:”45”},{“name”:”skypedataprdcoleus06.cloudapp.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”2.2.2.2”,”TTL”:”5”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 55911 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”v10.events.data.microsoft.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”global.events.data.trafficmanager.net”,”IP”:””,”TTL”:”1390”},{“name”:”global.events.data.trafficmanager.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”skypedataprdcolcus00.cloudapp.net”,”IP”:””,”TTL”:”25”},{“name”:”skypedataprdcolcus00.cloudapp.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”9”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 56095 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”144”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 61769 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”v10.events.data.microsoft.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”global.events.data.trafficmanager.net”,”IP”:””,”TTL”:”862”},{“name”:”global.events.data.trafficmanager.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”skypedataprdcolase00.cloudapp.net”,”IP”:””,”TTL”:”19”},{“name”:”skypedataprdcolase00.cloudapp.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”4.4.4.4”,”TTL”:”9”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 53940 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”274”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 57260 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”v10.events.data.microsoft.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”global.events.data.trafficmanager.net”,”IP”:””,”TTL”:”1698”},{“name”:”global.events.data.trafficmanager.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”skypedataprdcolneu00.cloudapp.net”,”IP”:””,”TTL”:”21”},{“name”:”skypedataprdcolneu00.cloudapp.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”7.7.7.7”,”TTL”:”9”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 58832 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”206”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 60472 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”v10.events.data.microsoft.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”global.events.data.trafficmanager.net”,”IP”:””,”TTL”:”3334”},{“name”:”global.events.data.trafficmanager.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”skypedataprdcolweu05.cloudapp.net”,”IP”:””,”TTL”:”58”},{“name”:”skypedataprdcolweu05.cloudapp.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”10.10.0.1”,”TTL”:”8”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 54309 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”v10.events.data.microsoft.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”global.events.data.trafficmanager.net”,”IP”:””,”TTL”:”2327”},{“name”:”global.events.data.trafficmanager.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”skypedataprdcoluks05.cloudapp.net”,”IP”:””,”TTL”:”44”},{“name”:”skypedataprdcoluks05.cloudapp.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”10.10.0.1”,”TTL”:”7”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 61757 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”3.3.3.3”,”TTL”:”273”}]} | 17 |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 49681 | 10.10.0.1 | 53 | 2020-03-12T03:58:09.962Z | {“dns_answers”:[{“name”:”v10.events.data.microsoft.com”,”class”:”IN”,”type”:”CNAME”,”alias”:”global.events.data.trafficmanager.net”,”IP”:””,”TTL”:”798”},{“name”:”global.events.data.trafficmanager.net”,”class”:”IN”,”type”:”CNAME”,”alias”:”skypedataprdcolwus08.cloudapp.net”,”IP”:””,”TTL”:”40”},{“name”:”fe2.update.microsoft.com.nsatc.net”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”10.10.0.1”,”TTL”:”175”}]} | 17 |
23. fidelis-endpoint-query-dns-by-source-ip
Queries DNS by source IP address.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-query-dns-by-source-ip
Input
| Argument Name | Description | Required |
|---|---|---|
| start_time | The start time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| end_time | The end time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| logic | The logic of the query. Can be “and” or “or”. | Required |
| source_ip | The source IP address to query. | Required |
| domain | The domain to query. | Optional |
| limit | The maximum number of results to return. The default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Query.ProcessStartTime | Date | Process start time. |
| FidelisEndpoint.Query.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Query.ParentID | String | Parent ID. |
| FidelisEndpoint.Query.EventTime | Date | Event time. |
| FidelisEndpoint.Query.RemotePort | Number | Remote port. |
| FidelisEndpoint.Query.DnsAnswer | String | The DNS answer. |
| FidelisEndpoint.Query.LocalPort | Number | Local port. |
| FidelisEndpoint.Query.TargetID | String | The target ID. |
| FidelisEndpoint.Query.RemoteIP | String | Remote IP address. |
| FidelisEndpoint.Query.DnsQuestion | String | The DNS question. |
| FidelisEndpoint.Query.StartTime | Date | Event start time. |
| FidelisEndpoint.Query.NetworkDirection | Number | Network direction. |
| FidelisEndpoint.Query.LocalIP | String | Local IP address. |
| FidelisEndpoint.Query.EventType | Number | Event type. |
| FidelisEndpoint.Query.EventIndex | Number | Event index. |
| FidelisEndpoint.Query.IndexingTime | Date | Indexing time. |
| FidelisEndpoint.Query.EntityType | Number | Entity type. |
Command Example
!fidelis-endpoint-query-dns-by-source-ip start_time="2020-01-01T00:00:00.842Z" end_time="2020-03-08T15:50:05.552Z" logic="or" source_ip="10.128.0.4" domain="logging.googleapis.com" limit=5
Context Example
{
"FidelisEndpoint.Query": [
{
"RemotePort": "53",
"EventTime": "2020-03-08T12:21:34.260Z",
"IndexingTime": "2020-03-08T12:26:25.293Z",
"LocalPort": "51663",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"87\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-08T12:18:33.199Z",
"IndexingTime": "2020-03-08T12:23:25.135Z",
"LocalPort": "65002",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"105\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-08T11:17:33.908Z",
"IndexingTime": "2020-03-08T11:25:23.700Z",
"LocalPort": "49412",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"253\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-08T11:05:33.831Z",
"IndexingTime": "2020-03-08T11:11:23.189Z",
"LocalPort": "63755",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"282\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-08T09:54:32.087Z",
"IndexingTime": "2020-03-08T09:59:21.585Z",
"LocalPort": "60331",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 5,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"61\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
},
{
"RemotePort": "53",
"EventTime": "2020-03-08T09:53:33.246Z",
"IndexingTime": "2020-03-08T09:59:21.585Z",
"LocalPort": "58452",
"EventType": 17,
"EntityType": 6,
"TargetID": "VqzBXZZVzjd",
"DnsQuestion": "{\"dns_questions\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\"}]}",
"LocalIP": "2.2.2.2",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-02-13T03:50:45.515Z",
"RemoteIP": "10.10.0.1",
"EventIndex": 2,
"ParentID": "VuFd4n1aut7",
"NetworkDirection": "0",
"DnsAnswer": "{\"dns_answers\":[{\"name\":\"logging.googleapis.com\",\"class\":\"IN\",\"type\":\"A\",\"alias\":\"\",\"IP\":\"6.6.6.6\",\"TTL\":\"12\"}]}",
"ProcessStartTime": "2020-02-13T03:50:45.515Z"
}
]
}
Human Readable Output
Fidelis Endpoint query results for the DNS request by source IP
| EndpointName | LocalIP | LocalPort | RemoteIP | RemotePort | ProcessStartTime | DnsQuestion | DnsAnswer |
|---|---|---|---|---|---|---|---|
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 51663 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_questions”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”}]} | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”6.6.6.6”,”TTL”:”87”}]} |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 65002 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_questions”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”}]} | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”6.6.6.6”,”TTL”:”105”}]} |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 49412 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_questions”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”}]} | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”6.6.6.6”,”TTL”:”253”}]} |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 63755 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_questions”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”}]} | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”6.6.6.6”,”TTL”:”282”}]} |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 60331 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_questions”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”}]} | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”6.6.6.6”,”TTL”:”61”}]} |
| fidelis-endpoint-winserver2019 | 2.2.2.2 | 58452 | 10.10.0.1 | 53 | 2020-02-13T03:50:45.515Z | {“dns_questions”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”}]} | {“dns_answers”:[{“name”:”logging.googleapis.com”,”class”:”IN”,”type”:”A”,”alias”:””,”IP”:”6.6.6.6”,”TTL”:”12”}]} |
24. fidelis-endpoint-query-events
Queries events.
Required Permissions
The required permissions: Read groups, View Behaviors, View Task Results
Base Command
fidelis-endpoint-query-events
Input
| Argument Name | Description | Required |
|---|---|---|
| start_time | The start time of the event in the system in UTC format. Supported values: “2019-10-21T23:45:00” (date). |
Optional |
| end_time | The end time of the event in the system in UTC format. Supported values:”2019-10-21T23:45:00” (date). |
Optional |
| logic | The logic of the query. Can be “and” or “or”. | Required |
| entity_type | Query entity type. Can be “antiMalware”, “dns”, “file”, “network”, “process”, “registry”, “remoteThread”, “script”, “usb”, or “windowsevent”. | Required |
| column | Column to query. For example: hash, name, remoteIP, dnsQuestion, localIP. | Required |
| value | The value to query. Can be an IP address, file hash, file path, and so on. | Required |
| operator | The operator, which describes how the “value” relates to the “field” (for example: “=”, “!=”, “>”, “<”). | Required |
| limit | The maximum number of results to return. The default is 50. | Optional |
| additional_filter | An additional filter to use in the query. For example: pid = 1234, pid > 1233. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| FidelisEndpoint.Query.ProcessStartTime | Date | Process start time. |
| FidelisEndpoint.Query.EndpointName | String | Endpoint name. |
| FidelisEndpoint.Query.Path | String | File path. |
| FidelisEndpoint.Query.ParentID | String | Parent ID. |
| FidelisEndpoint.Query.EventTime | Date | Event time. |
| FidelisEndpoint.Query..RemotePort | Number | Remote port. |
| FidelisEndpoint.Query.DnsAnswer | String | DNS answer. |
| FidelisEndpoint.Query.PID | Number | Process ID. |
| FidelisEndpoint.Query.Name | String | Process name. |
| FidelisEndpoint.Query.User | String | Endpoint user. |
| FidelisEndpoint.Query.LocalPort | Number | Local port. |
| FidelisEndpoint.Query.TargetID | String | Target ID. |
| FidelisEndpoint.Query.RemoteIP | String | Remote IP address. |
| FidelisEndpoint.Query.Hash | String | File hash. |
| FidelisEndpoint.Query.DnsQuestion | String | DNS question. |
| FidelisEndpoint.Query.StartTime | Date | Start time of the event. |
| FidelisEndpoint.Query.Entropy | Number | Entropy. |
| FidelisEndpoint.Query.LocalIP | String | Local IP address. |
| FidelisEndpoint.Query.EventType | Number | Event type. |
| FidelisEndpoint.Query.ParentName | String | Parent name. |
| FidelisEndpoint.Query.EventIndex | Number | Event index. |
| FidelisEndpoint.Query.IndexingTime | Date | Indexing time. |
| FidelisEndpoint.Query.EntityType | Number | Entity type. |
Command Example
!fidelis-endpoint-query-events column=name entity_type=process logic=or value=cmd.exe additional_filter="pid = 3276" operator="="
Context Example
{
"FidelisEndpoint.Query": [
{
"EntityType": 0,
"TargetID": "qgOl6OBq7v8",
"LocalIP": null,
"RemotePort": null,
"ProcessStartTime": "2020-03-26T09:25:53.122Z",
"IndexingTime": "2020-03-26T09:30:32.434Z",
"Hash": "975b45b669930b0cc773eaf2b412345f",
"LocalPort": null,
"EventType": 0,
"ParentName": "endpoint.exe",
"PID": 908,
"DnsQuestion": null,
"User": "NT AUTHORITY\\SYSTEM",
"EventIndex": null,
"Path": "C:\\Windows\\System32\\cmd.exe",
"DnsAnswer": null,
"RemoteIP": null,
"EventTime": "2020-03-26T09:25:53.122Z",
"Name": "cmd.exe",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-26T09:25:53.122Z",
"ParentID": "MKH6hK7yr75"
},
{
"EntityType": 0,
"TargetID": "w8qh7ogIf8l",
"LocalIP": null,
"RemotePort": null,
"ProcessStartTime": "2020-03-26T09:25:39.883Z",
"IndexingTime": "2020-03-26T09:30:32.878Z",
"Hash": "975b45b669930b0cc773eaf2b412345f",
"LocalPort": null,
"EventType": 0,
"ParentName": "endpoint.exe",
"PID": 3376,
"DnsQuestion": null,
"User": "NT AUTHORITY\\SYSTEM",
"EventIndex": null,
"Path": "C:\\Windows\\System32\\cmd.exe",
"DnsAnswer": null,
"RemoteIP": null,
"EventTime": "2020-03-26T09:25:39.883Z",
"Name": "cmd.exe",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-26T09:25:39.883Z",
"ParentID": "MKH6hK7yr75"
},
{
"EntityType": 0,
"TargetID": "SSDiQFEHvNg",
"LocalIP": null,
"RemotePort": null,
"ProcessStartTime": "2020-03-26T09:08:23.233Z",
"IndexingTime": "2020-03-26T09:12:32.225Z",
"Hash": "975b45b669930b0cc773eaf2b412345f",
"LocalPort": null,
"EventType": 0,
"ParentName": "endpoint.exe",
"PID": 2804,
"DnsQuestion": null,
"User": "NT AUTHORITY\\SYSTEM",
"EventIndex": null,
"Path": "C:\\Windows\\System32\\cmd.exe",
"DnsAnswer": null,
"RemoteIP": null,
"EventTime": "2020-03-26T09:08:23.233Z",
"Name": "cmd.exe",
"EndpointName": "fidelis-endpoint-winserver2019",
"StartTime": "2020-03-26T09:08:23.233Z",
"ParentID": "MKH6hK7yr75"
}
]
}
Human Readable Output
Fidelis Endpoint query events result
|PID|EndpointName|User|ProcessStartTime|ParentID|EventType|
|—|—|—|—|—|—|
| 908 | fidelis-endpoint-winserver2019 | NT AUTHORITY\SYSTEM | 2020-03-26T09:25:53.122Z | MKH6hK7yr75 | 0 |
| 3376 | fidelis-endpoint-winserver2019 | NT AUTHORITY\SYSTEM | 2020-03-26T09:25:39.883Z | MKH6hK7yr75 | 0 |
| 2804 | fidelis-endpoint-winserver2019 | NT AUTHORITY\SYSTEM | 2020-03-26T09:08:23.233Z | MKH6hK7yr75 | 0 |
24 Packs/FidelisEndpoint/pack_metadata.json
Configuration parameters
url— Server URL (e.g. https://abcde.fideliscloud.com/) (required)credentials— Username (required)incidentType— Incident typeincidentFetchInterval— Incidents Fetch IntervalisFetch— Fetch incidentsfetch_time— First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)fetch_limit— Fetch limit (minimum 5)insecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (24)
-
fidelis-endpoint-delete-fileDeletes a file at the specified path.
-
fidelis-endpoint-delete-file-search-jobRemoves the job to free up space on the server.
-
fidelis-endpoint-execute-scriptExecutes a script package from Fidelis endpoint packages.
-
fidelis-endpoint-file-searchSearches for files on multiple hosts, using file hash, file extension, file size, and other search criteria.
-
fidelis-endpoint-file-search-result-metadataGets the job results metadata. The maximum is 50 results.
-
fidelis-endpoint-file-search-statusGets the file search job status.
-
fidelis-endpoint-get-fileGets the file stream and download the file.
-
fidelis-endpoint-get-script-manifestGets the script manifest.
-
fidelis-endpoint-get-script-resultGets script job results.
-
fidelis-endpoint-host-infoSearches for endpoints based on an IP address or hostname.
-
fidelis-endpoint-isolate-networkQuarantines an endpoint. While isolated, the endpoint's network communication is restricted to only the allowed servers.
-
fidelis-endpoint-kill-processTerminates the process that matches the required parameter's process ID.
-
fidelis-endpoint-list-alertsReturns all alerts in the system.
-
fidelis-endpoint-list-processesGets a list all processes according to the OS system.
-
fidelis-endpoint-list-scriptsGets a list of all script packages.
-
fidelis-endpoint-query-by-dnsQueries by DNS request.
-
fidelis-endpoint-query-connection-by-remote-ipQueries a connection by remote IP address.
-
fidelis-endpoint-query-dns-by-server-ipQueries DNS by server IP address.
-
fidelis-endpoint-query-dns-by-source-ipQueries DNS by source IP address.
-
fidelis-endpoint-query-eventsQueries events.
-
fidelis-endpoint-query-fileQueries a file by file hash.
-
fidelis-endpoint-query-processQuery process.
-
fidelis-endpoint-remove-network-isolationRemoves the endpoint from isolation.
-
fidelis-endpoint-script-job-statusGets the script execution status.
category: Endpoint sectionorder: - Connect - Collect provider: Skyview Capital commonfields: id: Fidelis EDR version: -1 configuration: - display: Server URL (e.g. https://abcde.fideliscloud.com/) name: url required: true type: 0 section: Connect - display: Username name: credentials required: true type: 9 section: Connect - display: Incident type name: incidentType type: 13 required: false section: Collect - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 advanced: true section: Collect - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - defaultvalue: 3 days display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year) name: fetch_time type: 0 required: false section: Collect - defaultvalue: '50' display: Fetch limit (minimum 5) name: fetch_limit type: 0 required: false section: Collect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect description: Use the Fidelis Endpoint integration for advanced endpoint detection and response (EDR) across Windows, Mac and Linux OSes for faster threat remediation. display: Fidelis EDR name: Fidelis EDR script: commands: - arguments: - defaultValue: '50' description: The maximum number of alerts to return. name: limit - description: |- Sorts the result before applying take and skip. Can be any property name of the alert object. For example: "insertionDate Descending". name: sort - description: 'The start of the time range of returned values in UTC format. For example: 0001-01-01T00:00:00Z.' name: start_date - description: 'The end of the time range of returned values in UTC format. For example: 0001-01-01T00:00:00Z.' name: end_date description: Returns all alerts in the system. name: fidelis-endpoint-list-alerts outputs: - contextPath: FidelisEndpoint.Alert.EndpointName description: Endpoint name. type: String - contextPath: FidelisEndpoint.Alert.IntelName description: Intel name. type: String - contextPath: FidelisEndpoint.Alert.HasJob description: Whether the alert has an open job. type: Boolean - contextPath: FidelisEndpoint.Alert.EventTime description: Alert event time. type: Date - contextPath: FidelisEndpoint.Alert.ActionsTaken description: The actions taken for this alert. type: String - contextPath: FidelisEndpoint.Alert.CreateDate description: Alert creation date. type: Date - contextPath: FidelisEndpoint.Alert.ParentEventID description: Parent event ID. type: String - contextPath: FidelisEndpoint.Alert.Name description: Alert name. type: String - contextPath: FidelisEndpoint.Alert.ReportID description: Report ID. type: String - contextPath: FidelisEndpoint.Alert.EndpointID description: Endpoint ID. type: String - contextPath: FidelisEndpoint.Alert.IntelID description: Intel ID. type: String - contextPath: FidelisEndpoint.Alert.Name description: Alert Name. type: String - contextPath: FidelisEndpoint.Alert.EventType description: Event Type. type: Number - contextPath: FidelisEndpoint.Alert.EventID description: Event ID. type: String - contextPath: FidelisEndpoint.Alert.SourceType description: Source type. type: Number - contextPath: FidelisEndpoint.Alert.AgentTag description: Agent tag. type: String - contextPath: FidelisEndpoint.Alert.EventIndex description: Event index. type: Number - contextPath: FidelisEndpoint.Alert.Telemetry description: Telemetry data. type: String - contextPath: FidelisEndpoint.Alert.Source description: Alert source. type: String - contextPath: FidelisEndpoint.Alert.ID description: Alert ID. type: Number - contextPath: FidelisEndpoint.Alert.ValidatedDate description: Validation date. type: Date - contextPath: FidelisEndpoint.Alert.Description description: Alert description. type: String - contextPath: FidelisEndpoint.Alert.InsertionDate description: Alert insertion date. type: Date - contextPath: FidelisEndpoint.Alert.Severity description: Alert severity. type: Number - contextPath: FidelisEndpoint.Alert.ArtifactName description: Artifact name. type: String - arguments: - description: The IP address to search for. name: ip_address - description: The host name to search for. name: host description: Searches for endpoints based on an IP address or hostname. name: fidelis-endpoint-host-info outputs: - contextPath: FidelisEndpoint.Host.AgentVersion description: The agent version. type: String - contextPath: FidelisEndpoint.Host.MacAddress description: Host MAC address. type: String - contextPath: FidelisEndpoint.Host.OS description: Endpoint OS. type: String - contextPath: FidelisEndpoint.Host.IPAddress description: Endpoint IP address. type: String - contextPath: FidelisEndpoint.Host.Isolated description: Whether the endpoint is isolated. type: Boolean - contextPath: FidelisEndpoint.Host.AV_Enabled description: Whether AV is enabled. type: Boolean - contextPath: FidelisEndpoint.Host.Hostname description: Host name. type: String - contextPath: FidelisEndpoint.Host.AgentInstalled description: Whether an agent was installed. type: Boolean - contextPath: FidelisEndpoint.Host.Groups description: Endpoint groups. type: String - contextPath: FidelisEndpoint.Host.LastContactDate description: Host last contact date. type: Date - contextPath: FidelisEndpoint.Host.ID description: Host ID. type: String - contextPath: FidelisEndpoint.Host.ProcessorName description: Processor name. type: String - contextPath: FidelisEndpoint.Host.OnNetwork description: Whether the host is on the network. type: Boolean - arguments: - description: A comma-separated list of hosts in which to search for the specified file. isArray: true name: host - description: A comma-separated list MD5 hashes to search for. Get the hashes from the queries commands. isArray: true name: md5 required: true - description: The file extension. name: file_extension - description: The file path (recommended to lower the search time). name: file_path - defaultValue: '100' description: The file size greater than. The default is 100. name: file_size description: Searches for files on multiple hosts, using file hash, file extension, file size, and other search criteria. name: fidelis-endpoint-file-search outputs: - contextPath: FidelisEndpoint.FileSearch.JobID description: The job ID. type: String - contextPath: FidelisEndpoint.FileSearch.JobResultID description: The job result ID. type: String - arguments: - description: The job ID. Get the ID from the file-search command. name: job_id required: true - description: The job result ID. Get the ID from the file-search command. name: job_result_id required: true description: Gets the file search job status. name: fidelis-endpoint-file-search-status outputs: - contextPath: FidelisEndpoint.FileSearch.JobID description: The file search job ID. type: String - contextPath: FidelisEndpoint.FileSearch.JobResultID description: Job result ID. type: String - contextPath: FidelisEndpoint.FileSearch.Status description: Job status. type: String - arguments: - description: The job ID. Get the job ID from the file-search command. name: job_id required: true - description: The job result ID. Get the job result ID from the file-search command. name: job_result_id required: true description: Gets the job results metadata. The maximum is 50 results. name: fidelis-endpoint-file-search-result-metadata outputs: - contextPath: FidelisEndpoint.File.AgentID description: Agent ID. type: String - contextPath: FidelisEndpoint.File.FileName description: File name. type: String - contextPath: FidelisEndpoint.File.FilePath description: File path. type: String - contextPath: FidelisEndpoint.File.FileSize description: File size. type: Number - contextPath: FidelisEndpoint.File.HostIP description: Host IP address. type: String - contextPath: FidelisEndpoint.File.HostName description: Host name. type: String - contextPath: FidelisEndpoint.File.ID description: File ID. type: String - contextPath: FidelisEndpoint.File.MD5Hash description: File MD5 hash. type: String - contextPath: File.Path description: The file path. type: String - contextPath: File.Hostname description: The name of the host where the file was found. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.Size description: The size of the file in bytes. type: Number - arguments: - description: The file ID. Get the ID from the file-search-result-metadata command. name: file_id required: true - description: The file name to download (including extension). Get the file name from the file-search-result-metadata command. command). name: file_name required: true description: Gets the file stream and download the file. name: fidelis-endpoint-get-file outputs: - contextPath: File.Size description: The size of the file in bytes. type: Number - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.SSDeep description: The ssdeep hash of the file (same as displayed in file entries). type: String - contextPath: File.EntryID description: The ID for locating the file in the War Room. type: String - contextPath: File.Info description: The file information. type: String - contextPath: File.Type description: The file type, as determined by libmagic (same as displayed in file entries). type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - arguments: - description: The job ID. Get the job ID from the file-search command. name: job_id required: true description: Removes the job to free up space on the server. name: fidelis-endpoint-delete-file-search-job - description: Gets a list of all script packages. name: fidelis-endpoint-list-scripts outputs: - contextPath: FidelisEndpoint.Script.Description description: The script description. type: String - contextPath: FidelisEndpoint.Script.ID description: Script ID. type: String - contextPath: FidelisEndpoint.Script.Name description: Script name. type: String - arguments: - description: The script ID. Get the script ID from the list-scripts command. name: script_id required: true description: Gets the script manifest. name: fidelis-endpoint-get-script-manifest outputs: - contextPath: FidelisEndpoint.Script.ResultColumns description: The script results columns. type: String - contextPath: FidelisEndpoint.Script.Priority description: Script priority. type: String - contextPath: FidelisEndpoint.Script.ImpersonationUser description: Impersonation user. type: String - contextPath: FidelisEndpoint.Script.Name description: Script name. type: String - contextPath: FidelisEndpoint.Script.Command description: The script commands. type: String - contextPath: FidelisEndpoint.Script.Questions description: Script questions. type: String - contextPath: FidelisEndpoint.Script.WizardOverridePassword description: Wizard override password. type: Boolean - contextPath: FidelisEndpoint.Script.Platform description: Scripts platforms (only true). type: String - contextPath: FidelisEndpoint.Script.ImpersonationPassword description: Impersonation password. type: String - contextPath: FidelisEndpoint.Script.ID description: Script ID. type: String - contextPath: FidelisEndpoint.Script.Description description: The script description. type: String - contextPath: FidelisEndpoint.Script.TimeoutSeconds description: Script timeout in seconds. type: Number - arguments: - description: The endpoint IP. Get the endpoint IP from the host-info command. isArray: true name: endpoint_ip - auto: PREDEFINED description: Ths system OS. Can be "Windows", "Linux", or "macOS". name: operating_system predefined: - Windows - Linux - macOS required: true - defaultValue: '300' description: Script time out in seconds. The default is 300. name: time_out - description: The endpoint name. name: endpoint_name description: Gets a list all processes according to the OS system. name: fidelis-endpoint-list-processes outputs: - contextPath: FidelisEndpoint.Process.JobID description: Job ID. type: String - contextPath: FidelisEndpoint.Process.ID description: Script ID. type: String - arguments: - description: 'The script execution job ID. Get the ID the following commands: script-execution, file-search, list-processes, kill-process-by-pid, delete-file, network-isolation, remove-network-isolation.' name: job_id required: true description: Gets script job results. name: fidelis-endpoint-get-script-result outputs: - contextPath: FidelisEndpoint.ScriptResult.EndpointName description: Endpoint name. type: String - contextPath: FidelisEndpoint.ScriptResult.ParentPID description: Parent process ID. type: String - contextPath: FidelisEndpoint.ScriptResult.Path description: File path. type: String - contextPath: FidelisEndpoint.ScriptResult.SHA1 description: File SHA1 hash. type: String - contextPath: FidelisEndpoint.ScriptResult.PID description: Process ID. type: String - contextPath: FidelisEndpoint.ScriptResult.Name description: Process name. type: String - contextPath: FidelisEndpoint.ScriptResult.User description: Script user. type: String - contextPath: FidelisEndpoint.ScriptResult.StartTime description: Script start time. type: Date - contextPath: FidelisEndpoint.ScriptResult.EndpointID description: Endpoint ID. type: String - contextPath: FidelisEndpoint.ScriptResult.Matches description: Script matches. type: Number - contextPath: FidelisEndpoint.ScriptResult.IsHidden description: Whether the endpoint is hidden. type: String - contextPath: FidelisEndpoint.ScriptResult.GroupID description: Group ID. type: String - contextPath: FidelisEndpoint.ScriptResult.Tags description: Script tags. type: String - contextPath: FidelisEndpoint.ScriptResult.ID description: Script result ID. type: String - contextPath: FidelisEndpoint.ScriptResult.WorkingDirectory description: Working directory. type: String - contextPath: FidelisEndpoint.ScriptResult.MD5 description: File MD5 hash. type: String - contextPath: FidelisEndpoint.ScriptResult.CommandLine description: Command line. type: String - arguments: - description: The endpoint IP address. name: endpoint_ip - defaultValue: '300' description: Script time out (in seconds). The default is 300. name: time_out - auto: PREDEFINED description: System OS. Can be "Windows", "Linux", or "macOS". name: operating_system predefined: - Windows - Linux - macOS required: true - description: Process ID. Get the PID from the script-manifest command. name: pid required: true - description: The name of the endpoint. name: endpoint_name description: Terminates the process that matches the required parameter's process ID. name: fidelis-endpoint-kill-process outputs: - contextPath: FidelisEndpoint.Process.JobID description: Script job ID. type: String - contextPath: FidelisEndpoint.Process.ID description: Script ID. type: String - arguments: - description: Endpoint IP address. name: endpoint_ip - defaultValue: '300' description: Script time out (in seconds). The default is 300. name: time_out - auto: PREDEFINED description: System OS. Can be "Windows", "Linux", or "macOS". name: operating_system predefined: - Windows - Linux - macOS required: true - description: The path of the file to delete. name: file_path required: true - description: The name of the endpoint. name: endpoint_name description: Deletes a file at the specified path. name: fidelis-endpoint-delete-file outputs: - contextPath: FidelisEndpoint.Script.ID description: Script ID. type: String - contextPath: FidelisEndpoint.Script.JobID description: Script job ID. type: String - arguments: - description: The endpoint IP address to isolate. name: endpoint_ip - defaultValue: '300' description: Script timeout (in seconds). The default is 300. name: time_out - auto: PREDEFINED description: The system OS. Can be "Windows", "Linux", or "macOS". name: operating_system predefined: - Windows - Linux - macOS required: true - description: 'The server IP address that can communicate with the isolated endpoint. For example: 2.2.2.2.' name: allowed_server required: true - description: The name of the endpoint. name: endpoint_name description: Quarantines an endpoint. While isolated, the endpoint's network communication is restricted to only the allowed servers. name: fidelis-endpoint-isolate-network outputs: - contextPath: FidelisEndpoint.Isolation.ID description: Script ID. type: String - contextPath: FidelisEndpoint.Isolation.JobID description: Script job ID. type: String - arguments: - description: The isolated endpoint IP address. name: endpoint_ip - defaultValue: '300' description: Script timeout (in seconds). The default is 300. name: time_out - auto: PREDEFINED description: System OS. Can be "Windows", "Linux", or "macOS". name: operating_system predefined: - Windows - Linux - macOS required: true - description: The name of the endpoint. name: endpoint_name description: Removes the endpoint from isolation. name: fidelis-endpoint-remove-network-isolation outputs: - contextPath: FidelisEndpoint.Isolation.ID description: Script ID. type: String - contextPath: FidelisEndpoint.Isolation.JobID description: Script job ID. type: String - arguments: - description: 'The script execution job result ID. Get the ID from the following commands: script-execution, file-search, list-processes, kill-process-by-pid, delete-file, network-isolation, remove-network-isolation.' name: job_result_id required: true description: Gets the script execution status. name: fidelis-endpoint-script-job-status outputs: - contextPath: FidelisEndpoint.ScriptResult.JobName description: The job name. type: String - contextPath: FidelisEndpoint.ScriptResult.JobResultID description: Job result ID. type: String - contextPath: FidelisEndpoint.ScriptResult.Name description: Target name. type: String - contextPath: FidelisEndpoint.ScriptResult.Status description: Script execution status. type: String - arguments: - description: Script ID. Get the script ID from the list-scripts command. name: script_id required: true - defaultValue: '300' description: Script time out (in seconds). The default is 300. name: time_out - description: Endpoint IP address on which to run the script. name: endpoint_ip - description: The script to run. Get the answer from the script-manifest command. name: answer required: true - description: The name of the endpoint. name: endpoint_name description: Executes a script package from Fidelis endpoint packages. name: fidelis-endpoint-execute-script outputs: - contextPath: FidelisEndpoint.Script.ID description: Script ID. type: String - contextPath: FidelisEndpoint.Script.JobID description: Script job ID. type: String - arguments: - description: |- The start time of the event in the system in UTC format. Supported values: "2019-10-21T23:45:00" (date). name: start_time - description: |- The end time of the event in the system in UTC format. Supported values:"2019-10-21T23:45:00" (date). name: end_time - auto: PREDEFINED description: The logic of the query. Can be "and" or "or". name: logic predefined: - and - or required: true - description: The MD5 file hash to search for. name: file_hash required: true - defaultValue: '50' description: The maximum number of results to return. The default is 50. name: limit description: Queries a file by file hash. name: fidelis-endpoint-query-file outputs: - contextPath: FidelisEndpoint.Query.ProcessStartTime description: The process start time. type: Date - contextPath: FidelisEndpoint.Query.EndpointName description: Endpoint name. type: String - contextPath: FidelisEndpoint.Query.CertificateSubjectName description: Certificate subject name. type: String - contextPath: FidelisEndpoint.Query.Size description: File size. type: Number - contextPath: FidelisEndpoint.Query.FileExtension description: File extension. type: String - contextPath: FidelisEndpoint.Query.Path description: File path. type: String - contextPath: FidelisEndpoint.Query.CertificatePublisher description: Certificate publisher. type: String - contextPath: FidelisEndpoint.Query.ParentID description: Process parent ID. type: String - contextPath: FidelisEndpoint.Query.EventTime description: Event time. type: Date - contextPath: FidelisEndpoint.Query.SignedTime description: Signed time. type: Date - contextPath: FidelisEndpoint.Query.Name description: File name. type: String - contextPath: FidelisEndpoint.Query.TargetID description: Target ID. type: String - contextPath: FidelisEndpoint.Query.Hash description: File hash. type: String - contextPath: FidelisEndpoint.Query.StartTime description: Event start time. type: Date - contextPath: FidelisEndpoint.Query.HashSHA1 description: File SHA1 hash. type: String - contextPath: FidelisEndpoint.Query.EventType description: Event type. type: Number - contextPath: FidelisEndpoint.Query.HashSHA256 description: File SHA256 hash. type: String - contextPath: FidelisEndpoint.Query.ParentName description: Process parent name. type: String - contextPath: FidelisEndpoint.Query.FileType description: File type. type: Number - contextPath: FidelisEndpoint.Query.Signature description: File signature. type: Number - contextPath: FidelisEndpoint.Query.EventIndex description: Event index. type: Number - contextPath: FidelisEndpoint.Query.FileCategory description: File category. type: Number - contextPath: FidelisEndpoint.Query.CertificateIssuerName description: Certificate issuer name. type: String - contextPath: FidelisEndpoint.Query.FileVersion description: File version. type: String - contextPath: FidelisEndpoint.Query.IndexingTime description: Indexing time. type: Date - contextPath: FidelisEndpoint.Query.EntityType description: Entity type. type: Number - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.Size description: The size of the file in bytes. type: Number - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.Extension description: 'The file extension, for example: "txt".' type: String - contextPath: File.Type description: The file type, as determined by libmagic (same as displayed in file entries). type: Number - contextPath: File.Path description: The path where the file is located. type: String - contextPath: File.Hostname description: The name of the host where the file was found. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.FileVersion description: The file version. type: String - arguments: - description: |- The start time of the event in the system in UTC format. Supported values: "2019-10-21T23:45:00" (date). name: start_time - description: |- The end time of the event in the system in UTC format. Supported values:"2019-10-21T23:45:00" (date). name: end_time - auto: PREDEFINED description: The logic of the query. Can be "and" or "or". name: logic predefined: - and - or required: true - description: The process name to query. name: process_name required: true - defaultValue: '50' description: The maximum number of results to return. The default is 50. name: limit description: Query process. name: fidelis-endpoint-query-process outputs: - contextPath: FidelisEndpoint.Query.ProcessStartTime description: Process start time. type: String - contextPath: FidelisEndpoint.Query.EndpointName description: Endpoint name. type: String - contextPath: FidelisEndpoint.Query.Path description: The path of the process. type: String - contextPath: FidelisEndpoint.Query.ParentID description: Process parent ID. type: String - contextPath: FidelisEndpoint.Query.EventTime description: Event time. type: Date - contextPath: FidelisEndpoint.Query.PID description: Process ID. type: String - contextPath: FidelisEndpoint.Query.Name description: Process name. type: String - contextPath: FidelisEndpoint.Query.User description: The user of the system. type: String - contextPath: FidelisEndpoint.Query.TargetID description: Process target ID. type: String - contextPath: FidelisEndpoint.Query.Hash description: File hash. type: String - contextPath: FidelisEndpoint.Query.StartTime description: Process start time. type: Date - contextPath: FidelisEndpoint.Query.EventType description: Event type. type: Number - contextPath: FidelisEndpoint.Query.ParentName description: Process parent name. type: String - contextPath: FidelisEndpoint.Query.IndexingTime description: Indexing time. type: Date - contextPath: FidelisEndpoint.Query.EntityType description: Entity type. type: Number - arguments: - description: |- The start time of the event in the system in UTC format. Supported values: "2019-10-21T23:45:00" (date). name: start_time - description: |- The end time of the event in the system in UTC format. Supported values:"2019-10-21T23:45:00" (date). name: end_time - auto: PREDEFINED description: The logic of the query. Can be "and" or "or". name: logic predefined: - and - or required: true - description: The remote IP address on which to query. name: remote_ip required: true - defaultValue: '50' description: The maximum number of results to return. The default is 50. name: limit description: Queries a connection by remote IP address. name: fidelis-endpoint-query-connection-by-remote-ip outputs: - contextPath: FidelisEndpoint.Query.ProcessStartTime description: Process start time. type: Date - contextPath: FidelisEndpoint.Query.EndpointName description: Endpoint name. type: String - contextPath: FidelisEndpoint.Query.ParentID description: Process parent ID. type: String - contextPath: FidelisEndpoint.Query.EventTime description: Event time. type: Date - contextPath: FidelisEndpoint.Query.RemotePort description: Remote port. type: Number - contextPath: FidelisEndpoint.Query.LocalPort description: Local port. type: Number - contextPath: FidelisEndpoint.Query.TargetID description: Target ID. type: String - contextPath: FidelisEndpoint.Query.RemoteIP description: Remote IP address. type: String - contextPath: FidelisEndpoint.Query.StartTime description: Event start time. type: Date - contextPath: FidelisEndpoint.Query.EndpointID description: Endpoint ID. type: String - contextPath: FidelisEndpoint.Query.NetworkDirection description: Network direction. type: Number - contextPath: FidelisEndpoint.Query.LastEventTime description: Last event time. type: Date - contextPath: FidelisEndpoint.Query.LocalIP description: Local IP address. type: String - contextPath: FidelisEndpoint.Query.EventType description: Event type. type: Number - contextPath: FidelisEndpoint.Query.ParentName description: Parent name. type: String - contextPath: FidelisEndpoint.Query.FirstEventTime description: First event time. type: Date - contextPath: FidelisEndpoint.Query.EventIndex description: Event Index. type: Number - contextPath: FidelisEndpoint.Query.Protocol description: Protocol. type: String - contextPath: FidelisEndpoint.Query.PPID description: Process parent ID. type: Number - contextPath: FidelisEndpoint.Query.EntityType description: Entity type. type: Number - contextPath: FidelisEndpoint.Query.ParentHashSHA1 description: Parent SHA1 hash. type: String - arguments: - description: |- The start time of the event in the system in UTC format. Supported values: "2019-10-21T23:45:00" (date). name: start_time - description: |- The end time of the event in the system in UTC format. Supported values:"2019-10-21T23:45:00" (date). name: end_time - auto: PREDEFINED description: The logic of the query. Can be "and" or "or". name: logic predefined: - and - or required: true - description: URL or domain on which to query. name: url required: true - defaultValue: '50' description: The maximum number of results to return. The default is 50. name: limit description: Queries by DNS request. name: fidelis-endpoint-query-by-dns outputs: - contextPath: FidelisEndpoint.Query.ProcessStartTime description: Process start time. type: Date - contextPath: FidelisEndpoint.Query.EndpointName description: Endpoint name. type: String - contextPath: FidelisEndpoint.Query.ParentID description: Parent ID. type: String - contextPath: FidelisEndpoint.Query.EventTime description: Event time. type: Date - contextPath: FidelisEndpoint.Query.RemotePort description: Remote port. type: Number - contextPath: FidelisEndpoint.Query.DnsAnswer description: The DNS answer. type: String - contextPath: FidelisEndpoint.Query.LocalPort description: Local port. type: Number - contextPath: FidelisEndpoint.Query.TargetID description: The target ID. type: String - contextPath: FidelisEndpoint.Query.RemoteIP description: Remote IP address. type: String - contextPath: FidelisEndpoint.Query.DnsQuestion description: The DNS question. type: String - contextPath: FidelisEndpoint.Query.StartTime description: Event start time. type: Date - contextPath: FidelisEndpoint.Query.NetworkDirection description: Network direction. type: Number - contextPath: FidelisEndpoint.Query.LocalIP description: Local IP address. type: String - contextPath: FidelisEndpoint.Query.EventType description: Event type. type: Number - contextPath: FidelisEndpoint.Query.EventIndex description: Event index. type: Number - contextPath: FidelisEndpoint.Query.IndexingTime description: Indexing time. type: Date - contextPath: FidelisEndpoint.Query.EntityType description: Entity type. type: Number - arguments: - description: |- The start time of the event in the system in UTC format. Supported values: "2019-10-21T23:45:00" (date). name: start_time - description: |- The end time of the event in the system in UTC format. Supported values:"2019-10-21T23:45:00" (date). name: end_time - auto: PREDEFINED description: The logic of the query. Can be "and" or "or". name: logic predefined: - and - or required: true - description: The remote IP on which to query. name: remote_ip required: true - defaultValue: '50' description: The maximum number of results to return. The default is 50. name: limit description: Queries DNS by server IP address. name: fidelis-endpoint-query-dns-by-server-ip outputs: - contextPath: FidelisEndpoint.Query.ProcessStartTime description: Process start time. type: Date - contextPath: FidelisEndpoint.Query.EndpointName description: Endpoint name. type: String - contextPath: FidelisEndpoint.Query.ParentID description: Parent ID. type: String - contextPath: FidelisEndpoint.Query.EventTime description: Event time. type: Date - contextPath: FidelisEndpoint.Query.RemotePort description: Remote port. type: Number - contextPath: FidelisEndpoint.Query.DnsAnswer description: The DNS answer. type: String - contextPath: FidelisEndpoint.Query.LocalPort description: Local port. type: Number - contextPath: FidelisEndpoint.Query.TargetID description: The target ID. type: String - contextPath: FidelisEndpoint.Query.RemoteIP description: Remote IP address. type: String - contextPath: FidelisEndpoint.Query.DnsQuestion description: The DNS question. type: String - contextPath: FidelisEndpoint.Query.StartTime description: Event start time. type: Date - contextPath: FidelisEndpoint.Query.NetworkDirection description: Network direction. type: Number - contextPath: FidelisEndpoint.Query.LocalIP description: Local IP address. type: String - contextPath: FidelisEndpoint.Query.EventType description: Event type. type: Number - contextPath: FidelisEndpoint.Query.EventIndex description: Event index. type: Number - contextPath: FidelisEndpoint.Query.IndexingTime description: Indexing time. type: Date - contextPath: FidelisEndpoint.Query.EntityType description: Entity type. type: Number - arguments: - description: |- The start time of the event in the system in UTC format. Supported values: "2019-10-21T23:45:00" (date). name: start_time - description: |- The end time of the event in the system in UTC format. Supported values:"2019-10-21T23:45:00" (date). name: end_time - auto: PREDEFINED description: The logic of the query. Can be "and" or "or". name: logic predefined: - and - or required: true - description: The source IP address to query. name: source_ip required: true - description: The domain to query. name: domain - defaultValue: '50' description: The maximum number of results to return. The default is 50. name: limit description: Queries DNS by source IP address. name: fidelis-endpoint-query-dns-by-source-ip outputs: - contextPath: FidelisEndpoint.Query.ProcessStartTime description: Process start time. type: Date - contextPath: FidelisEndpoint.Query.EndpointName description: Endpoint name. type: String - contextPath: FidelisEndpoint.Query.ParentID description: Parent ID. type: String - contextPath: FidelisEndpoint.Query.EventTime description: Event time. type: Date - contextPath: FidelisEndpoint.Query.RemotePort description: Remote port. type: Number - contextPath: FidelisEndpoint.Query.DnsAnswer description: The DNS answer. type: String - contextPath: FidelisEndpoint.Query.LocalPort description: Local port. type: Number - contextPath: FidelisEndpoint.Query.TargetID description: The target ID. type: String - contextPath: FidelisEndpoint.Query.RemoteIP description: Remote IP address. type: String - contextPath: FidelisEndpoint.Query.DnsQuestion description: The DNS question. type: String - contextPath: FidelisEndpoint.Query.StartTime description: Event start time. type: Date - contextPath: FidelisEndpoint.Query.NetworkDirection description: Network direction. type: Number - contextPath: FidelisEndpoint.Query.LocalIP description: Local IP address. type: String - contextPath: FidelisEndpoint.Query.EventType description: Event type. type: Number - contextPath: FidelisEndpoint.Query.EventIndex description: Event index. type: Number - contextPath: FidelisEndpoint.Query.IndexingTime description: Indexing time. type: Date - contextPath: FidelisEndpoint.Query.EntityType description: Entity type. type: Number - arguments: - description: |- The start time of the event in the system in UTC format. Supported values: "2019-10-21T23:45:00" (date). name: start_time - description: |- The end time of the event in the system in UTC format. Supported values:"2019-10-21T23:45:00" (date). name: end_time - auto: PREDEFINED description: The logic of the query. Can be "and" or "or". name: logic predefined: - and - or required: true - auto: PREDEFINED description: Query entity type. Can be "antiMalware", "dns", "file", "network", "process", "registry", "remoteThread", "script", "usb", or "windowsevent". name: entity_type predefined: - antiMalware - dns - file - network - process - registry - remoteThread - script - usb - windowsevent required: true - description: 'Column to query. For example: hash, name, remoteIP, dnsQuestion, localIP.' name: column required: true - description: The value to query. Can be an IP address, file hash, file path, and so on. name: value required: true - description: 'The operator, which describes how the "value" relates to the "field" (for example: "=", "!=", ">", "<").' name: operator required: true - defaultValue: '50' description: The maximum number of results to return. The default is 50. name: limit - description: 'An additional filter to use in the query. For example: pid = 1234, pid > 1233.' name: additional_filter description: Queries events. name: fidelis-endpoint-query-events outputs: - contextPath: FidelisEndpoint.Query.ProcessStartTime description: Process start time. type: Date - contextPath: FidelisEndpoint.Query.EndpointName description: Endpoint name. type: String - contextPath: FidelisEndpoint.Query.Path description: File path. type: String - contextPath: FidelisEndpoint.Query.ParentID description: Parent ID. type: String - contextPath: FidelisEndpoint.Query.EventTime description: Event time. type: Date - contextPath: FidelisEndpoint.Query..RemotePort description: Remote port. type: Number - contextPath: FidelisEndpoint.Query.DnsAnswer description: DNS answer. type: String - contextPath: FidelisEndpoint.Query.PID description: Process ID. type: Number - contextPath: FidelisEndpoint.Query.Name description: Process name. type: String - contextPath: FidelisEndpoint.Query.User description: Endpoint user. type: String - contextPath: FidelisEndpoint.Query.LocalPort description: Local port. type: Number - contextPath: FidelisEndpoint.Query.TargetID description: Target ID. type: String - contextPath: FidelisEndpoint.Query.RemoteIP description: Remote IP address. type: String - contextPath: FidelisEndpoint.Query.Hash description: File hash. type: String - contextPath: FidelisEndpoint.Query.DnsQuestion description: DNS question. type: String - contextPath: FidelisEndpoint.Query.StartTime description: Start time of the event. type: Date - contextPath: FidelisEndpoint.Query.Entropy description: Entropy. type: Number - contextPath: FidelisEndpoint.Query.LocalIP description: Local IP address. type: String - contextPath: FidelisEndpoint.Query.EventType description: Event type. type: Number - contextPath: FidelisEndpoint.Query.ParentName description: Parent name. type: String - contextPath: FidelisEndpoint.Query.EventIndex description: Event index. type: Number - contextPath: FidelisEndpoint.Query.IndexingTime description: Indexing time. type: Date - contextPath: FidelisEndpoint.Query.EntityType description: Entity type. type: Number dockerimage: demisto/python3:3.12.13.10116658 isfetch: true runonce: false script: '-' type: python subtype: python3 tests: - no tests test is in non-cricle Fidelis Endpoint - Test fromversion: 5.0.0