FireEye HX Event Collector

Details

ID	`FireEye HX Event Collector`
Provider	Trellix
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Palo Alto Networks FireEye HX Event Collector integration for XSIAM.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure FireEye HX Event Collector in Cortex

Parameter	Description	Required
Server URL (e.g., https://192.168.0.1:3000)		True
User Name		True
Password		True
Trust any certificate (not secure)		False
Use system proxy settings		False
The maximum number of events per fetch.	The maximum number of events to fetch every time fetch is executed.	False
First Fetch Time	The First Fetch Time, e.g., 1 hour, 3 days	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

fireeye-hx-get-events

Manual command to fetch events and display them.

Base Command

fireeye-hx-get-events

Input

Argument Name	Description	Required
limit	The maximum number of events to get.	Optional
since	Occurrence time of the least recent event to include (inclusive). Default is 3 days.	Optional
should_push_events	If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false.	Required

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (e.g., https://192.168.0.1:3000) (required)
credentials — User Name (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
max_fetch — The maximum number of events per fetch.
first_fetch — First Fetch Time

Commands (1)

fireeye-hx-get-events
Manual command to fetch events and display them.

Source

FireEyeHXEventCollector.py FireEyeHXEventCollector_test.py FireEyeHXEventCollector.yml

Download History Raw

category: Analytics & SIEM
provider: Trellix
description: Palo Alto Networks FireEye HX Event Collector integration for XSIAM.
display: FireEye HX Event Collector
name: FireEye HX Event Collector
commonfields:
  id: FireEye HX Event Collector
  version: -1
configuration:
- display: Server URL (e.g., https://192.168.0.1:3000)
  name: url
  required: true
  type: 0
- display: User Name
  name: credentials
  required: true
  type: 9
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: The maximum number of events per fetch.
  additionalinfo: The maximum number of events to fetch every time fetch is executed.
  defaultvalue: 1000
  name: max_fetch
  type: 0
  section: Collect
  required: false
- additionalinfo: The first fetch time, e.g., 1 hour, 3 days
  display: First Fetch Time
  defaultvalue: 3 days
  name: first_fetch
  type: 0
  section: Collect
  required: false
script:
  commands:
  - description: Manual command to fetch events and display them.
    name: fireeye-hx-get-events
    arguments:
    - name: limit
      description: The maximum number of events to get.
    - name: since
      description: Occurrence time of the least recent event to include (inclusive).
      defaultValue: 3 days
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the command will create events, otherwise it will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
supportedModules:
- xsiam