FireEye Central Management

FireEye Central Management (CM Series) is the FireEye threat intelligence hub. It services the FireEye ecosystem, ensuring that FireEye products share the latest intelligence and correlate across attack vectors to detect and prevent cyber attacks.

Analytics & SIEM · FireEye Central Management

Details

IDFireEye Central Management
ProviderTrellix
CategoryAnalytics & SIEM
From Version5.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

FireEye Central Management (CM Series) is the FireEye threat intelligence hub. It services the FireEye ecosystem, ensuring that FireEye products share the latest intelligence and correlate across attack vectors to detect and prevent cyber attacks
This integration was integrated and tested with version 9.0.2 of FireEye Central Management

API Key management

This integration generates an API Key from the username and password given to be authenticated with FireEye.
The API Key is valid for 15 minutes.
The integration manages the storage of this key, and its re-generation when the key expires.

Fetch FireEye EX Alert Emails

To fetch a FireEye EX alert email, you will need the UUID.

  1. Run the fireeye-cm-get-alert-details** command with the alert ID. For example,
    **    !fireeye-cm-get-alert-details alert_id=542    *
  2. Locate the UUID in the context data and run the fireeye-cm-get-artifacts-by-uuid command with the UUID. For example:
    !fireeye-cm-get-artifacts-by-uuid uuid=243a2555-a915-47a1-a947-e71049f4971c
  3. Download the email.

Access the FireEye Alert URL

To display a proper link in the FireEye NX Alert URL field of the FireEye NX or EX Alert layout, you need to configure the hostname in the appliance settings of the FireEye application.

  1. Log in to your FireEye application.
  2. Navigate to Appliance Settings > Network > Hostname.
  3. In the Hostname field, enter your URL/server/ip address.

Configure FireEye Central Management in Cortex

Parameter Required
Your server URL True
Username True
Fetch incidents False
Max incidents to fetch False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year) False
Incident type False
Info level for fetched alerts False
Trust any certificate (not secure) False
Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

fireeye-cm-get-alerts

Searches and retrieves FireEye CM alerts based on several filters.

Base Command

fireeye-cm-get-alerts

Input

Argument Name Description Required
alert_id The ID number of the alert to retrieve. Optional
duration The time interval to search. This filter is used with either the start_time or end_time filter. If duration, start time, and end time are not specified, the system defaults to duration=12_hours, end_time=current_time. If only the duration is specified, the end_time defaults to the current_time. Possible values are: 1_hour, 2_hours, 6_hours, 12_hours, 24_hours, 48_hours. Optional
start_time The start time of the search. This filter is optional. Syntax: start_time=YYYY-MM-DDTHH:mm:ss.sss-OH:om or ‘1 day/month/year’. Default is 1 day. Optional
end_time The end time of the search. This filter is used with the duration filter. If the end_time is specified but not the duration, the system defaults to duration=12_hours, ending at the specified end_time. Syntax: end_time=YYYY-MM-DDTHH:mm:ss.sss-OH:om. Optional
callback_domain Searches for alerts that include callbacks to the specified domain. Optional
dst_ip The destination IPv4 address related to the malware alert. Optional
src_ip The source IPv4 address related to the malware alert. Optional
file_name The name of the malware file. Optional
file_type The malware file type. Optional
info_level The level of information to be returned. Possible values: “concise”, “normal”, and “extended”. Possible values are: concise, normal, extended. Default is concise. Optional
malware_name The name of the malware object. Optional
malware_type The type of the malware object. Possible values: “domain_match”, “malware_callback”, “malware_object”, “web_infection”, “infection_match”, “riskware-infection”, “riskware-callback”, “riskware-object”. Possible values are: domain_match, malware_callback, malware_object, web_infection, infection_match, riskware-infection, riskware-callback, riskware-object. Optional
md5 Searches for alerts that include a specific MD5 hash. Optional
recipient_email The email address of the malware object receiver. Optional
sender_email The email address of the malware object sender. Optional
url Searches for a specific alert URL. Optional
limit Maximum number of alerts to return. Default is 20. Optional

Context Output

Path Type Description
FireEyeCM.Alerts.id String The ID of the alert.
FireEyeCM.Alerts.uuid String The UUID of the alert.
FireEyeCM.Alerts.occurred String The time when the alert occurred.
FireEyeCM.Alerts.product String The product name of the alert.
FireEyeCM.Alerts.rootInfection String The ID of the infection associated with the malware alert.
FireEyeCM.Alerts.name String The link to the infection associated with the malware alert.
FireEyeCM.Alerts.vlan String The virtual LAN (VLAN) of the alert.
FireEyeCM.Alerts.malicious String A flag indicating whether the alert is malicious.
FireEyeCM.Alerts.severity String The severity of the alert.
FireEyeCM.Alerts.sensor String The sensor name that the alert is associated with.
FireEyeCM.Alerts.applianceId String The appliance ID of the alert.
FireEyeCM.Alerts.sensorIp String The sensor IP that the alert is associated with.
FireEyeCM.Alerts.ack String A flag indicating whether an acknowledgment is received.
FireEyeCM.Alerts.src Unknown The source of the alert.
FireEyeCM.Alerts.dst Unknown The destination of the alert.
FireEyeCM.Alerts.explanation Unknown The explanation data of the alert.

Command Example


#### Context Example

```json
{
    "FireEyeCM": {
        "Alerts": [
            {
                "ack": "no",
                "action": "notified",
                "alertUrl": "https://FireEyeCM/event_stream/events_for_bot?ev_id=35685",
                "applianceId": "test",
                "attackTime": "2021-06-10 21:52:43 +0000",
                "dst": {
                    "ip": "1.1.1.1",
                    "mac": "00:50:56:94:b8:42",
                    "port": 443
                },
                "explanation": {
                    "malwareDetected": {
                        "malware": [
                            {
                                "name": "Trojan.Malicious.SSL.Certificate.Dridex"
                            }
                        ]
                    },
                    "osChanges": []
                },
                "id": 35685,
                "malicious": "yes",
                "name": "MALWARE_CALLBACK",
                "occurred": "2021-06-10 21:52:43 +0000",
                "product": "WEB_MPS",
                "rootInfection": 34670,
                "scVersion": "1163.102",
                "sensor": "sensor",
                "sensorIp": "1.1.1.1",
                "severity": "CRIT",
                "src": {
                    "ip": "1.1.1.1",
                    "port": 8080
                },
                "uuid": "529023c0-6ddf-4933-9241-fe4ec71a788e",
                "vlan": 0
            }
        ]
    }
}

Human Readable Output

FireEye Central Management Alerts

id occurred product name malicious severity alertUrl
35685 2021-06-10 21:52:43 +0000 WEB_MPS MALWARE_CALLBACK yes CRIT https://FireEyeCM/event_stream/events_for_bot?ev_id=35685

fireeye-cm-get-alert-details

Searches and retrieves the details of a single alert.

Base Command

fireeye-cm-get-alert-details

Input

Argument Name Description Required
alert_id The ID of the alert for which to retrieve its details. Required
timeout Timeout to retrieve the artifacts. Default is 30 seconds. Optional

Context Output

Path Type Description
FireEyeCM.Alerts.id String The ID of the alert.
FireEyeCM.Alerts.uuid String The UUID of the alert.
FireEyeCM.Alerts.occurred String The time when the alert occurred.
FireEyeCM.Alerts.product String The product name of the alert.
FireEyeCM.Alerts.rootInfection String The ID of the infection associated with the malware alert.
FireEyeCM.Alerts.name String The link to the infection associated with the malware alert.
FireEyeCM.Alerts.vlan String The virtual LAN (VLAN) of the alert.
FireEyeCM.Alerts.malicious String A flag indicating whether the alert is malicious.
FireEyeCM.Alerts.severity String The severity of the alert.
FireEyeCM.Alerts.sensor String The sensor name that the alert is associated with.
FireEyeCM.Alerts.applianceId String The appliance ID of the alert.
FireEyeCM.Alerts.sensorIp String The sensor IP that the alert is associated with.
FireEyeCM.Alerts.ack String A flag indicating whether an acknowledgment is received.
FireEyeCM.Alerts.src Unknown The source of the alert.
FireEyeCM.Alerts.dst Unknown The destination of the alert.
FireEyeCM.Alerts.explanation Unknown The explanation data of the alert.

Command Example

!fireeye-cm-get-alert-details alert_id=35685

Context Example

{
    "FireEyeCM": {
        "Alerts": {
            "ack": "no",
            "action": "notified",
            "alertUrl": "https://FireEyeCM/event_stream/events_for_bot?ev_id=35685",
            "applianceId": "test",
            "attackTime": "2021-06-10 21:52:43 +0000",
            "dst": {
                "ip": "1.1.1.1",
                "mac": "00:50:56:94:b8:42",
                "port": 443
            },
            "explanation": {
                "malwareDetected": {
                    "malware": [
                        {
                            "name": "Trojan.Malicious.SSL.Certificate.Dridex"
                        }
                    ]
                },
                "osChanges": []
            },
            "id": 35685,
            "malicious": "yes",
            "name": "MALWARE_CALLBACK",
            "occurred": "2021-06-10 21:52:43 +0000",
            "product": "WEB_MPS",
            "rootInfection": 34670,
            "scVersion": "1163.102",
            "sensor": "sensor",
            "sensorIp": "1.1.1.1",
            "severity": "CRIT",
            "src": {
                "ip": "1.1.1.1",
                "port": 8080
            },
            "uuid": "529023c0-6ddf-4933-9241-fe4ec71a788e",
            "vlan": 0
        }
    }
}

Human Readable Output

FireEye Central Management Alerts

id occurred product name malicious action src dst severity alertUrl
35685 2021-06-10 21:52:43 +0000 WEB_MPS MALWARE_CALLBACK yes notified ip: 34.252.247.142
port: 51270		 mac: 00:50:56:94:b8:42
port: 443
ip: 192.168.1.202		 CRIT https://FireEyeCM/event_stream/events_for_bot?ev_id=35685

fireeye-cm-alert-acknowledge

Confirms that the alert has been reviewed.

Base Command

fireeye-cm-alert-acknowledge

Input

Argument Name Description Required
uuid The universally unique identifier (UUID) for the alert. Required

Context Output

There is no context output for this command.

Command Example

!fireeye-cm-alert-acknowledge uuid=529023c0-6ddf-4933-9241-fe4ec71a788e

Human Readable Output

Alert 529023c0-6ddf-4933-9241-fe4ec71a788e was acknowledged successfully.

fireeye-cm-get-artifacts-by-uuid

Downloads malware artifacts data for the specified UUID as a zip file.

Base Command

fireeye-cm-get-artifacts-by-uuid

Input

Argument Name Description Required
uuid The universally unique identifier (UUID) for the alert. Required
timeout Timeout to retrieve the artifacts. Default is 120 seconds. Optional

Context Output

Path Type Description
InfoFile.EntryID string The EntryID of the artifact file.
InfoFile.Extension string The extension of the artifact file.
InfoFile.Name string The name of the artifact file.
InfoFile.Info string The info of the artifact file.
InfoFile.Size number The size of the artifact file.
InfoFile.Type string The type of the artifact file.

Command Example

!fireeye-cm-get-artifacts-by-uuid uuid=b38b83a0-4b96-408c-999f-4e97a5099f61

Context Example

{
    "InfoFile": {
        "EntryID": "400@2c246757-e02c-458a-8620-dbc236283fb8",
        "Extension": "zip",
        "Info": "application/zip",
        "Name": "artifacts_b38b83a0-4b96-408c-999f-4e97a5099f61.zip",
        "Size": 5501,
        "Type": "Zip archive data, at least v2.0 to extract"
    }
}

Human Readable Output

fireeye-cm-get-artifacts-metadata-by-uuid

Gets artifacts metadata for the specified UUID.

Base Command

fireeye-cm-get-artifacts-metadata-by-uuid

Input

Argument Name Description Required
uuid The universally unique identifier (UUID) for the alert. Required

Context Output

Path Type Description
FireEyeCM.Alerts.uuid string Universally unique ID (UUID) of the alert.
FireEyeCM.Alerts.artifactsInfoList.artifactType string The artifact type.
FireEyeCM.Alerts.artifactsInfoList.artifactName string The artifact name.
FireEyeCM.Alerts.artifactsInfoList.artifactSize string The zipped artifact size in bytes.

Command Example

!fireeye-cm-get-artifacts-metadata-by-uuid uuid=b38b83a0-4b96-408c-999f-4e97a5099f61

Context Example

{
    "FireEyeCM": {
        "Alerts": {
            "artifactsInfoList": [
                {
                    "artifactName": "34.252.247.142-192.168.1.202-1620538334558058-33354739.txt.gz",
                    "artifactSize": "1641",
                    "artifactType": "l7_context_file"
                },
                {
                    "artifactName": "192.168.1.202-34.252.247.142-1620538334557811-33354739-cs.pcap",
                    "artifactSize": "3645",
                    "artifactType": "bott_communication_capture"
                }
            ],
            "uuid": "b38b83a0-4b96-408c-999f-4e97a5099f61"
        }
    }
}

Human Readable Output

FireEye Central Management b38b83a0-4b96-408c-999f-4e97a5099f61 Artifact metadata

artifactName artifactSize artifactType
34.252.247.142-192.168.1.202-1620538334558058-33354739.txt.gz 1641 l7_context_file
192.168.1.202-34.252.247.142-1620538334557811-33354739-cs.pcap 3645 bott_communication_capture

fireeye-cm-get-events

Retrieves information about existing IPS NX events. An IPS enabled appliance is a prerequisite to be able to retrieve IPS event data.

Base Command

fireeye-cm-get-events

Input

Argument Name Description Required
duration The time interval in which to search. This filter is used with the end_time filter. If the duration is not specified, the system defaults to duration=12_hours, end_time=current_time. Possible values are: 1_hour, 2_hours, 6_hours, 12_hours, 24_hours, 48_hours. Optional
end_time The end time of the search. This filter is used with the duration filter. If the end_time is specified but not the duration, the system defaults to duration=12_hours, ending at the specified end_time. Syntax: end_time=YYYY-MM-DDTHH:mm:ss.sss-OH:om. Optional
mvx_correlated_only Specifies whether to include all IPS events or MVX-correlated events only. Possible values: “true” and “false”. Possible values are: false, true. Default is false. Optional
limit Maximum number of events to return. Default is 20. Optional

Context Output

Path Type Description
FireEyeCM.Events.eventId Number The ID of the event.
FireEyeCM.Events.occurred string The date and time when the event occurred.
FireEyeCM.Events.srcIp string The IP address of the victim.
FireEyeCM.Events.srcPort Number The port address of the victim.
FireEyeCM.Events.dstIp string The IP address of the attacker.
FireEyeCM.Events.dstPort Number The port address of the attacker.
FireEyeCM.Events.vlan Number The virtual LAN (VLAN) of the event.
FireEyeCM.Events.signatureMatchCnt String The date and time when the event occurred.
FireEyeCM.Events.signatureId String The ID of the event.
FireEyeCM.Events.signatureRev String The date and time when the event occurred.
FireEyeCM.Events.severity String The ID of the event.
FireEyeCM.Events.vmVerified String The date and time when the event occurred.
FireEyeCM.Events.srcMac String The MAC address of the source machine.
FireEyeCM.Events.dstMac String The MAC address of the destination machine.
FireEyeCM.Events.ruleName String The rule name for the event.
FireEyeCM.Events.sensorId String The sensor ID of the FireEye machine.
FireEyeCM.Events.cveId String The CVE ID found in the event.
FireEyeCM.Events.actionTaken String The IPS blocking action taken on the event.
FireEyeCM.Events.attackMode String The attack mode mentioned in the event.
FireEyeCM.Events.interfaceId Number The interface ID of the event.
FireEyeCM.Events.protocol Number The protocol used in the event.
FireEyeCM.Events.incidentId Number The incident ID of the event on FireEye.

Command Example

!fireeye-cm-get-events duration="48_hours" end_time="2021-05-14T01:08:04.000-02:00" mvx_correlated_only="true"

Human Readable Output

No events in the given timeframe were found.

fireeye-cm-get-quarantined-emails

Searches and retrieves quarantined emails.

Base Command

fireeye-cm-get-quarantined-emails

Input

Argument Name Description Required
start_time Specifies the start time of the search. This filter is optional. Syntax: start_time=YYYY-MM-DDTHH:mm:ss.sss-OH:om or ‘1 day/month/year’. Default is 1 day. Optional
end_time Specifies the end time of the search. Default is now. Syntax: end_time=YYYY-MM-DDTHH:mm:ss.sss-OH:om or ‘1 day/month/year’. Optional
from The sender email. Optional
subject The email subject. Must be URL encoded. Optional
appliance_id The appliance ID. Optional
limit Number of emails to return. Default is 20. Optional

Context Output

Path Type Description
FireEyeCM.QuarantinedEmail.appliance_id string The appliance ID associated with the quarantined email.
FireEyeCM.QuarantinedEmail.completed_at string The time the email has been quarantined.
FireEyeCM.QuarantinedEmail.email_uuid string The quarantined email UUID.
FireEyeCM.QuarantinedEmail.from string The quarantined email sender.
FireEyeCM.QuarantinedEmail.message_id string The quarantined email message ID.
FireEyeCM.QuarantinedEmail.quarantine_path string The quarantined email path.
FireEyeCM.QuarantinedEmail.The quarantined email queue id. string The quarantined email queue ID.
FireEyeCM.QuarantinedEmail.subject string The quarantined email subject.

Command Example

!fireeye-cm-get-quarantined-emails start_time="1 month" limit=4

Context Example

{
    "FireEyeCM": {
        "QuarantinedEmail": [
            {
                "appliance_id": "test",
                "completed_at": "2021-05-24T09:04:03",
                "email_uuid": "d7738eb0-7fe7-4b5d-8fcb-2b053ef57e13",
                "from": "test@malicious.net",
                "message_id": "queue-id-test@no-message-id",
                "quarantine_path": "/data/email-analysis/quarantine2/2021-05-24/09/test",
                "queue_id": "4FpWV31wpbzTgF9",
                "subject": "test"
            },
            {
                "appliance_id": "test",
                "completed_at": "2021-05-24T16:01:16",
                "email_uuid": "9e73ca23-b935-47c2-8d2a-fe1a10071db2",
                "from": "test@malicious.net",
                "message_id": "queue-id-test@no-message-id",
                "quarantine_path": "/data/email-analysis/quarantine2/2021-05-24/16/test",
                "queue_id": "test",
                "subject": "test"
            },
            {
                "appliance_id": "test",
                "completed_at": "2021-05-24T16:01:16",
                "email_uuid": "e7b52446-555d-40d0-b8ad-e8f1f2a7ab7a",
                "from": "test@malicious.net",
                "message_id": "queue-id-test@no-message-id",
                "quarantine_path": "/data/email-analysis/quarantine2/2021-05-24/16/test",
                "queue_id": "test",
                "subject": "test"
            },
            {
                "appliance_id": "test",
                "completed_at": "2021-05-24T16:01:16",
                "email_uuid": "ebb991b5-06ef-44f4-b44d-e1daef67ce70",
                "from": "test@malicious.net",
                "message_id": "queue-id-test@no-message-id",
                "quarantine_path": "/data/email-analysis/quarantine2/2021-05-24/16/test",
                "queue_id": "test",
                "subject": "test"
            }
        ]
    }
}

Human Readable Output

FireEye Central Management Quarantined emails

email_uuid from subject message_id completed_at
d7738eb0-7fe7-4b5d-8fcb-2b053ef57e13 test@malicious.net test queue-id-test@no-message-id 2021-05-24T09:04:03
9e73ca23-b935-47c2-8d2a-fe1a10071db2 test@malicious.net test queue-id-test@no-message-id 2021-05-24T16:01:16
e7b52446-555d-40d0-b8ad-e8f1f2a7ab7a test@malicious.net test queue-id-test@no-message-id 2021-05-24T16:01:16
ebb991b5-06ef-44f4-b44d-e1daef67ce70 test@malicious.net test queue-id-test@no-message-id 2021-05-24T16:01:16

fireeye-cm-release-quarantined-emails

Releases and deletes quarantined emails. This is not available when Email Security is in Drop mode.

Base Command

fireeye-cm-release-quarantined-emails

Input

Argument Name Description Required
queue_ids A comma-separated list of quarantined email queue IDs. Supports up to 100 IDs. Required
sensor_name The sensor display name. Required

Context Output

There is no context output for this command.

fireeye-cm-delete-quarantined-emails

Deletes quarantined emails. This is not available when Email Security is in Drop mode.

Base Command

fireeye-cm-delete-quarantined-emails

Input

Argument Name Description Required
queue_ids A comma-separated list of quarantined email queue IDs. Supports up to 100 IDs. Required
sensor_name The sensor display name. Required

Context Output

There is no context output for this command.

fireeye-cm-download-quarantined-emails

Download quarantined emails.

Base Command

fireeye-cm-download-quarantined-emails

Input

Argument Name Description Required
queue_id The quarantined emails queue ID. Required
sensor_name The sensor display name. Required

Context Output

Path Type Description
File.Name String The name of the email.
File.MD5 String The MD5 hash of the email.
File.SHA1 String The SHA1 hash of the email.
File.SHA256 String The SHA256 hash of the email.
File.Type String The file type.
File.Size Number The size of the email in bytes.
File.SSDeep String The SSDeep hash of the email.

Command Example

!fireeye-cm-download-quarantined-emails sensor_name=FireEyeEX queue_id=test

Context Example

{
    "File": {
        "EntryID": "420@2c246757-e02c-458a-8620-dbc236283fb8",
        "Extension": "eml",
        "Info": "message/rfc822",
        "MD5": "634996e695399dfc43488047c8316eaf",
        "Name": "quarantined_email_4FpWV31wpbzTgF9.eml",
        "SHA1": "5e6f89930c81da3f562eb630b4f881315bb56103",
        "SHA256": "218f9c5975dc12e3e3857474669cda62df063051a46213042f5b404ae8bf138f",
        "SHA512": "a7c19471fb4f2b752024246c28a37127ea7475148c04ace743392334d0ecc4762baf30b892d6a24b335e1065b254166f905fc46cc3ba5dba89e757bb7023a211",
        "SSDeep": "6:tnWrw+bcnWd4jXQ93f9FfZPny8ZijRSF1OZKi1rzfSY4SXfT8oERf:tnWrwWcnWd4M9fZvy8SUF184MfPE5",
        "Size": 269,
        "Type": "RFC 822 mail text, ASCII text"
    }
}

Human Readable Output

fireeye-cm-get-reports

Returns reports on selected alerts.

Base Command

fireeye-cm-get-reports

Input

Argument Name Description Required
report_type The report type. Requests for ipsTopNAttack, ipsTopNAttacker, ipsTopNVictim, or ipsTopNMvxVerified reports must be used with the limit parameter set to either 25, 50, 75, or 100. You must have an Intrusion Prevention System (IPS)-enabled appliance to be able to generate the IPS reports. Possible values are: empsEmailAVReport, empsEmailActivity, empsEmailExecutiveSummary, empsEmailHourlyStat, mpsCallBackServer, mpsExecutiveSummary, mpsInfectedHostsTrend, mpsMalwareActivity, mpsWebAVReport, ipsExecutiveSummary, ipsTopNAttack, ipsTopNAttacker, ipsTopNVictim, ipsTopNMvxVerified, alertDetailsReport. Required
start_time The start time of the search. This filter is optional. Syntax: start_time=YYYY-MM-DDTHH:mm:ss.sss-OH:om or ‘1 day/month/year’. Default is 1 week. Optional
end_time Specifies the end time of the search. Default is now. Syntax: end_time=YYYY-MM-DDTHH:mm:ss.sss-OH:om or ‘1 day/month/year’. Optional
limit The maximum number of items covered by each report. This option is required only for IPS TopN reports. Default is 100. Optional
interface The internet interface to one of the values. This option is required only for IPS reports. Possible values are: A, B, AB. Optional
alert_id Alert ID. This argument is only relevant when retrieving a report of type alertDetailsReport. Optional
infection_id Infection ID. This argument is only relevant when retrieving a report of type alertDetailsReport with conjunction to the infection_type argument. Optional
infection_type Infection type. Possible values: “malware-object”, “malware-callback”, “infection-match”, “domain-match”, “web-infection”. This argument is only relevant when retrieving a report of type alertDetailsReport with conjunction to the infection_id argument. Possible values are: malware-object, malware-callback, infection-match, domain-match, web-infection. Optional
timeout Timeout to retrieve the reports. Default is 120 seconds. Optional

Context Output

Path Type Description
InfoFile.EntryID string The EntryID of the artifact file.
InfoFile.Extension string The extension of the artifact file.
InfoFile.Name string The name of the artifact file.
InfoFile.Info string The info of the artifact file.
InfoFile.Size number The size of the artifact file.
InfoFile.Type string The type of the artifact file.

Command Example

``````

Human Readable Output

Known Limitations

Clicking the Test button of the Integration instance settings window verifies that the instance configuration is correct.
Due to a known limitation, clicking the Test button several times in quick succession may result in an “Unauthorized” error, even after a successful result was initially returned. It is enough to receive one success message to verify that the configuration is correct. “Unauthorized” error messages received from repeated clicking of the instance configuration Test button do not affect the validity of the instance if the initial response was successful.

Configuration parameters

  • url — Your server URL (required)
  • credentials — Username (required)
  • isFetch — Fetch incidents
  • max_fetch — Max incidents to fetch
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • info_level — Info level for fetched alerts
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (11)

  • fireeye-cm-alert-acknowledge

    Confirms that the alert has been reviewed.

  • fireeye-cm-delete-quarantined-emails

    Deletes quarantined emails. This is not available when Email Security is in Drop mode.

  • fireeye-cm-download-quarantined-emails

    Download quarantined emails.

  • fireeye-cm-get-alert-details

    Searches and retrieves the details of a single alert.

  • fireeye-cm-get-alerts

    Searches and retrieves FireEye CM alerts based on several filters.

  • fireeye-cm-get-artifacts-by-uuid

    Downloads malware artifacts data for the specified UUID as a zip file.

  • fireeye-cm-get-artifacts-metadata-by-uuid

    Gets artifacts metadata for the specified UUID.

  • fireeye-cm-get-events

    Retrieves information about existing IPS NX events. An IPS enabled appliance is a prerequisite to be able to retrieve IPS event data.

  • fireeye-cm-get-quarantined-emails

    Searches and retrieves quarantined emails.

  • fireeye-cm-get-reports

    Returns reports on selected alerts.

  • fireeye-cm-release-quarantined-emails

    Releases and deletes quarantined emails. This is not available when Email Security is in Drop mode.

Source

FireEyeCM.py FireEyeCM_test.py FireEyeCM.yml FireEyeCM_description.md command_examples.txt
Download History Raw 
category: Analytics & SIEM
sectionorder:
- Connect
- Collect
provider: Trellix
commonfields:
  id: FireEye Central Management
  version: -1
configuration:
- defaultvalue: https://example.com/
  display: Your server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  type: 9
  required: true
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- defaultvalue: '50'
  display: Max incidents to fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- defaultvalue: 'concise'
  display: Info level for fetched alerts
  name: info_level
  options:
  - 'concise'
  - 'normal'
  - 'extended'
  type: 15
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: "FireEye Central Management (CM Series) is the FireEye threat intelligence hub. It services the FireEye ecosystem, ensuring that FireEye products share the latest intelligence and correlate across attack vectors to detect and prevent cyber attacks."
display: FireEye Central Management
name: FireEye Central Management
script:
  commands:
  - arguments:
    - description: The ID number of the alert to retrieve.
      name: alert_id
    - description: "The time interval to search. This filter is used with either the start_time or end_time filter. If duration, start time, and end time are not specified, the system defaults to duration=12_hours, end_time=current_time. If only the duration is specified, the end_time defaults to the current_time."
      auto: PREDEFINED
      predefined:
      - '1_hour'
      - '2_hours'
      - '6_hours'
      - '12_hours'
      - '24_hours'
      - '48_hours'
      name: duration
    - description: "The start time of the search. This filter is optional. Syntax: start_time=YYYY-MM-DDTHH:mm:ss.sss-OH:om or '1 day/month/year'. Default is 1 day."
      name: start_time
    - description: "The end time of the search. This filter is used with the duration filter. If the end_time is specified but not the duration, the system defaults to duration=12_hours, ending at the specified end_time. Syntax: end_time=YYYY-MM-DDTHH:mm:ss.sss-OH:om."
      name: end_time
    - description: Searches for alerts that include callbacks to the specified domain.
      name: callback_domain
    - description: The destination IPv4 address related to the malware alert.
      name: dst_ip
    - description: The source IPv4 address related to the malware alert.
      name: src_ip
    - description: The name of the malware file.
      name: file_name
    - description: The malware file type.
      name: file_type
    - defaultValue: 'concise'
      description: 'The level of information to be returned. Possible values: "concise", "normal", and "extended".'
      auto: PREDEFINED
      predefined:
      - 'concise'
      - 'normal'
      - 'extended'
      name: info_level
    - description: The name of the malware object.
      name: malware_name
    - description: 'The type of the malware object. Possible values: "domain_match", "malware_callback", "malware_object", "web_infection", "infection_match", "riskware-infection", "riskware-callback", "riskware-object".'
      predefined:
      - 'domain_match'
      - 'malware_callback'
      - 'malware_object'
      - 'web_infection'
      - 'infection_match'
      - 'riskware-infection'
      - 'riskware-callback'
      - 'riskware-object'
      name: malware_type
    - description: Searches for alerts that include a specific MD5 hash.
      name: md5
    - description: The email address of the malware object receiver.
      name: recipient_email
    - description: The email address of the malware object sender.
      name: sender_email
    - description: Searches for a specific alert URL.
      name: url
    - defaultValue: '20'
      description: Maximum number of alerts to return.
      name: limit
    - defaultValue: '120'
      description: Timeout (in seconds) to retrieve the alerts.
      name: timeout
    description: Searches and retrieves FireEye CM alerts based on several filters.
    name: fireeye-cm-get-alerts
    outputs:
    - contextPath: FireEyeCM.Alerts.id
      description: The ID of the alert.
      type: String
    - contextPath: FireEyeCM.Alerts.uuid
      description: The UUID of the alert.
      type: String
    - contextPath: FireEyeCM.Alerts.occurred
      description: The time when the alert occurred.
      type: String
    - contextPath: FireEyeCM.Alerts.product
      description: The product name of the alert.
      type: String
    - contextPath: FireEyeCM.Alerts.rootInfection
      description: The ID of the infection associated with the malware alert.
      type: String
    - contextPath: FireEyeCM.Alerts.name
      description: The link to the infection associated with the malware alert.
      type: String
    - contextPath: FireEyeCM.Alerts.vlan
      description: The virtual LAN (VLAN) of the alert.
      type: String
    - contextPath: FireEyeCM.Alerts.malicious
      description: A flag indicating whether the alert is malicious.
      type: String
    - contextPath: FireEyeCM.Alerts.severity
      description: The severity of the alert.
      type: String
    - contextPath: FireEyeCM.Alerts.sensor
      description: The sensor name that the alert is associated with.
      type: String
    - contextPath: FireEyeCM.Alerts.applianceId
      description: The appliance ID of the alert.
      type: String
    - contextPath: FireEyeCM.Alerts.sensorIp
      description: The sensor IP that the alert is associated with.
      type: String
    - contextPath: FireEyeCM.Alerts.ack
      description: A flag indicating whether an acknowledgment is received.
      type: String
    - contextPath: FireEyeCM.Alerts.src
      description: The source of the alert.
      type: Unknown
    - contextPath: FireEyeCM.Alerts.dst
      description: The destination of the alert.
      type: Unknown
    - contextPath: FireEyeCM.Alerts.explanation
      description: The explanation data of the alert.
      type: Unknown
  - arguments:
    - description: The ID of the alert for which to retrieve its details.
      isArray: true
      name: alert_id
      required: true
    - defaultValue: '30'
      description: Timeout (in seconds) to retrieve the alert details.
      name: timeout
    description: Searches and retrieves the details of a single alert.
    name: fireeye-cm-get-alert-details
    outputs:
    - contextPath: FireEyeCM.Alerts.id
      description: The ID of the alert.
      type: String
    - contextPath: FireEyeCM.Alerts.uuid
      description: The UUID of the alert.
      type: String
    - contextPath: FireEyeCM.Alerts.occurred
      description: The time when the alert occurred.
      type: String
    - contextPath: FireEyeCM.Alerts.product
      description: The product name of the alert.
      type: String
    - contextPath: FireEyeCM.Alerts.rootInfection
      description: The ID of the infection associated with the malware alert.
      type: String
    - contextPath: FireEyeCM.Alerts.name
      description: The link to the infection associated with the malware alert.
      type: String
    - contextPath: FireEyeCM.Alerts.vlan
      description: The virtual LAN (VLAN) of the alert.
      type: String
    - contextPath: FireEyeCM.Alerts.malicious
      description: A flag indicating whether the alert is malicious.
      type: String
    - contextPath: FireEyeCM.Alerts.severity
      description: The severity of the alert.
      type: String
    - contextPath: FireEyeCM.Alerts.sensor
      description: The sensor name that the alert is associated with.
      type: String
    - contextPath: FireEyeCM.Alerts.applianceId
      description: The appliance ID of the alert.
      type: String
    - contextPath: FireEyeCM.Alerts.sensorIp
      description: The sensor IP that the alert is associated with.
      type: String
    - contextPath: FireEyeCM.Alerts.ack
      description: A flag indicating whether an acknowledgment is received.
      type: String
    - contextPath: FireEyeCM.Alerts.src
      description: The source of the alert.
      type: Unknown
    - contextPath: FireEyeCM.Alerts.dst
      description: The destination of the alert.
      type: Unknown
    - contextPath: FireEyeCM.Alerts.explanation
      description: The explanation data of the alert.
      type: Unknown
  - arguments:
    - description: The universally unique identifier (UUID) for the alert.
      isArray: true
      name: uuid
      required: true
    description: Confirms that the alert has been reviewed.
    name: fireeye-cm-alert-acknowledge
  - arguments:
    - description: The universally unique identifier (UUID) for the alert.
      isArray: true
      name: uuid
      required: true
    - defaultValue: '120'
      description: Timeout (in seconds) to retrieve the artifacts.
      name: timeout
    description: Downloads malware artifacts data for the specified UUID as a zip file.
    name: fireeye-cm-get-artifacts-by-uuid
    outputs:
    - contextPath: InfoFile.EntryID
      description: The EntryID of the artifact file.
      type: string
    - contextPath: InfoFile.Extension
      description: The extension of the artifact file.
      type: string
    - contextPath: InfoFile.Name
      description: The name of the artifact file.
      type: string
    - contextPath: InfoFile.Info
      description: The info of the artifact file.
      type: string
    - contextPath: InfoFile.Size
      description: The size of the artifact file.
      type: number
    - contextPath: InfoFile.Type
      description: The type of the artifact file.
      type: string
  - arguments:
    - description: The universally unique identifier (UUID) for the alert.
      isArray: true
      name: uuid
      required: true
    description: Gets artifacts metadata for the specified UUID.
    name: fireeye-cm-get-artifacts-metadata-by-uuid
    outputs:
    - contextPath: FireEyeCM.Alerts.uuid
      description: Universally unique ID (UUID) of the alert.
      type: string
    - contextPath: FireEyeCM.Alerts.artifactsInfoList.artifactType
      description: The artifact type.
      type: string
    - contextPath: FireEyeCM.Alerts.artifactsInfoList.artifactName
      description: The artifact name.
      type: string
    - contextPath: FireEyeCM.Alerts.artifactsInfoList.artifactSize
      description: The zipped artifact size in bytes.
      type: string
  - arguments:
    - description: The time interval in which to search. This filter is used with the end_time filter. If the duration is not specified, the system defaults to duration=12_hours, end_time=current_time.
      auto: PREDEFINED
      predefined:
      - '1_hour'
      - '2_hours'
      - '6_hours'
      - '12_hours'
      - '24_hours'
      - '48_hours'
      name: duration
    - description: "The end time of the search. This filter is used with the duration filter. If the end_time is specified but not the duration, the system defaults to duration=12_hours, ending at the specified end_time. Syntax: end_time=YYYY-MM-DDTHH:mm:ss.sss-OH:om"
      name: end_time
    - defaultValue: 'false'
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
      description: 'Specifies whether to include all IPS events or MVX-correlated events only. Possible values: "true" and "false".'
      name: mvx_correlated_only
    - defaultValue: '20'
      description: Maximum number of events to return.
      name: limit
    description: Retrieves information about existing IPS NX events. An IPS enabled appliance is a prerequisite to be able to retrieve IPS event data.
    name: fireeye-cm-get-events
    outputs:
    - contextPath: FireEyeCM.Events.eventId
      description: The ID of the event.
      type: Number
    - contextPath: FireEyeCM.Events.occurred
      description: The date and time when the event occurred.
      type: string
    - contextPath: FireEyeCM.Events.srcIp
      description: The IP address of the victim.
      type: string
    - contextPath: FireEyeCM.Events.srcPort
      description: The port address of the victim.
      type: Number
    - contextPath: FireEyeCM.Events.dstIp
      description: The IP address of the attacker.
      type: string
    - contextPath: FireEyeCM.Events.dstPort
      description: The port address of the attacker.
      type: Number
    - contextPath: FireEyeCM.Events.vlan
      description: The virtual LAN (VLAN) of the event.
      type: Number
    - contextPath: FireEyeCM.Events.signatureMatchCnt
      description: The date and time when the event occurred.
      type: String
    - contextPath: FireEyeCM.Events.signatureId
      description: The ID of the event.
      type: String
    - contextPath: FireEyeCM.Events.signatureRev
      description: The date and time when the event occurred.
      type: String
    - contextPath: FireEyeCM.Events.severity
      description: The ID of the event.
      type: String
    - contextPath: FireEyeCM.Events.vmVerified
      description: The date and time when the event occurred.
      type: String
    - contextPath: FireEyeCM.Events.srcMac
      description: The MAC address of the source machine.
      type: String
    - contextPath: FireEyeCM.Events.dstMac
      description: The MAC address of the destination machine.
      type: String
    - contextPath: FireEyeCM.Events.ruleName
      description: The rule name for the event.
      type: String
    - contextPath: FireEyeCM.Events.sensorId
      description: The sensor ID of the FireEye machine.
      type: String
    - contextPath: FireEyeCM.Events.cveId
      description: The CVE ID found in the event.
      type: String
    - contextPath: FireEyeCM.Events.actionTaken
      description: The IPS blocking action taken on the event.
      type: String
    - contextPath: FireEyeCM.Events.attackMode
      description: The attack mode mentioned in the event.
      type: String
    - contextPath: FireEyeCM.Events.interfaceId
      description: The interface ID of the event.
      type: Number
    - contextPath: FireEyeCM.Events.protocol
      description: The protocol used in the event.
      type: Number
    - contextPath: FireEyeCM.Events.incidentId
      description: The incident ID of the event on FireEye.
      type: Number
  - arguments:
    - defaultValue: '1 day'
      description: "Specifies the start time of the search. This filter is optional. Default is last day. Syntax: start_time=YYYY-MM-DDTHH:mm:ss.sss-OH:om or '1 day/month/year'."
      name: start_time
    - description: "Specifies the end time of the search. Default is now. Syntax: end_time=YYYY-MM-DDTHH:mm:ss.sss-OH:om or '1 day/month/year'."
      name: end_time
    - description: The sender email.
      name: from
    - description: The email subject. Must be URL encoded.
      name: subject
    - description: The appliance ID.
      name: appliance_id
    - defaultValue: '20'
      description: Number of emails to return.
      name: limit
    description: Searches and retrieves quarantined emails.
    name: fireeye-cm-get-quarantined-emails
    outputs:
    - contextPath: FireEyeCM.QuarantinedEmail.appliance_id
      description: The appliance ID associated with the quarantined email.
      type: string
    - contextPath: FireEyeCM.QuarantinedEmail.completed_at
      description: The time the email has been quarantined.
      type: string
    - contextPath: FireEyeCM.QuarantinedEmail.email_uuid
      description: The quarantined email UUID.
      type: string
    - contextPath: FireEyeCM.QuarantinedEmail.from
      description: The quarantined email sender.
      type: string
    - contextPath: FireEyeCM.QuarantinedEmail.message_id
      description: The quarantined email message ID.
      type: string
    - contextPath: FireEyeCM.QuarantinedEmail.quarantine_path
      description: The quarantined email path.
      type: string
    - contextPath: FireEyeCM.QuarantinedEmail.The quarantined email queue id.
      description: The quarantined email queue ID.
      type: string
    - contextPath: FireEyeCM.QuarantinedEmail.subject
      description: The quarantined email subject.
      type: string
  - arguments:
    - description: A comma-separated list of quarantined email queue IDs. Supports up to 100 IDs.
      isArray: true
      name: queue_ids
      required: true
    - description: The sensor display name.
      name: sensor_name
      required: true
    description: Releases and deletes quarantined emails. This is not available when Email Security is in Drop mode.
    name: fireeye-cm-release-quarantined-emails
  - arguments:
    - description: A comma-separated list of quarantined email queue IDs. Supports up to 100 IDs.
      isArray: true
      name: queue_ids
      required: true
    - description: The sensor display name.
      name: sensor_name
      required: true
    description: Deletes quarantined emails. This is not available when Email Security is in Drop mode.
    name: fireeye-cm-delete-quarantined-emails
  - arguments:
    - description: The quarantined emails queue ID.
      name: queue_id
      required: true
    - description: The sensor display name.
      name: sensor_name
      required: true
    - defaultValue: '120'
      description: Timeout (in seconds) to retrieve the reports.
      name: timeout
    description: Download quarantined emails.
    name: fireeye-cm-download-quarantined-emails
    outputs:
    - contextPath: File.Name
      description: The name of the email.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the email.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the email.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the email.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.Size
      description: The size of the email in bytes.
      type: Number
    - contextPath: File.SSDeep
      description: The SSDeep hash of the email.
      type: String
  - arguments:
    - description: "The report type. Requests for ipsTopNAttack, ipsTopNAttacker, ipsTopNVictim, or ipsTopNMvxVerified reports must be used with the limit parameter set to either 25, 50, 75, or 100. You must have an Intrusion Prevention System (IPS)-enabled appliance to be able to generate the IPS reports."
      auto: PREDEFINED
      predefined:
      - 'empsEmailAVReport'
      - 'empsEmailActivity'
      - 'empsEmailExecutiveSummary'
      - 'empsEmailHourlyStat'
      - 'mpsCallBackServer'
      - 'mpsExecutiveSummary'
      - 'mpsInfectedHostsTrend'
      - 'mpsMalwareActivity'
      - 'mpsWebAVReport'
      - 'ipsExecutiveSummary'
      - 'ipsTopNAttack'
      - 'ipsTopNAttacker'
      - 'ipsTopNVictim'
      - 'ipsTopNMvxVerified'
      - 'alertDetailsReport'
      name: report_type
      required: true
    - defaultValue: '1 week'
      description: "The start time of the search. This filter is optional. Syntax: start_time=YYYY-MM-DDTHH:mm:ss.sss-OH:om or '1 day/month/year'."
      name: start_time
    - description: "Specifies the end time of the search. Default is now. Syntax: end_time=YYYY-MM-DDTHH:mm:ss.sss-OH:om or '1 day/month/year'."
      name: end_time
    - defaultValue: '100'
      description: The maximum number of items covered by each report. This option is required only for IPS TopN reports.
      name: limit
    - auto: PREDEFINED
      predefined:
      - 'A'
      - 'B'
      - 'AB'
      description: The internet interface to one of the values. This option is required only for IPS reports.
      name: interface
    - description: Alert ID. This argument is only relevant when retrieving a report of type alertDetailsReport.
      name: alert_id
    - description: Infection ID. This argument is only relevant when retrieving a report of type alertDetailsReport with conjunction to the infection_type argument.
      name: infection_id
    - description: 'Infection type. Possible values: "malware-object", "malware-callback", "infection-match", "domain-match", "web-infection". This argument is only relevant when retrieving a report of type alertDetailsReport with conjunction to the infection_id argument.'
      auto: PREDEFINED
      predefined:
      - 'malware-object'
      - 'malware-callback'
      - 'infection-match'
      - 'domain-match'
      - 'web-infection'
      name: infection_type
    - defaultValue: '120'
      description: Timeout (in seconds) to retrieve the reports.
      name: timeout
    description: Returns reports on selected alerts.
    name: fireeye-cm-get-reports
    outputs:
    - contextPath: InfoFile.EntryID
      description: The EntryID of the artifact file.
      type: string
    - contextPath: InfoFile.Extension
      description: The extension of the artifact file.
      type: string
    - contextPath: InfoFile.Name
      description: The name of the artifact file.
      type: string
    - contextPath: InfoFile.Info
      description: The info of the artifact file.
      type: string
    - contextPath: InfoFile.Size
      description: The size of the artifact file.
      type: number
    - contextPath: InfoFile.Type
      description: The type of the artifact file.
      type: string
  isfetch: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 5.5.0
tests:
- FireEye Central Management - Test