fireeye

Perform malware dynamic analysis.

Forensics & Malware Analysis · FireEye (AX Series)

Details

ID	`fireeye`
Provider	Trellix
Category	Forensics & Malware Analysis
From Version	5.0.0
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

This article describes the way in which to set up the FireEye (AX Series) integration on Cortex XSOAR.

Setting up the FireEye Web Services API to work with Cortex XSOAR:

This section explains what needs to be done to set up a Fire Eye Web Services API for Cortex XSOAR integration on the FireEye side.

This integration supports AXSeriesWebServicesAPI versions 7.7.0 and up.

To use this integration, you need to have a Fire Eye user account of either api_analyst or api_monitor.

To set up the FireEye Web Services API:

1. On the machine where the FireEye API will run, open the CLI and enter the following:

hostname > enable

hostname # configure terminal

hostname (config) # wsapi enable

2. Make sure that FireEye Web Services API is running ether the following:

hostname(config)#showwsapi

The reply should indicate that the Server is ‘enabled’ and in ‘running’ state.

Setting up the integration on Cortex XSOAR:

1. Go to ‘Settings > Integrations > Servers & Services’

2. Locate the FireEye (AX Series) integration by searching for ‘FireEye’ using the search box on the top of the page.

3. Click ‘Add instance’ to create and configure a new integration. You should configure the following FireEye and Cortex XSOAR-specific settings:

Name: A textual name for the integration instance.
Server URL: The hostname or IP address of the FireEye’ application. Make sure the URL is reachable with respect to IP address and port.
Credentials and Password: Your FireEye username and password.
Do not validate server certificate: Select to avoid server certification validation. You may want to do this in case Cortex XSOAR cannot validate the integration server certificate (due to missing CA certificate)
Use system proxy settings – Mark this option.

4. Press the ‘Test’ button to validate connection.

5. After completing the test successfully, press the ‘Done’ button.

Commands:

fe-alert - FireEye view existing alert command. See the FireEye Web Services API Guide for details

fe-config - Configuration commands. See the FireEye Web Services API Guide for details

fe-report - Return a requested report

fe-submit - Submit a malware object for analysis by FireEye

fe-submit-result - Submission key of the submission

fe-submit-status - Get a status for a malware object submitted to FireEye analysis

fe-submit-url - Submit a URL to FireEye for analysis

fe-submit-url-status - Get the status of a URL submitted to FireEye for analysis

fe-submit-url-result

Results of the URL submission

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

fe-submit-url-result

Input

Argument Name	Description	Required
submissionID	Submission ID of the submission.	Required
info_level	Specifies the level of information to be returned. Unless otherwise specified, the info_level is set to concise. You can select the following information levels concise: (default), normal, extended. Possible values are: concise, normal, extended. Default is concise.	Optional

Context Output

Path	Type	Description
FireEyeAX.Submissions.Key	unknown	The submission key
FireEyeAX.Submissions.Severity	unknown	The severity level of the file
FireEyeAX.Submissions.InfoLevel	String	The info level of the report.
DBotScore.Score	unknown	The actual score
DBotScore.Indicator	unknown	The indicator we tested
DBotScore.Vendor	unknown	Vendor used to calculate the score
File.MD5	unknown	Bad hash found
File.Malicious.Vendor	unknown	For malicious files, the vendor that made the decision

Configuration parameters

server — Server URL (e.g. https://192.168.0.1) (required)
credentials — Username
clientToken — Client token
credentials_client_token —
version — Version
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (9)

fe-alert
commands.server.feAlert.description.
fe-config
commands.server.feConfig.description.
fe-report
commands.server.feReport.description.
fe-submit
commands.server.feSubmit.description.
fe-submit-result
Results of the file submission.
fe-submit-status
commands.server.feSubmitStatus.description.
fe-submit-url
Submit a url for analysis by FireEye.
fe-submit-url-result
Results of the URL submission.
fe-submit-url-status
Get a status for a url submitted to FireEye analysis.

Source

Fireeye.js Fireeye.yml

Download History Raw

commonfields:
  id: fireeye
  version: -1
name: fireeye
fromversion: 5.0.0
display: FireEye (AX Series)
category: Forensics & Malware Analysis
provider: Trellix
description: Perform malware dynamic analysis.
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: server
  defaultvalue: ""
  type: 0
  required: true
- display: Username
  name: credentials
  defaultvalue: ""
  type: 9
  required: false
- display: Client token
  name: clientToken
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
- displaypassword: Client Token
  name: credentials_client_token
  hiddenusername: true
  type: 9
  required: false
- display: Version
  name: version
  defaultvalue: 1.1.0
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: fe-report
    arguments:
    - name: report_type
      required: true
      description: commands.server.feReport.arguments.reportType.description.
    - name: type
      required: true
      description: commands.server.feReport.arguments.type.description.
    - name: start_time
      required: true
      description: Report start time.
    - name: end_time
      required: true
      description: Report end time.
    - name: command
      description: Report command.
    - name: module
      description: Report module.
    - name: frame
      description: commands.server.feReport.arguments.frame.description.
    description: commands.server.feReport.description.
  - name: fe-submit-status
    arguments:
    - name: submission_Key
      required: true
      description: commands.server.feSubmit.arguments.submissionKey.description.
    outputs:
    - contextPath: FireEyeAX.Submissions.Key
      description: The file submission key.
    - contextPath: FireEyeAX.Submissions.Status
      description: The file submission status.
    description: commands.server.feSubmitStatus.description.
  - name: fe-alert
    arguments:
    - name: duration
      description: commands.server.feAlert.arguments.duration.description.
    - name: start_time
      description: commands.server.feAlert.arguments.startTime.description.
    - name: end_time
      description: commands.server.feAlert.arguments.endTime.description.
    - name: src_ip
      description: commands.server.feAlert.arguments.srcIP.description.
    - name: dst_ip
      description: commands.server.feAlert.arguments.dstIP.description.
    - name: malware_name
      description: commands.server.feAlert.arguments.malwareName.description.
    - name: malware_type
      description: commands.server.feAlert.arguments.malwareType.description.
    - name: sender_email
      description: commands.server.feAlert.arguments.senderMail.description.
    - name: recipient_email
      description: commands.server.feAlert.arguments.recipientEMail.description.
    - name: file_name
      description: commands.server.feAlert.arguments.fileName.description.
    - name: file_type
      description: commands.server.feAlert.arguments.fileType.description.
    - name: url
      description: commands.server.feAlert.arguments.url.description.
    - name: md5
      description: commands.server.feAlert.arguments.md5.description.
    - name: info_level
      description: commands.server.feAlert.arguments.infoLevel.description.
    - name: callback_domain
      description: commands.server.feAlert.arguments.callbackDomain.description.
    description: commands.server.feAlert.description.
  - name: fe-submit-result
    arguments:
    - name: submission_Key
      required: true
      description: commands.server.feSubmit.arguments.submissionKey.description.
    - name: info_level
      auto: PREDEFINED
      predefined:
      - concise
      - normal
      - extended
      description: commands.server.feAlert.arguments.infoLevel.description.
      defaultValue: concise
    outputs:
    - contextPath: FireEyeAX.Submissions.Key
      description: The submission key.
    - contextPath: FireEyeAX.Submissions.Severity
      description: The severity level of the file.
    - contextPath: DBotScore.Score
      description: The actual score.
    - contextPath: DBotScore.Indicator
      description: The indicator we tested.
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
    - contextPath: DBotScore.Type
      description: The type of the indicator.
    - contextPath: File.MD5
      description: Bad hash found.
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
    description: Results of the file submission.
  - name: fe-submit
    arguments:
    - name: upload
      description: commands.server.feSubmit.arguments.upload.description.
      deprecated: true
    - name: uploadFile
      description: commands.server.feSubmit.arguments.uploadFile.description.
    - name: analysistype
      required: true
      description: commands.server.feSubmit.arguments.analysisType.description.
    - name: profiles
      required: true
      description: commands.server.feSubmit.arguments.profile.description.
    - name: application
      required: true
      description: commands.server.feSubmit.arguments.application.description.
    - name: priority
      required: true
      description: commands.server.feSubmit.arguments.priority.description.
    - name: force
      required: true
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: commands.server.feSubmit.arguments.force.description.
    - name: prefetch
      required: true
      description: commands.server.feSubmit.arguments.prefetch.description.
    - name: timeout
      required: true
      description: commands.server.feSubmit.arguments.timeout.description.
    outputs:
    - contextPath: FireEyeAX.Submissions.Key
      description: The file submission key.
    description: commands.server.feSubmit.description.
  - name: fe-config
    arguments: []
    outputs:
    - contextPath: FireEyeAX.Sensors.Address
      description: Sensor IP address.
    - contextPath: FireEyeAX.Sensors.ID
      description: Sensor FireEye id.
    - contextPath: FireEyeAX.Sensors.Name
      description: Sensor name.
    - contextPath: FireEyeAX.Sensors.Profiles.ID
      description: ID of FireEye sensor profile.
    - contextPath: FireEyeAX.Sensors.Profiles.Name
      description: Name of FireEye sensor name.
    - contextPath: FireEyeAX.Sensors.Profiles.Applications.-id
      description: FireEye application ID.
    - contextPath: FFireEyeAX.Sensors.Profiles.Applications.-name
      description: FireEye application name.
    description: commands.server.feConfig.description.
  - name: fe-submit-url
    arguments:
    - name: analysistype
      required: true
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      description: 'Specify live or sandbox analysis mode. 1—Live, analyze suspected malware objects live within the MAS Multivector Virtual Execution (MVX) analysis engine. 2—Sandbox, analyze suspected malware objects in a closed, protected environment. Example: analysisType=1.'
    - name: profiles
      required: true
      description: Select the MAS profile to use for analysis. To determine the available profiles, use the configuration command.  To submit profiles, add them as a parameter using a comma to separate them.  For example, profiles="win7-sp1,winxp-sp3".
    - name: application
      required: true
      description: 'Specifies the application to be used for the analysis. To determine the available applications  for a specific profile, use the configuration command. Note: Setting the application value to 0, allows the MAS to determine the file type for you.'
    - name: priority
      required: true
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      description: 'Sets the analysis priority: 0—Normal, adds analysis to the bottom of queue. 1—Urgent, places the analysis at the top of the queue.'
    - name: force
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: 'Specify whether to perform an analysis on the malware object even if the object exactly matches an analysis that has already been performed. In most cases, it is not necessary to reanalyze malware. (default: false) False, Do not analyze duplicate objects. True, Force analysis.'
    - name: prefetch
      required: true
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      description: Specifies whether to determine the file target based on an internal determination rather than browsing to the target location. 0—No 1—Yes. If analysistype is set to 0 for sandbox analysis, prefetch must be set to 1.
    - name: timeout
      required: true
      description: Sets the analysis timeout (in seconds).
    - name: urls
      required: true
      description: URLs to be analyzed. To submit URLs, add them as a parameter using a comma to separate them.  For example, urls="www.demisto.com,www.google.com".
    outputs:
    - contextPath: FireEyeAX.Submissions.Key
      description: The file submission key.
    description: Submit a url for analysis by FireEye.
  - name: fe-submit-url-status
    arguments:
    - name: submission_Key
      required: true
      description: Submission key of the submission.
    outputs:
    - contextPath: FireEyeAX.Submissions.Key
      description: The url submission key.
    - contextPath: FireEyeAX.Submissions.InfoLevel
      description: The info level of the report.
      type: String
    - contextPath: FireEyeAX.Submissions.Status
      description: The url submission status.
    - contextPath: FireEyeAX.Submissions.ID
      description: The ID of URL submission results.
    description: Get a status for a url submitted to FireEye analysis.
  - name: fe-submit-url-result
    arguments:
    - name: submissionID
      required: true
      description: Submission ID of the submission.
    - name: info_level
      auto: PREDEFINED
      predefined:
      - concise
      - normal
      - extended
      description: 'Specifies the level of information to be returned. Unless otherwise specified, the info_level is set to concise. You can select the following information levels concise: (default), normal, extended.'
      defaultValue: concise
    outputs:
    - contextPath: FireEyeAX.Submissions.Key
      description: The submission key.
    - contextPath: FireEyeAX.Submissions.Severity
      description: The severity level of the file.
    - contextPath: FireEyeAX.Submissions.InfoLevel
      description: The info level of the report.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
    - contextPath: DBotScore.Indicator
      description: The indicator we tested.
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
    - contextPath: File.MD5
      description: Bad hash found.
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
    description: Results of the URL submission.
tests:
- No test - no instance