FireEye Central Management

FireEye Central Management (CM Series) is the FireEye threat intelligence hub. It services the FireEye ecosystem, ensuring that FireEye products share the latest intelligence and correlate across attack vectors to detect and prevent cyber attacks
This integration was integrated and tested with version 9.0.2 of FireEye Central Management

API Key management

This integration generates an API Key from the username and password given to be authenticated with FireEye.
The API Key is valid for 15 minutes.
The integration manages the storage of this key, and its re-generation when the key expires.

Fetch FireEye EX Alert Emails

To fetch a FireEye EX alert email, you will need the UUID.

1. Run the fireeye-cm-get-alert-details** command with the alert ID. For example,
   **!fireeye-cm-get-alert-details alert_id=542*
2. Locate the UUID in the context data and run the fireeye-cm-get-artifacts-by-uuid command with the UUID. For example:
   !fireeye-cm-get-artifacts-by-uuid uuid=243a2555-a915-47a1-a947-e71049f4971c
3. Download the email.

Access the FireEye Alert URL

To display a proper link in the FireEye NX Alert URL field of the FireEye NX or EX Alert layout, you need to configure the hostname in the appliance settings of the FireEye application.

1. Log in to your FireEye application.
2. Navigate to Appliance Settings > Network > Hostname.
3. In the Hostname field, enter your URL/server/ip address.

Configure FireEye Central Management in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

fireeye-cm-get-alerts

Searches and retrieves FireEye CM alerts based on several filters.

Base Command

fireeye-cm-get-alerts

Input

Context Output

Command Example

#### Context Example

```json
{
    "FireEyeCM": {
        "Alerts": [
            {
                "ack": "no",
                "action": "notified",
                "alertUrl": "https://FireEyeCM/event_stream/events_for_bot?ev_id=35685",
                "applianceId": "test",
                "attackTime": "2021-06-10 21:52:43 +0000",
                "dst": {
                    "ip": "1.1.1.1",
                    "mac": "00:50:56:94:b8:42",
                    "port": 443
                },
                "explanation": {
                    "malwareDetected": {
                        "malware": [
                            {
                                "name": "Trojan.Malicious.SSL.Certificate.Dridex"
                            }
                        ]
                    },
                    "osChanges": []
                },
                "id": 35685,
                "malicious": "yes",
                "name": "MALWARE_CALLBACK",
                "occurred": "2021-06-10 21:52:43 +0000",
                "product": "WEB_MPS",
                "rootInfection": 34670,
                "scVersion": "1163.102",
                "sensor": "sensor",
                "sensorIp": "1.1.1.1",
                "severity": "CRIT",
                "src": {
                    "ip": "1.1.1.1",
                    "port": 8080
                },
                "uuid": "529023c0-6ddf-4933-9241-fe4ec71a788e",
                "vlan": 0
            }
        ]
    }
}

Human Readable Output

FireEye Central Management Alerts

id	occurred	product	name	malicious	severity	alertUrl
35685	2021-06-10 21:52:43 +0000	WEB_MPS	MALWARE_CALLBACK	yes	CRIT	https://FireEyeCM/event_stream/events_for_bot?ev_id=35685

fireeye-cm-get-alert-details

Searches and retrieves the details of a single alert.

Base Command

fireeye-cm-get-alert-details

Input

Context Output

Command Example

!fireeye-cm-get-alert-details alert_id=35685

Context Example

{
    "FireEyeCM": {
        "Alerts": {
            "ack": "no",
            "action": "notified",
            "alertUrl": "https://FireEyeCM/event_stream/events_for_bot?ev_id=35685",
            "applianceId": "test",
            "attackTime": "2021-06-10 21:52:43 +0000",
            "dst": {
                "ip": "1.1.1.1",
                "mac": "00:50:56:94:b8:42",
                "port": 443
            },
            "explanation": {
                "malwareDetected": {
                    "malware": [
                        {
                            "name": "Trojan.Malicious.SSL.Certificate.Dridex"
                        }
                    ]
                },
                "osChanges": []
            },
            "id": 35685,
            "malicious": "yes",
            "name": "MALWARE_CALLBACK",
            "occurred": "2021-06-10 21:52:43 +0000",
            "product": "WEB_MPS",
            "rootInfection": 34670,
            "scVersion": "1163.102",
            "sensor": "sensor",
            "sensorIp": "1.1.1.1",
            "severity": "CRIT",
            "src": {
                "ip": "1.1.1.1",
                "port": 8080
            },
            "uuid": "529023c0-6ddf-4933-9241-fe4ec71a788e",
            "vlan": 0
        }
    }
}

Human Readable Output

FireEye Central Management Alerts

id	occurred	product	name	malicious	action	src	dst	severity	alertUrl
35685	2021-06-10 21:52:43 +0000	WEB_MPS	MALWARE_CALLBACK	yes	notified	ip: 34.252.247.142 port: 51270	mac: 00:50:56:94:b8:42 port: 443 ip: 192.168.1.202	CRIT	https://FireEyeCM/event_stream/events_for_bot?ev_id=35685

fireeye-cm-alert-acknowledge

Confirms that the alert has been reviewed.

Base Command

fireeye-cm-alert-acknowledge

Input

Context Output

There is no context output for this command.

Command Example

!fireeye-cm-alert-acknowledge uuid=529023c0-6ddf-4933-9241-fe4ec71a788e

Human Readable Output

Alert 529023c0-6ddf-4933-9241-fe4ec71a788e was acknowledged successfully.

fireeye-cm-get-artifacts-by-uuid

Downloads malware artifacts data for the specified UUID as a zip file.

Base Command

fireeye-cm-get-artifacts-by-uuid

Input

Context Output

Command Example

!fireeye-cm-get-artifacts-by-uuid uuid=b38b83a0-4b96-408c-999f-4e97a5099f61

Context Example

{
    "InfoFile": {
        "EntryID": "400@2c246757-e02c-458a-8620-dbc236283fb8",
        "Extension": "zip",
        "Info": "application/zip",
        "Name": "artifacts_b38b83a0-4b96-408c-999f-4e97a5099f61.zip",
        "Size": 5501,
        "Type": "Zip archive data, at least v2.0 to extract"
    }
}

Human Readable Output

fireeye-cm-get-artifacts-metadata-by-uuid

Gets artifacts metadata for the specified UUID.

Base Command

fireeye-cm-get-artifacts-metadata-by-uuid

Input

Context Output

Command Example

!fireeye-cm-get-artifacts-metadata-by-uuid uuid=b38b83a0-4b96-408c-999f-4e97a5099f61

Context Example

{
    "FireEyeCM": {
        "Alerts": {
            "artifactsInfoList": [
                {
                    "artifactName": "34.252.247.142-192.168.1.202-1620538334558058-33354739.txt.gz",
                    "artifactSize": "1641",
                    "artifactType": "l7_context_file"
                },
                {
                    "artifactName": "192.168.1.202-34.252.247.142-1620538334557811-33354739-cs.pcap",
                    "artifactSize": "3645",
                    "artifactType": "bott_communication_capture"
                }
            ],
            "uuid": "b38b83a0-4b96-408c-999f-4e97a5099f61"
        }
    }
}

Human Readable Output

FireEye Central Management b38b83a0-4b96-408c-999f-4e97a5099f61 Artifact metadata

artifactName	artifactSize	artifactType
34.252.247.142-192.168.1.202-1620538334558058-33354739.txt.gz	1641	l7_context_file
192.168.1.202-34.252.247.142-1620538334557811-33354739-cs.pcap	3645	bott_communication_capture

fireeye-cm-get-events

Retrieves information about existing IPS NX events. An IPS enabled appliance is a prerequisite to be able to retrieve IPS event data.

Base Command

fireeye-cm-get-events

Input

Context Output

Command Example

!fireeye-cm-get-events duration="48_hours" end_time="2021-05-14T01:08:04.000-02:00" mvx_correlated_only="true"

Human Readable Output

No events in the given timeframe were found.

fireeye-cm-get-quarantined-emails

Searches and retrieves quarantined emails.

Base Command

fireeye-cm-get-quarantined-emails

Input

Context Output

Command Example

!fireeye-cm-get-quarantined-emails start_time="1 month" limit=4

Context Example

{
    "FireEyeCM": {
        "QuarantinedEmail": [
            {
                "appliance_id": "test",
                "completed_at": "2021-05-24T09:04:03",
                "email_uuid": "d7738eb0-7fe7-4b5d-8fcb-2b053ef57e13",
                "from": "test@malicious.net",
                "message_id": "queue-id-test@no-message-id",
                "quarantine_path": "/data/email-analysis/quarantine2/2021-05-24/09/test",
                "queue_id": "4FpWV31wpbzTgF9",
                "subject": "test"
            },
            {
                "appliance_id": "test",
                "completed_at": "2021-05-24T16:01:16",
                "email_uuid": "9e73ca23-b935-47c2-8d2a-fe1a10071db2",
                "from": "test@malicious.net",
                "message_id": "queue-id-test@no-message-id",
                "quarantine_path": "/data/email-analysis/quarantine2/2021-05-24/16/test",
                "queue_id": "test",
                "subject": "test"
            },
            {
                "appliance_id": "test",
                "completed_at": "2021-05-24T16:01:16",
                "email_uuid": "e7b52446-555d-40d0-b8ad-e8f1f2a7ab7a",
                "from": "test@malicious.net",
                "message_id": "queue-id-test@no-message-id",
                "quarantine_path": "/data/email-analysis/quarantine2/2021-05-24/16/test",
                "queue_id": "test",
                "subject": "test"
            },
            {
                "appliance_id": "test",
                "completed_at": "2021-05-24T16:01:16",
                "email_uuid": "ebb991b5-06ef-44f4-b44d-e1daef67ce70",
                "from": "test@malicious.net",
                "message_id": "queue-id-test@no-message-id",
                "quarantine_path": "/data/email-analysis/quarantine2/2021-05-24/16/test",
                "queue_id": "test",
                "subject": "test"
            }
        ]
    }
}

Human Readable Output

FireEye Central Management Quarantined emails

email_uuid	from	subject	message_id	completed_at
d7738eb0-7fe7-4b5d-8fcb-2b053ef57e13	test@malicious.net	test	queue-id-test@no-message-id	2021-05-24T09:04:03
9e73ca23-b935-47c2-8d2a-fe1a10071db2	test@malicious.net	test	queue-id-test@no-message-id	2021-05-24T16:01:16
e7b52446-555d-40d0-b8ad-e8f1f2a7ab7a	test@malicious.net	test	queue-id-test@no-message-id	2021-05-24T16:01:16
ebb991b5-06ef-44f4-b44d-e1daef67ce70	test@malicious.net	test	queue-id-test@no-message-id	2021-05-24T16:01:16

fireeye-cm-release-quarantined-emails

Releases and deletes quarantined emails. This is not available when Email Security is in Drop mode.

Base Command

fireeye-cm-release-quarantined-emails

Input

Context Output

There is no context output for this command.

fireeye-cm-delete-quarantined-emails

Deletes quarantined emails. This is not available when Email Security is in Drop mode.

Base Command

fireeye-cm-delete-quarantined-emails

Input

Context Output

There is no context output for this command.

fireeye-cm-download-quarantined-emails

Download quarantined emails.

Base Command

fireeye-cm-download-quarantined-emails

Input

Context Output

Command Example

!fireeye-cm-download-quarantined-emails sensor_name=FireEyeEX queue_id=test

Context Example

{
    "File": {
        "EntryID": "420@2c246757-e02c-458a-8620-dbc236283fb8",
        "Extension": "eml",
        "Info": "message/rfc822",
        "MD5": "634996e695399dfc43488047c8316eaf",
        "Name": "quarantined_email_4FpWV31wpbzTgF9.eml",
        "SHA1": "5e6f89930c81da3f562eb630b4f881315bb56103",
        "SHA256": "218f9c5975dc12e3e3857474669cda62df063051a46213042f5b404ae8bf138f",
        "SHA512": "a7c19471fb4f2b752024246c28a37127ea7475148c04ace743392334d0ecc4762baf30b892d6a24b335e1065b254166f905fc46cc3ba5dba89e757bb7023a211",
        "SSDeep": "6:tnWrw+bcnWd4jXQ93f9FfZPny8ZijRSF1OZKi1rzfSY4SXfT8oERf:tnWrwWcnWd4M9fZvy8SUF184MfPE5",
        "Size": 269,
        "Type": "RFC 822 mail text, ASCII text"
    }
}

Human Readable Output

fireeye-cm-get-reports

Returns reports on selected alerts.

Base Command

fireeye-cm-get-reports

Input

Context Output

Command Example

``````

Human Readable Output

Known Limitations

Clicking the Test button of the Integration instance settings window verifies that the instance configuration is correct.
Due to a known limitation, clicking the Test button several times in quick succession may result in an “Unauthorized” error, even after a successful result was initially returned. It is enough to receive one success message to verify that the configuration is correct. “Unauthorized” error messages received from repeated clicking of the instance configuration Test button do not affect the validity of the instance if the initial response was successful.