Lumu

SecOps operations - Reflect and manage the Lumu Incidents either from XSOAR Cortex or viceversa using the mirroring integration flow, https://lumu.io/

Utilities · Lumu

Details

IDLumu
ProviderLumu
CategoryUtilities
From Version6.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

SecOps operations - Reflect and manage the Lumu Incidents either from XSOAR Cortex or viceversa using the mirroring integration flow, https://lumu.io/
This integration was integrated and tested with version 20230215 of Lumu

Configure Lumu in Cortex

Parameter Description Required
Maximum number of incidents to fetch every time   False
First fetch time interval The time range to consider for the initial data fetch. (<number> <unit>, e.g., 2 minutes, 2 hours, 2 days, 2 months, 2 years). Default is 3 days. False
Server URL   True
Use system proxy settings   False
Trust any certificate (not secure)   False
API Key   True
Incident Offset   False
Total Incident per fetching using lumu endpoint   False
Max time in seconds per fetching using lumu endpoint   False
Fetch incidents   False
Incident type   False
Incidents Fetch Interval   False
Incident Mirroring Direction Selects which direction you want the incidents mirrored. You can mirror **Incoming** only (from Lumu to Cortex XSOAR), **Outgoing** only (from Cortex XSOAR to Lumu), or both **Incoming And Outgoing**. Cortex XSOAR only parameter. False
Mirror tags Comment and files that will be marked with this tag will be pushed into Lumu. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

lumu-retrieve-labels

Get a paginated list of all the labels created for the company and its details such as id, name and business relevance. The items are sorted by the label id in ascending order.

Base Command

lumu-retrieve-labels

Input

Argument Name Description Required
page page requested. Optional
limit items limit requested. Default is 10. Optional

Context Output

Path Type Description
Lumu.RetrieveLabels.labels.id Number label id
Lumu.RetrieveLabels.labels.name String label name
Lumu.RetrieveLabels.labels.relevance Number label relevance
Lumu.RetrieveLabels.paginationInfo.page Number current page
Lumu.RetrieveLabels.paginationInfo.items Number current items
Lumu.RetrieveLabels.paginationInfo.next Number next page
Lumu.RetrieveLabels.paginationInfo.prev Number previous page

Command example


#### Context Example

```json
{
    "Lumu": {
        "RetrieveLabels": {
            "labels": [
                {
                    "id": 51,
                    "name": "Mi Ofi",
                    "relevance": 1
                },
                {
                    "id": 112,
                    "name": "Lab1",
                    "relevance": 1
                },
                {
                    "id": 113,
                    "name": "Lab2",
                    "relevance": 1
                },
                {
                    "id": 134,
                    "name": "cd test",
                    "relevance": 1
                },
                {
                    "id": 147,
                    "name": "cd",
                    "relevance": 1
                },
                {
                    "id": 173,
                    "name": "VA 3.1.2 Test",
                    "relevance": 1
                },
                {
                    "id": 218,
                    "name": "acastaneda",
                    "relevance": 1
                },
                {
                    "id": 227,
                    "name": "VA 1.3.3 Label",
                    "relevance": 1
                },
                {
                    "id": 280,
                    "name": "client test",
                    "relevance": 1
                },
                {
                    "id": 331,
                    "name": "VA 3.1.3",
                    "relevance": 1
                }
            ],
            "paginationInfo": {
                "items": 10,
                "next": 2,
                "page": 1
            }
        }
    }
}

Human Readable Output

Labels

Id Name Relevance
51 Mi Ofi 1
112 Lab1 1
113 Lab2 1
134 cd test 1
147 cd 1
173 VA 3.1.2 Test 1
218 acastaneda 1
227 VA 1.3.3 Label 1
280 client test 1
331 VA 3.1.3 1

paginationInfo

Items Next Page
10 2 1

lumu-retrieve-a-specific-label

Get details such as id, name and business relevance from a specific label.

| {label-id} | ID of the specific label |
|—|—|

Base Command

lumu-retrieve-a-specific-label

Input

Argument Name Description Required
label_id label id requested. Required

Context Output

Path Type Description
Lumu.RetrieveASpecificLabel.id Number label id
Lumu.RetrieveASpecificLabel.name String label name
Lumu.RetrieveASpecificLabel.relevance Number label relevance

Command example

!lumu-retrieve-a-specific-label label_id=51

Context Example

{
    "Lumu": {
        "RetrieveASpecificLabel": {
            "id": 51,
            "name": "Mi Ofi",
            "relevance": 1
        }
    }
}

Human Readable Output

Label

Id Name Relevance
51 Mi Ofi 1

lumu-retrieve-incidents

Get a paginated list of incidents for the company. The items are listed by the most recent.

Base Command

lumu-retrieve-incidents

Input

Argument Name Description Required
page page requested. Optional
limit items limit requested. Default is 10. Optional
fromdate from date in ISO string format
e.g. 2023 january 1st, 14:40:14 - 2023-01-01T14:40:14.000Z
e.g. 2023 july 4th, 05:10 - 2023-07-04T05:10:00.000Z.		 Optional
todate from date in ISO string format
e.g. 2023 january 1st, 14:40:14 - 2023-01-01T14:40:14.000Z
e.g. 2023 july 4th, 05:10 - 2023-07-04T05:10:00.000Z.		 Optional
status choose status: open,muted,closed. Possible values are: open, muted, closed. Optional
adversary_types choose types: C2C,Malware,DGA,Mining,Spam,Phishing. Possible values are: C2C, Malware, DGA, Mining, Spam, Phishing. Optional
labels choose labels. Optional

Context Output

Path Type Description
Lumu.RetrieveIncidents.items.id String Lumu incident id
Lumu.RetrieveIncidents.items.timestamp Date Lumu timestamp
Lumu.RetrieveIncidents.items.statusTimestamp Date Lumu statusTimestamp
Lumu.RetrieveIncidents.items.status String Lumu status
Lumu.RetrieveIncidents.items.contacts Number Lumu contacts
Lumu.RetrieveIncidents.items.adversaries String umu adversaries
Lumu.RetrieveIncidents.items.adversaryTypes String Lumu adversaryTypes
Lumu.RetrieveIncidents.items.labelDistribution Number Lumu incident labels
Lumu.RetrieveIncidents.items.totalEndpoints Number Lumu totalEndpoints
Lumu.RetrieveIncidents.items.lastContact Date Lumu lastContact
Lumu.RetrieveIncidents.items.unread Boolean Lumu unread
Lumu.RetrieveIncidents.paginationInfo.page Number current page
Lumu.RetrieveIncidents.paginationInfo.items Number current items

Command example


#### Context Example

```json
{
    "Lumu": {
        "RetrieveIncidents": [
            {
                "adversaries": [
                    "www.chg.com.br"
                ],
                "adversaryId": "www.chg.com.br",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family Win32.Remoteadmin.C.Winvnc.Based",
                "firstContact": "2023-02-15T13:28:25.537Z",
                "hasPlaybackContacts": false,
                "id": "ad2b63c0-ad34-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 1
                },
                "lastContact": "2023-02-15T13:28:25.537Z",
                "status": "closed",
                "statusTimestamp": "2023-02-15T21:53:41.468Z",
                "timestamp": "2023-02-15T13:28:47.356Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "104.156.63.145"
                ],
                "adversaryId": "104.156.63.145",
                "adversaryTypes": [
                    "C2C"
                ],
                "contacts": 10,
                "description": "Malware family Agentemis",
                "firstContact": "2023-02-15T02:21:59Z",
                "hasPlaybackContacts": false,
                "id": "8c5efc90-aca5-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "2144": 10
                },
                "lastContact": "2023-02-15T05:35:40Z",
                "status": "open",
                "statusTimestamp": "2023-02-14T20:24:14.297Z",
                "timestamp": "2023-02-14T20:24:14.297Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "161.97.110.203"
                ],
                "adversaryId": "161.97.110.203",
                "adversaryTypes": [
                    "C2C"
                ],
                "contacts": 1,
                "description": "Malware family Katana",
                "firstContact": "2023-02-15T02:18:17Z",
                "hasPlaybackContacts": false,
                "id": "853e3020-aca5-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "2144": 1
                },
                "lastContact": "2023-02-15T02:18:17Z",
                "status": "open",
                "statusTimestamp": "2023-02-14T20:24:02.338Z",
                "timestamp": "2023-02-14T20:24:02.338Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "rea.co.ke"
                ],
                "adversaryId": "rea.co.ke",
                "adversaryTypes": [
                    "C2C",
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family P2PZeuS",
                "firstContact": "2023-02-14T17:27:26.791Z",
                "hasPlaybackContacts": false,
                "id": "e0b39da0-ac8c-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "989": 1
                },
                "lastContact": "2023-02-14T17:27:26.791Z",
                "status": "closed",
                "statusTimestamp": "2023-02-14T18:33:38.315Z",
                "timestamp": "2023-02-14T17:27:38.362Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "www.puertoballesta.com"
                ],
                "adversaryId": "www.puertoballesta.com",
                "adversaryTypes": [
                    "Phishing"
                ],
                "contacts": 1,
                "description": "Phishing domain",
                "firstContact": "2023-02-14T17:08:11.751Z",
                "hasPlaybackContacts": false,
                "id": "91aaaf20-ac8a-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "989": 1
                },
                "lastContact": "2023-02-14T17:08:11.751Z",
                "status": "open",
                "statusTimestamp": "2023-02-14T17:24:41.268Z",
                "timestamp": "2023-02-14T17:11:06.770Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "bitmovil.mx"
                ],
                "adversaryId": "bitmovil.mx",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 2,
                "description": "Heodo",
                "firstContact": "2023-02-14T17:05:37.987Z",
                "hasPlaybackContacts": false,
                "id": "0d207a50-ac8a-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "989": 2
                },
                "lastContact": "2023-02-14T17:05:37.987Z",
                "status": "closed",
                "statusTimestamp": "2023-02-14T18:44:09.946Z",
                "timestamp": "2023-02-14T17:07:24.405Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "msk.turbolider.ru"
                ],
                "adversaryId": "msk.turbolider.ru",
                "adversaryTypes": [
                    "Phishing"
                ],
                "contacts": 2,
                "description": "Phishing domain",
                "firstContact": "2023-02-14T16:28:11.169Z",
                "hasPlaybackContacts": false,
                "id": "99b7bf10-ac84-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "147": 2
                },
                "lastContact": "2023-02-14T16:28:11.169Z",
                "status": "open",
                "statusTimestamp": "2023-02-14T16:28:23.297Z",
                "timestamp": "2023-02-14T16:28:23.297Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "rspg-spectrum.eu"
                ],
                "adversaryId": "rspg-spectrum.eu",
                "adversaryTypes": [
                    "Phishing"
                ],
                "contacts": 7,
                "description": "Phishing domain",
                "firstContact": "2023-01-13T18:15:24.305Z",
                "hasPlaybackContacts": true,
                "id": "903c5580-abef-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "2041": 5,
                    "4055": 2
                },
                "lastContact": "2023-02-14T16:01:27.715Z",
                "status": "open",
                "statusTimestamp": "2023-02-13T22:41:32.376Z",
                "timestamp": "2023-02-13T22:41:32.376Z",
                "totalEndpoints": 3,
                "unread": false
            },
            {
                "adversaries": [
                    "scalarchives.com"
                ],
                "adversaryId": "scalarchives.com",
                "adversaryTypes": [
                    "Phishing"
                ],
                "contacts": 4,
                "description": "Phishing domain",
                "firstContact": "2023-01-13T21:44:39.025Z",
                "hasPlaybackContacts": true,
                "id": "f2571f00-aa43-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "4055": 4
                },
                "lastContact": "2023-01-13T21:44:39.035Z",
                "status": "open",
                "statusTimestamp": "2023-02-11T19:40:32.368Z",
                "timestamp": "2023-02-11T19:40:32.368Z",
                "totalEndpoints": 2,
                "unread": false
            },
            {
                "adversaries": [
                    "portaconexao8.top"
                ],
                "adversaryId": "portaconexao8.top",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 2,
                "description": "Malware hash: 55e57c52cd5e1dcfad4e9bcf0eb2f3a5",
                "firstContact": "2023-02-11T18:40:09.087Z",
                "hasPlaybackContacts": false,
                "id": "89658e80-aa3b-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "147": 2
                },
                "lastContact": "2023-02-11T18:40:09.087Z",
                "status": "closed",
                "statusTimestamp": "2023-02-15T13:26:02.357Z",
                "timestamp": "2023-02-11T18:40:20.328Z",
                "totalEndpoints": 1,
                "unread": false
            }
        ]
    }
}

Human Readable Output

Incidents

Adversaries Adversary Id Adversary Types Contacts Description First Contact Has Playback Contacts Id Label Distribution Last Contact Status Status Timestamp Timestamp Total Endpoints Unread
www.chg.com.br www.chg.com.br Malware 1 Malware family Win32.Remoteadmin.C.Winvnc.Based 2023-02-15T13:28:25.537Z false ad2b63c0-ad34-11ed-9fd0-e5fb50c818f6 0: 1 2023-02-15T13:28:25.537Z closed 2023-02-15T21:53:41.468Z 2023-02-15T13:28:47.356Z 1 false
104.156.63.145 104.156.63.145 C2C 10 Malware family Agentemis 2023-02-15T02:21:59Z false 8c5efc90-aca5-11ed-9fd0-e5fb50c818f6 2144: 10 2023-02-15T05:35:40Z open 2023-02-14T20:24:14.297Z 2023-02-14T20:24:14.297Z 1 false
161.97.110.203 161.97.110.203 C2C 1 Malware family Katana 2023-02-15T02:18:17Z false 853e3020-aca5-11ed-9fd0-e5fb50c818f6 2144: 1 2023-02-15T02:18:17Z open 2023-02-14T20:24:02.338Z 2023-02-14T20:24:02.338Z 1 false
rea.co.ke rea.co.ke C2C,
Malware		 1 Malware family P2PZeuS 2023-02-14T17:27:26.791Z false e0b39da0-ac8c-11ed-9fd0-e5fb50c818f6 989: 1 2023-02-14T17:27:26.791Z closed 2023-02-14T18:33:38.315Z 2023-02-14T17:27:38.362Z 1 false
www.puertoballesta.com www.puertoballesta.com Phishing 1 Phishing domain 2023-02-14T17:08:11.751Z false 91aaaf20-ac8a-11ed-9fd0-e5fb50c818f6 989: 1 2023-02-14T17:08:11.751Z open 2023-02-14T17:24:41.268Z 2023-02-14T17:11:06.770Z 1 false
bitmovil.mx bitmovil.mx Malware 2 Heodo 2023-02-14T17:05:37.987Z false 0d207a50-ac8a-11ed-9fd0-e5fb50c818f6 989: 2 2023-02-14T17:05:37.987Z closed 2023-02-14T18:44:09.946Z 2023-02-14T17:07:24.405Z 1 false
msk.turbolider.ru msk.turbolider.ru Phishing 2 Phishing domain 2023-02-14T16:28:11.169Z false 99b7bf10-ac84-11ed-9fd0-e5fb50c818f6 147: 2 2023-02-14T16:28:11.169Z open 2023-02-14T16:28:23.297Z 2023-02-14T16:28:23.297Z 1 false
rspg-spectrum.eu rspg-spectrum.eu Phishing 7 Phishing domain 2023-01-13T18:15:24.305Z true 903c5580-abef-11ed-9fd0-e5fb50c818f6 4055: 2
2041: 5		 2023-02-14T16:01:27.715Z open 2023-02-13T22:41:32.376Z 2023-02-13T22:41:32.376Z 3 false
scalarchives.com scalarchives.com Phishing 4 Phishing domain 2023-01-13T21:44:39.025Z true f2571f00-aa43-11ed-9fd0-e5fb50c818f6 4055: 4 2023-01-13T21:44:39.035Z open 2023-02-11T19:40:32.368Z 2023-02-11T19:40:32.368Z 2 false
portaconexao8.top portaconexao8.top Malware 2 Malware hash: 55e57c52cd5e1dcfad4e9bcf0eb2f3a5 2023-02-11T18:40:09.087Z false 89658e80-aa3b-11ed-9fd0-e5fb50c818f6 147: 2 2023-02-11T18:40:09.087Z closed 2023-02-15T13:26:02.357Z 2023-02-11T18:40:20.328Z 1 false

paginationInfo

Items Next Page
10 2 1

Command example

!lumu-retrieve-incidents page=2 status=open adversary-types=Malware labels=1580

Human Readable Output

Incidents

No entries.

paginationInfo

Items Page Prev
10 2 1

lumu-retrieve-a-specific-incident-details

Get details of a specific Incident.

| {incident-uuid} | uuid of the specific incident |
|—|—|

Base Command

lumu-retrieve-a-specific-incident-details

Input

Argument Name Description Required
lumu_incident_id Lumu id requested. Required

Context Output

Path Type Description
Lumu.RetrieveASpecificIncidentDetails.id String Lumu id
Lumu.RetrieveASpecificIncidentDetails.timestamp Date Lumu timestamp
Lumu.RetrieveASpecificIncidentDetails.isUnread Boolean Lumu isUnread
Lumu.RetrieveASpecificIncidentDetails.contacts Number Lumu contacts
Lumu.RetrieveASpecificIncidentDetails.adversaryId String Lumu adversaryId
Lumu.RetrieveASpecificIncidentDetails.adversaries String Lumu adversaries
Lumu.RetrieveASpecificIncidentDetails.adversaryTypes String Lumu adversaryTypes
Lumu.RetrieveASpecificIncidentDetails.description String Lumu description
Lumu.RetrieveASpecificIncidentDetails.labelDistribution Number Lumu incident label
Lumu.RetrieveASpecificIncidentDetails.totalEndpoints Number Lumu totalEndpoints
Lumu.RetrieveASpecificIncidentDetails.lastContact Date Lumu lastContact
Lumu.RetrieveASpecificIncidentDetails.actions.datetime Date Lumu actions.datetime
Lumu.RetrieveASpecificIncidentDetails.actions.userId Number Lumu actions.userId
Lumu.RetrieveASpecificIncidentDetails.actions.action String Lumu actions.action
Lumu.RetrieveASpecificIncidentDetails.actions.comment String Lumu comment
Lumu.RetrieveASpecificIncidentDetails.status String Lumu status
Lumu.RetrieveASpecificIncidentDetails.statusTimestamp Date Lumu statusTimestamp
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.uuid String Lumu firstContactDetails.uuid
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.datetime Date Lumu firstContactDetails.datetime
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.host String Lumu firstContactDetails.host
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.types String Lumu firstContactDetails.types
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.details String Lumu firstContactDetails.details
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.endpointIp String Lumu firstContactDetails.endpointIp
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.endpointName String Lumu firstContactDetails.endpointName
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.label Number Lumu firstContactDetails.label
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceType String Lumu firstContactDetails.sourceType
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceId String Lumu firstContactDetails.sourceId
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.question.type String Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.question.type
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.question.name String Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.question.name
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.question.class String Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.question.class
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.responseCode String Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.responseCode
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.flags.authoritative Boolean Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.flags.authoritative
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.flags.recursion_available Boolean Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.flags.recursion_available
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.flags.truncated_response Boolean Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.flags.truncated_response
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.flags.checking_disabled Boolean Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.flags.checking_disabled
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.flags.recursion_desired Boolean Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.flags.recursion_desired
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.flags.authentic_data Boolean Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.flags.authentic_data
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.answers.name String Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.answers.name
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.answers.type String Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.answers.type
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.answers.class String Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.answers.class
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.answers.ttl Number Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.answers.ttl
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.answers.data String Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.answers.data
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.sourceData.DNSPacketExtraInfo.opCode String Lumu firstContactDetails.sourceData.DNSPacketExtraInfo.opCode
Lumu.RetrieveASpecificIncidentDetails.firstContactDetails.isPlayback Boolean Lumu firstContactDetails.isPlayback
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.uuid String Lumu lastContactDetails.uuid
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.datetime Date Lumu lastContactDetails.datetime
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.host String Lumu lastContactDetails.host
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.types String Lumu lastContactDetails.types
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.details String Lumu lastContactDetails.details
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.endpointIp String Lumu lastContactDetails.endpointIp
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.endpointName String Lumu lastContactDetails.endpointName
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.label Number Lumu lastContactDetails.label
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceType String Lumu lastContactDetails.sourceType
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceId String Lumu lastContactDetails.sourceId
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.question.type String Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.question.type
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.question.name String Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.question.name
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.question.class String Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.question.class
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.responseCode String Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.responseCode
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.flags.authoritative Boolean Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.flags.authoritative
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.flags.recursion_available Boolean Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.flags.recursion_available
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.flags.truncated_response Boolean Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.flags.truncated_response
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.flags.checking_disabled Boolean Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.flags.checking_disabled
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.flags.recursion_desired Boolean Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.flags.recursion_desired
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.flags.authentic_data Boolean Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.flags.authentic_data
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.answers.name String Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.answers.name
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.answers.type String Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.answers.type
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.answers.class String Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.answers.class
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.answers.ttl Number Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.answers.ttl
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.answers.data String Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.answers.data
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.sourceData.DNSPacketExtraInfo.opCode String Lumu lastContactDetails.sourceData.DNSPacketExtraInfo.opCode
Lumu.RetrieveASpecificIncidentDetails.lastContactDetails.isPlayback Boolean Lumu lastContactDetails.isPlayback

Command example

!lumu-retrieve-a-specific-incident-details lumu_incident_id=7c40be00-a7cf-11ed-9fd0-e5fb50c818f6

Context Example

{
    "Lumu": {
        "RetrieveASpecificIncidentDetails": {
            "actions": [
                {
                    "action": "comment",
                    "comment": "test comment",
                    "datetime": "2023-02-15T12:18:53.523Z",
                    "userId": 6252
                },
                {
                    "action": "comment",
                    "comment": "from XSOAR Cortex 20230215_121052 jusa a comment 710, hmacsha256:4a72fe5ec25900e165988e155a1f629ceb2b3e0b92127b8b7df04ab8576b86e8",
                    "datetime": "2023-02-15T12:10:54.152Z",
                    "userId": 0
                },
                {
                    "action": "unmute",
                    "comment": "from XSOAR Cortex 20230215_120059 , hmacsha256:7e909a46d09f7e2fe9f81b8dbb4e56f39f1ed760744ff9b6ca0d17ca31c5a4c4",
                    "datetime": "2023-02-15T12:01:03.667Z",
                    "userId": 0
                },
                {
                    "action": "mute",
                    "comment": "from XSOAR Cortex 20230209_165814 at 1158, hmacsha256:ad2f2ce9951184230647f2feed5856d41fa75500ded13aed5bf78176d825e40b",
                    "datetime": "2023-02-09T16:58:14.536Z",
                    "userId": 0
                }
            ],
            "adversaries": [
                "activity.lumu.io"
            ],
            "adversaryId": "activity.lumu.io",
            "adversaryTypes": [
                "Spam"
            ],
            "contacts": 8,
            "description": "Activity Test Query",
            "firstContactDetails": {
                "datetime": "2023-02-08T16:41:35.613Z",
                "details": [
                    "Activity Test Query"
                ],
                "endpointIp": "186.29.109.138",
                "endpointName": "cd-ho",
                "host": "activity.lumu.io",
                "isPlayback": false,
                "label": 147,
                "sourceData": null,
                "sourceId": "587ec9d348053ca03a58aeddeccb1b93",
                "sourceType": "PublicResolver",
                "types": [
                    "Spam"
                ],
                "uuid": "737f12d0-a7cf-11ed-972b-0f9b6b3c6ffd"
            },
            "hasPlaybackContacts": false,
            "id": "7c40be00-a7cf-11ed-9fd0-e5fb50c818f6",
            "isUnread": false,
            "labelDistribution": {
                "0": 2,
                "147": 1,
                "1885": 2,
                "2254": 1,
                "989": 2
            },
            "lastContact": "2023-02-15T16:59:47.142Z",
            "lastContactDetails": {
                "datetime": "2023-02-15T16:59:47.142Z",
                "details": [
                    "Activity Test Query"
                ],
                "endpointIp": "192.168.1.100",
                "endpointName": "LUMU-100",
                "host": "activity.lumu.io",
                "isPlayback": false,
                "label": 0,
                "sourceData": {
                    "DNSQueryExtraInfo": {
                        "queryType": "A"
                    }
                },
                "sourceId": "6d942a7a-d287-415e-9c09-3d6632a6a976",
                "sourceType": "custom_collector",
                "types": [
                    "Spam"
                ],
                "uuid": "26fd6e60-ad52-11ed-8d57-0f9b6b8d54f0"
            },
            "status": "open",
            "statusTimestamp": "2023-02-15T12:01:03.667Z",
            "timestamp": "2023-02-08T16:41:50.304Z",
            "totalEndpoints": 6
        }
    }
}

Human Readable Output

Incident

Adversaries Adversary Id Adversary Types Contacts Description First Contact Details Has Playback Contacts Id Is Unread Label Distribution Last Contact Last Contact Details Status Status Timestamp Timestamp Total Endpoints
activity.lumu.io activity.lumu.io Spam 8 Activity Test Query uuid: 737f12d0-a7cf-11ed-972b-0f9b6b3c6ffd
datetime: 2023-02-08T16:41:35.613Z
host: activity.lumu.io
types: Spam
details: Activity Test Query
endpointIp: 186.29.109.138
endpointName: cd-ho
label: 147
sourceType: PublicResolver
sourceId: 587ec9d348053ca03a58aeddeccb1b93
sourceData: null
isPlayback: false		 false 7c40be00-a7cf-11ed-9fd0-e5fb50c818f6 false 147: 1
2254: 1
1885: 2
989: 2
0: 2		 2023-02-15T16:59:47.142Z uuid: 26fd6e60-ad52-11ed-8d57-0f9b6b8d54f0
datetime: 2023-02-15T16:59:47.142Z
host: activity.lumu.io
types: Spam
details: Activity Test Query
endpointIp: 192.168.1.100
endpointName: LUMU-100
label: 0
sourceType: custom_collector
sourceId: 6d942a7a-d287-415e-9c09-3d6632a6a976
sourceData: {“DNSQueryExtraInfo”: {“queryType”: “A”}}
isPlayback: false		 open 2023-02-15T12:01:03.667Z 2023-02-08T16:41:50.304Z 6

Actions

Action Comment Datetime User Id
comment test comment 2023-02-15T12:18:53.523Z 6252
comment from XSOAR Cortex 20230215_121052 jusa a comment 710, hmacsha256:4a72fe5ec25900e165988e155a1f629ceb2b3e0b92127b8b7df04ab8576b86e8 2023-02-15T12:10:54.152Z 0
unmute from XSOAR Cortex 20230215_120059 , hmacsha256:7e909a46d09f7e2fe9f81b8dbb4e56f39f1ed760744ff9b6ca0d17ca31c5a4c4 2023-02-15T12:01:03.667Z 0
mute from XSOAR Cortex 20230209_165814 at 1158, hmacsha256:ad2f2ce9951184230647f2feed5856d41fa75500ded13aed5bf78176d825e40b 2023-02-09T16:58:14.536Z 0

lumu-retrieve-a-specific-incident-context

Get details of a specific Incident.

| {incident-uuid} | uuid of the specific incident |
|—|—|

Base Command

lumu-retrieve-a-specific-incident-context

Input

Argument Name Description Required
lumu_incident_id Lumu id requested. Required
hash Lumu hash type. Optional

Context Output

Path Type Description
Lumu.RetrieveASpecificIncidentContext.adversary_id String Lumu adversary_id
Lumu.RetrieveASpecificIncidentContext.currently_active Boolean Lumu currently_active
Lumu.RetrieveASpecificIncidentContext.deactivated_on Date Lumu deactivated_on
Lumu.RetrieveASpecificIncidentContext.mitre.details.tactic String Lumu mitre.details.tactic
Lumu.RetrieveASpecificIncidentContext.mitre.details.techniques String Lumu mitre.details.techniques
Lumu.RetrieveASpecificIncidentContext.mitre.matrix String Lumu mitre.matrix
Lumu.RetrieveASpecificIncidentContext.mitre.version String Lumu mitre.version
Lumu.RetrieveASpecificIncidentContext.related_files String Lumu related_files
Lumu.RetrieveASpecificIncidentContext.threat_details String Lumu threat_details
Lumu.RetrieveASpecificIncidentContext.threat_triggers String Lumu threat_triggers
Lumu.RetrieveASpecificIncidentContext.playbooks String Lumu playbooks
Lumu.RetrieveASpecificIncidentContext.external_resources String Lumu external_resources
Lumu.RetrieveASpecificIncidentContext.timestamp Date Lumu timestamp

Command example

!lumu-retrieve-a-specific-incident-context lumu_incident_id=6eddaf40-938c-11ed-b0f8-a7e340234a4e hash=SHA256

Context Example

{
    "Lumu": {
        "RetrieveASpecificIncidentContext": {
            "adversary_id": "jits.ac.in",
            "currently_active": true,
            "external_resources": [
                "https://blog.quosec.net/posts/grap_qakbot_navigation/",
                "https://unit42.paloaltonetworks.com/wireshark-tutorial-emotet-infection/",
                "https://malwareandstuff.com/an-old-enemy-diving-into-qbot-part-1/",
                "https://raw.githubusercontent.com/fboldewin/When-ransomware-hits-an-ATM-giant---The-Diebold-Nixdorf-case-dissected/main/When%20ransomware%20hits%20an%20ATM%20giant%20-%20The%20Diebold%20Nixdorf%20case%20dissected%20-%20Group-IB%20CyberCrimeCon2020.pdf",
                "https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot",
                "https://media.scmagazine.com/documents/225/bae_qbot_report_56053.pdf",
                "https://malwareandstuff.com/an-old-enemy-diving-into-qbot-part-3/",
                "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-010.pdf",
                "https://urlhaus.abuse.ch/host/jits.ac.in/",
                "https://elis531989.medium.com/funtastic-packers-and-where-to-find-them-41429a7ef9a7",
                "https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/",
                "https://www.vkremez.com/2018/07/lets-learn-in-depth-reversing-of-qakbot.html",
                "https://twitter.com/redcanary/status/1334224861628039169",
                "https://web.archive.org/web/20201207094648/https://go.group-ib.com/rs/689-LRE-818/images/Group-IB_Egregor_Ransomware.pdf",
                "https://www.hornetsecurity.com/en/security-information/qakbot-malspam-leading-to-prolock/",
                "https://blog.morphisec.com/qakbot-qbot-maldoc-two-new-techniques",
                "https://www.virustotal.com/gui/domain/jits.ac.in/relations"
            ],
            "mitre": {
                "details": [
                    {
                        "tactic": "command-and-control",
                        "techniques": [
                            "T1071"
                        ]
                    }
                ],
                "matrix": "enterprise",
                "version": "8.2"
            },
            "playbooks": [
                "https://docs.lumu.io/portal/en/kb/articles/malware-incident-response-playbook"
            ],
            "threat_details": [
                "qbot",
                "Gafgyt",
                "Qakbot",
                "Quakbot",
                "Qbot",
                "lizkebab",
                "torlus",
                "PinkSlipBot",
                "Bashlite",
                "Akbot",
                "Pinkslipbot",
                "Qbot ",
                "gayfgt"
            ],
            "threat_triggers": [
                "https://jits.ac.in/TS.php"
            ],
            "timestamp": "2023-02-15T21:59:16.261Z"
        }
    }
}

Human Readable Output

Incident

Adversary _ Id Currently _ Active External _ Resources Mitre Playbooks Threat _ Details Threat _ Triggers Timestamp
jits.ac.in true https://blog.quosec.net/posts/grap_qakbot_navigation/,
https://unit42.paloaltonetworks.com/wireshark-tutorial-emotet-infection/,
https://malwareandstuff.com/an-old-enemy-diving-into-qbot-part-1/,
https://raw.githubusercontent.com/fboldewin/When-ransomware-hits-an-ATM-giant—The-Diebold-Nixdorf-case-dissected/main/When%20ransomware%20hits%20an%20ATM%20giant%20-%20The%20Diebold%20Nixdorf%20case%20dissected%20-%20Group-IB%20CyberCrimeCon2020.pdf,
https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot,
https://media.scmagazine.com/documents/225/bae_qbot_report_56053.pdf,
https://malwareandstuff.com/an-old-enemy-diving-into-qbot-part-3/,
https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-010.pdf,
https://urlhaus.abuse.ch/host/jits.ac.in/,
https://elis531989.medium.com/funtastic-packers-and-where-to-find-them-41429a7ef9a7,
https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/,
https://www.vkremez.com/2018/07/lets-learn-in-depth-reversing-of-qakbot.html,
https://twitter.com/redcanary/status/1334224861628039169,
https://web.archive.org/web/20201207094648/https://go.group-ib.com/rs/689-LRE-818/images/Group-IB_Egregor_Ransomware.pdf,
https://www.hornetsecurity.com/en/security-information/qakbot-malspam-leading-to-prolock/,
https://blog.morphisec.com/qakbot-qbot-maldoc-two-new-techniques,
https://www.virustotal.com/gui/domain/jits.ac.in/relations		 details: {‘tactic’: ‘command-and-control’, ‘techniques’: [‘T1071’]}
matrix: enterprise
version: 8.2		 https://docs.lumu.io/portal/en/kb/articles/malware-incident-response-playbook qbot,
Gafgyt,
Qakbot,
Quakbot,
Qbot,
lizkebab,
torlus,
PinkSlipBot,
Bashlite,
Akbot,
Pinkslipbot,
Qbot ,
gayfgt		 https://jits.ac.in/TS.php 2023-02-15T21:59:16.261Z

lumu-comment-a-specific-incident

Get a paginated list of open incidents for the company. The items are listed by the most recent.

Base Command

lumu-comment-a-specific-incident

Input

Argument Name Description Required
lumu_incident_id Lumu incident id requested. Required
comment Lumu comment requested. Optional

Context Output

Path Type Description
Lumu.CommentASpecificIncident.statusCode number Lumu statusCode

Command example

!lumu-comment-a-specific-incident comment="from cortex, palo alto" lumu_incident_id=7c40be00-a7cf-11ed-9fd0-e5fb50c818f6

Context Example

{
    "Lumu": {
        "CommentASpecificIncident": {
            "response": "",
            "statusCode": 200
        }
    }
}

Human Readable Output

Comment added to the incident successfully.

lumu-retrieve-open-incidents

Get a paginated list of open incidents for the company. The items are listed by the most recent.

Base Command

lumu-retrieve-open-incidents

Input

Argument Name Description Required
page page requested . Optional
limit item limit requested . Default is 10. Optional
adversary_types choose types: C2C,Malware,DGA,Mining,Spam,Phishing. Possible values are: C2C, Malware, DGA, Mining, Spam, Phishing. Optional
labels Lumu labels requested. Optional

Context Output

Path Type Description
Lumu.RetrieveOpenIncidents.items.id String Lumu incident id
Lumu.RetrieveOpenIncidents.items.timestamp Date Lumu timestamp
Lumu.RetrieveOpenIncidents.items.statusTimestamp Date Lumu statusTimestamp
Lumu.RetrieveOpenIncidents.items.status String Lumu status
Lumu.RetrieveOpenIncidents.items.contacts Number Lumu contacts
Lumu.RetrieveOpenIncidents.items.adversaries String Lumu adversaries
Lumu.RetrieveOpenIncidents.items.adversaryId String Lumu adversaryId
Lumu.RetrieveOpenIncidents.items.adversaryTypes String Lumu adversaryTypes
Lumu.RetrieveOpenIncidents.items.description String Lumu description
Lumu.RetrieveOpenIncidents.items.labelDistribution Number Lumu labelDistribution
Lumu.RetrieveOpenIncidents.items.totalEndpoints Number Lumu totalEndpoints
Lumu.RetrieveOpenIncidents.items.lastContact Date Lumu lastContact
Lumu.RetrieveOpenIncidents.items.unread Boolean Lumu unread
Lumu.RetrieveOpenIncidents.paginationInfo.page Number current page
Lumu.RetrieveOpenIncidents.paginationInfo.items Number current items

Command example


#### Context Example

```json
{
    "Lumu": {
        "RetrieveOpenIncidents": [
            {
                "adversaries": [
                    "activity.lumu.io"
                ],
                "adversaryId": "activity.lumu.io",
                "adversaryTypes": [
                    "Spam"
                ],
                "contacts": 8,
                "description": "Activity Test Query",
                "firstContact": "2023-02-08T16:41:35.613Z",
                "hasPlaybackContacts": false,
                "id": "7c40be00-a7cf-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 2,
                    "147": 1,
                    "1885": 2,
                    "2254": 1,
                    "989": 2
                },
                "lastContact": "2023-02-15T16:59:47.142Z",
                "status": "open",
                "statusTimestamp": "2023-02-15T12:01:03.667Z",
                "timestamp": "2023-02-08T16:41:50.304Z",
                "totalEndpoints": 6,
                "unread": false
            },
            {
                "adversaries": [
                    "104.156.63.145"
                ],
                "adversaryId": "104.156.63.145",
                "adversaryTypes": [
                    "C2C"
                ],
                "contacts": 10,
                "description": "Malware family Agentemis",
                "firstContact": "2023-02-15T02:21:59Z",
                "hasPlaybackContacts": false,
                "id": "8c5efc90-aca5-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "2144": 10
                },
                "lastContact": "2023-02-15T05:35:40Z",
                "status": "open",
                "statusTimestamp": "2023-02-14T20:24:14.297Z",
                "timestamp": "2023-02-14T20:24:14.297Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "161.97.110.203"
                ],
                "adversaryId": "161.97.110.203",
                "adversaryTypes": [
                    "C2C"
                ],
                "contacts": 1,
                "description": "Malware family Katana",
                "firstContact": "2023-02-15T02:18:17Z",
                "hasPlaybackContacts": false,
                "id": "853e3020-aca5-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "2144": 1
                },
                "lastContact": "2023-02-15T02:18:17Z",
                "status": "open",
                "statusTimestamp": "2023-02-14T20:24:02.338Z",
                "timestamp": "2023-02-14T20:24:02.338Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "www.puertoballesta.com"
                ],
                "adversaryId": "www.puertoballesta.com",
                "adversaryTypes": [
                    "Phishing"
                ],
                "contacts": 1,
                "description": "Phishing domain",
                "firstContact": "2023-02-14T17:08:11.751Z",
                "hasPlaybackContacts": false,
                "id": "91aaaf20-ac8a-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "989": 1
                },
                "lastContact": "2023-02-14T17:08:11.751Z",
                "status": "open",
                "statusTimestamp": "2023-02-14T17:24:41.268Z",
                "timestamp": "2023-02-14T17:11:06.770Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "msk.turbolider.ru"
                ],
                "adversaryId": "msk.turbolider.ru",
                "adversaryTypes": [
                    "Phishing"
                ],
                "contacts": 2,
                "description": "Phishing domain",
                "firstContact": "2023-02-14T16:28:11.169Z",
                "hasPlaybackContacts": false,
                "id": "99b7bf10-ac84-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "147": 2
                },
                "lastContact": "2023-02-14T16:28:11.169Z",
                "status": "open",
                "statusTimestamp": "2023-02-14T16:28:23.297Z",
                "timestamp": "2023-02-14T16:28:23.297Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "rspg-spectrum.eu"
                ],
                "adversaryId": "rspg-spectrum.eu",
                "adversaryTypes": [
                    "Phishing"
                ],
                "contacts": 7,
                "description": "Phishing domain",
                "firstContact": "2023-01-13T18:15:24.305Z",
                "hasPlaybackContacts": true,
                "id": "903c5580-abef-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "2041": 5,
                    "4055": 2
                },
                "lastContact": "2023-02-14T16:01:27.715Z",
                "status": "open",
                "statusTimestamp": "2023-02-13T22:41:32.376Z",
                "timestamp": "2023-02-13T22:41:32.376Z",
                "totalEndpoints": 3,
                "unread": false
            },
            {
                "adversaries": [
                    "scalarchives.com"
                ],
                "adversaryId": "scalarchives.com",
                "adversaryTypes": [
                    "Phishing"
                ],
                "contacts": 4,
                "description": "Phishing domain",
                "firstContact": "2023-01-13T21:44:39.025Z",
                "hasPlaybackContacts": true,
                "id": "f2571f00-aa43-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "4055": 4
                },
                "lastContact": "2023-01-13T21:44:39.035Z",
                "status": "open",
                "statusTimestamp": "2023-02-11T19:40:32.368Z",
                "timestamp": "2023-02-11T19:40:32.368Z",
                "totalEndpoints": 2,
                "unread": false
            },
            {
                "adversaries": [
                    "www.ascentive.com"
                ],
                "adversaryId": "www.ascentive.com",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 9,
                "description": "Malware family Trojan.Win32.Generic",
                "firstContact": "2023-02-09T16:04:59.540Z",
                "hasPlaybackContacts": false,
                "id": "e6a0cc30-a893-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "1885": 1,
                    "2144": 7,
                    "989": 1
                },
                "lastContact": "2023-02-14T23:34:09.414Z",
                "status": "open",
                "statusTimestamp": "2023-02-09T16:07:50.131Z",
                "timestamp": "2023-02-09T16:07:50.131Z",
                "totalEndpoints": 3,
                "unread": false
            },
            {
                "adversaries": [
                    "ac20mail.in"
                ],
                "adversaryId": "ac20mail.in",
                "adversaryTypes": [
                    "Spam"
                ],
                "contacts": 1,
                "description": "Disposable email host",
                "firstContact": "2023-01-28T05:29:26.009Z",
                "hasPlaybackContacts": false,
                "id": "ce5753e0-9ecc-11ed-a0c7-dd6f8e69d343",
                "labelDistribution": {
                    "4301": 1
                },
                "lastContact": "2023-01-28T05:29:26.009Z",
                "status": "open",
                "statusTimestamp": "2023-02-09T15:55:27.960Z",
                "timestamp": "2023-01-28T05:29:59.070Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "dimar.cl"
                ],
                "adversaryId": "dimar.cl",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 2,
                "description": "Malicious domain",
                "firstContact": "2023-02-07T08:10:51.125Z",
                "hasPlaybackContacts": false,
                "id": "cf26cf90-a7e5-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "51": 2
                },
                "lastContact": "2023-02-07T08:10:51.125Z",
                "status": "open",
                "statusTimestamp": "2023-02-08T19:21:38.313Z",
                "timestamp": "2023-02-08T19:21:38.313Z",
                "totalEndpoints": 1,
                "unread": false
            }
        ]
    }
}

Human Readable Output

Incidents

Adversaries Adversary Id Adversary Types Contacts Description First Contact Has Playback Contacts Id Label Distribution Last Contact Status Status Timestamp Timestamp Total Endpoints Unread
activity.lumu.io activity.lumu.io Spam 8 Activity Test Query 2023-02-08T16:41:35.613Z false 7c40be00-a7cf-11ed-9fd0-e5fb50c818f6 147: 1
2254: 1
1885: 2
989: 2
0: 2		 2023-02-15T16:59:47.142Z open 2023-02-15T12:01:03.667Z 2023-02-08T16:41:50.304Z 6 false
104.156.63.145 104.156.63.145 C2C 10 Malware family Agentemis 2023-02-15T02:21:59Z false 8c5efc90-aca5-11ed-9fd0-e5fb50c818f6 2144: 10 2023-02-15T05:35:40Z open 2023-02-14T20:24:14.297Z 2023-02-14T20:24:14.297Z 1 false
161.97.110.203 161.97.110.203 C2C 1 Malware family Katana 2023-02-15T02:18:17Z false 853e3020-aca5-11ed-9fd0-e5fb50c818f6 2144: 1 2023-02-15T02:18:17Z open 2023-02-14T20:24:02.338Z 2023-02-14T20:24:02.338Z 1 false
www.puertoballesta.com www.puertoballesta.com Phishing 1 Phishing domain 2023-02-14T17:08:11.751Z false 91aaaf20-ac8a-11ed-9fd0-e5fb50c818f6 989: 1 2023-02-14T17:08:11.751Z open 2023-02-14T17:24:41.268Z 2023-02-14T17:11:06.770Z 1 false
msk.turbolider.ru msk.turbolider.ru Phishing 2 Phishing domain 2023-02-14T16:28:11.169Z false 99b7bf10-ac84-11ed-9fd0-e5fb50c818f6 147: 2 2023-02-14T16:28:11.169Z open 2023-02-14T16:28:23.297Z 2023-02-14T16:28:23.297Z 1 false
rspg-spectrum.eu rspg-spectrum.eu Phishing 7 Phishing domain 2023-01-13T18:15:24.305Z true 903c5580-abef-11ed-9fd0-e5fb50c818f6 4055: 2
2041: 5		 2023-02-14T16:01:27.715Z open 2023-02-13T22:41:32.376Z 2023-02-13T22:41:32.376Z 3 false
scalarchives.com scalarchives.com Phishing 4 Phishing domain 2023-01-13T21:44:39.025Z true f2571f00-aa43-11ed-9fd0-e5fb50c818f6 4055: 4 2023-01-13T21:44:39.035Z open 2023-02-11T19:40:32.368Z 2023-02-11T19:40:32.368Z 2 false
www.ascentive.com www.ascentive.com Malware 9 Malware family Trojan.Win32.Generic 2023-02-09T16:04:59.540Z false e6a0cc30-a893-11ed-9fd0-e5fb50c818f6 989: 1
2144: 7
1885: 1		 2023-02-14T23:34:09.414Z open 2023-02-09T16:07:50.131Z 2023-02-09T16:07:50.131Z 3 false
ac20mail.in ac20mail.in Spam 1 Disposable email host 2023-01-28T05:29:26.009Z false ce5753e0-9ecc-11ed-a0c7-dd6f8e69d343 4301: 1 2023-01-28T05:29:26.009Z open 2023-02-09T15:55:27.960Z 2023-01-28T05:29:59.070Z 1 false
dimar.cl dimar.cl Malware 2 Malicious domain 2023-02-07T08:10:51.125Z false cf26cf90-a7e5-11ed-9fd0-e5fb50c818f6 51: 2 2023-02-07T08:10:51.125Z open 2023-02-08T19:21:38.313Z 2023-02-08T19:21:38.313Z 1 false

paginationInfo

Items Next Page
10 2 1

Command example

!lumu-retrieve-open-incidents adversary-types=Spam labels=1791

Context Example

{
    "Lumu": {
        "RetrieveOpenIncidents": [
            {
                "adversaries": [
                    "jits.ac.in"
                ],
                "adversaryId": "jits.ac.in",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 5,
                "description": "QakBot",
                "firstContact": "2023-01-13T21:51:12.190Z",
                "hasPlaybackContacts": false,
                "id": "6eddaf40-938c-11ed-b0f8-a7e340234a4e",
                "labelDistribution": {
                    "1791": 1,
                    "4301": 1,
                    "548": 3
                },
                "lastContact": "2023-01-27T21:23:34.329Z",
                "status": "open",
                "statusTimestamp": "2023-02-08T00:29:50.824Z",
                "timestamp": "2023-01-13T21:51:28.308Z",
                "totalEndpoints": 3,
                "unread": false
            },
            {
                "adversaries": [
                    "msgos.com"
                ],
                "adversaryId": "msgos.com",
                "adversaryTypes": [
                    "Spam"
                ],
                "contacts": 3,
                "description": "Disposable email host",
                "firstContact": "2023-01-13T21:51:10.312Z",
                "hasPlaybackContacts": false,
                "id": "6edc4fb0-938c-11ed-b0f8-a7e340234a4e",
                "labelDistribution": {
                    "1791": 1,
                    "4055": 1,
                    "4301": 1
                },
                "lastContact": "2023-01-27T21:16:25.261Z",
                "status": "open",
                "statusTimestamp": "2023-01-13T21:51:28.299Z",
                "timestamp": "2023-01-13T21:51:28.299Z",
                "totalEndpoints": 3,
                "unread": false
            },
            {
                "adversaries": [
                    "netwonder.net"
                ],
                "adversaryId": "netwonder.net",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 9,
                "description": "Malware family Nivdort",
                "firstContact": "2023-01-13T21:50:53.247Z",
                "hasPlaybackContacts": false,
                "id": "642934c0-938c-11ed-b0f8-a7e340234a4e",
                "labelDistribution": {
                    "1791": 2,
                    "2144": 6,
                    "4301": 1
                },
                "lastContact": "2023-01-27T21:21:19.861Z",
                "status": "open",
                "statusTimestamp": "2023-01-13T21:51:10.348Z",
                "timestamp": "2023-01-13T21:51:10.348Z",
                "totalEndpoints": 3,
                "unread": false
            },
            {
                "adversaries": [
                    "subwaybookreview.com"
                ],
                "adversaryId": "subwaybookreview.com",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 2,
                "description": "Malware family Exploit.Msoffice.Generic",
                "firstContact": "2023-01-13T21:50:38.599Z",
                "hasPlaybackContacts": false,
                "id": "59641870-938c-11ed-b0f8-a7e340234a4e",
                "labelDistribution": {
                    "1791": 1,
                    "4301": 1
                },
                "lastContact": "2023-01-27T21:33:59.964Z",
                "status": "open",
                "statusTimestamp": "2023-01-13T21:50:52.279Z",
                "timestamp": "2023-01-13T21:50:52.279Z",
                "totalEndpoints": 2,
                "unread": true
            },
            {
                "adversaries": [
                    "michaeleaston.com"
                ],
                "adversaryId": "michaeleaston.com",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 3,
                "description": "Malware family Trojan.Agent.Bg.Script",
                "firstContact": "2023-01-13T21:49:50.220Z",
                "hasPlaybackContacts": false,
                "id": "405525e0-938c-11ed-b0f8-a7e340234a4e",
                "labelDistribution": {
                    "1791": 1,
                    "4301": 1,
                    "989": 1
                },
                "lastContact": "2023-01-27T21:16:25.995Z",
                "status": "open",
                "statusTimestamp": "2023-01-13T21:50:10.238Z",
                "timestamp": "2023-01-13T21:50:10.238Z",
                "totalEndpoints": 3,
                "unread": false
            },
            {
                "adversaries": [
                    "cane.pw"
                ],
                "adversaryId": "cane.pw",
                "adversaryTypes": [
                    "Spam"
                ],
                "contacts": 2,
                "description": "Disposable email host",
                "firstContact": "2023-01-13T21:49:28.515Z",
                "hasPlaybackContacts": false,
                "id": "304360e0-938c-11ed-b0f8-a7e340234a4e",
                "labelDistribution": {
                    "1791": 1,
                    "4301": 1
                },
                "lastContact": "2023-01-27T21:16:25.956Z",
                "status": "open",
                "statusTimestamp": "2023-01-13T21:49:43.278Z",
                "timestamp": "2023-01-13T21:49:43.278Z",
                "totalEndpoints": 2,
                "unread": true
            },
            {
                "adversaries": [
                    "cek.pm"
                ],
                "adversaryId": "cek.pm",
                "adversaryTypes": [
                    "Spam"
                ],
                "contacts": 2,
                "description": "Disposable email host",
                "firstContact": "2023-01-13T21:47:46.473Z",
                "hasPlaybackContacts": false,
                "id": "f1a7da00-938b-11ed-b0f8-a7e340234a4e",
                "labelDistribution": {
                    "1791": 1,
                    "4301": 1
                },
                "lastContact": "2023-01-27T21:16:25.744Z",
                "status": "open",
                "statusTimestamp": "2023-01-13T21:47:58.240Z",
                "timestamp": "2023-01-13T21:47:58.240Z",
                "totalEndpoints": 2,
                "unread": true
            },
            {
                "adversaries": [
                    "anothercity.ru"
                ],
                "adversaryId": "anothercity.ru",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 2,
                "description": "Malware family Backdoor.Peg.Php.Generic",
                "firstContact": "2023-01-13T21:46:26.925Z",
                "hasPlaybackContacts": false,
                "id": "c329ff00-938b-11ed-b0f8-a7e340234a4e",
                "labelDistribution": {
                    "1791": 1,
                    "4301": 1
                },
                "lastContact": "2023-01-27T21:16:25.912Z",
                "status": "open",
                "statusTimestamp": "2023-01-13T21:46:40.240Z",
                "timestamp": "2023-01-13T21:46:40.240Z",
                "totalEndpoints": 2,
                "unread": false
            },
            {
                "adversaries": [
                    "tormail.org"
                ],
                "adversaryId": "tormail.org",
                "adversaryTypes": [
                    "Spam"
                ],
                "contacts": 4,
                "description": "Disposable email host",
                "firstContact": "2023-01-13T21:46:15.650Z",
                "hasPlaybackContacts": false,
                "id": "bc0a4400-938b-11ed-b0f8-a7e340234a4e",
                "labelDistribution": {
                    "1791": 1,
                    "2144": 2,
                    "4301": 1
                },
                "lastContact": "2023-01-27T21:03:07.761Z",
                "status": "open",
                "statusTimestamp": "2023-01-13T21:46:28.288Z",
                "timestamp": "2023-01-13T21:46:28.288Z",
                "totalEndpoints": 3,
                "unread": true
            },
            {
                "adversaries": [
                    "businessbackend.com"
                ],
                "adversaryId": "businessbackend.com",
                "adversaryTypes": [
                    "Spam"
                ],
                "contacts": 2,
                "description": "Disposable email host",
                "firstContact": "2023-01-13T21:46:06.886Z",
                "hasPlaybackContacts": false,
                "id": "ba390670-938b-11ed-b0f8-a7e340234a4e",
                "labelDistribution": {
                    "1791": 1,
                    "4301": 1
                },
                "lastContact": "2023-01-27T21:03:35.699Z",
                "status": "open",
                "statusTimestamp": "2023-01-13T21:46:25.239Z",
                "timestamp": "2023-01-13T21:46:25.239Z",
                "totalEndpoints": 2,
                "unread": true
            }
        ]
    }
}

Human Readable Output

Incidents

Adversaries Adversary Id Adversary Types Contacts Description First Contact Has Playback Contacts Id Label Distribution Last Contact Status Status Timestamp Timestamp Total Endpoints Unread
jits.ac.in jits.ac.in Malware 5 QakBot 2023-01-13T21:51:12.190Z false 6eddaf40-938c-11ed-b0f8-a7e340234a4e 1791: 1
548: 3
4301: 1		 2023-01-27T21:23:34.329Z open 2023-02-08T00:29:50.824Z 2023-01-13T21:51:28.308Z 3 false
msgos.com msgos.com Spam 3 Disposable email host 2023-01-13T21:51:10.312Z false 6edc4fb0-938c-11ed-b0f8-a7e340234a4e 1791: 1
4055: 1
4301: 1		 2023-01-27T21:16:25.261Z open 2023-01-13T21:51:28.299Z 2023-01-13T21:51:28.299Z 3 false
netwonder.net netwonder.net Malware 9 Malware family Nivdort 2023-01-13T21:50:53.247Z false 642934c0-938c-11ed-b0f8-a7e340234a4e 1791: 2
2144: 6
4301: 1		 2023-01-27T21:21:19.861Z open 2023-01-13T21:51:10.348Z 2023-01-13T21:51:10.348Z 3 false
subwaybookreview.com subwaybookreview.com Malware 2 Malware family Exploit.Msoffice.Generic 2023-01-13T21:50:38.599Z false 59641870-938c-11ed-b0f8-a7e340234a4e 1791: 1
4301: 1		 2023-01-27T21:33:59.964Z open 2023-01-13T21:50:52.279Z 2023-01-13T21:50:52.279Z 2 true
michaeleaston.com michaeleaston.com Malware 3 Malware family Trojan.Agent.Bg.Script 2023-01-13T21:49:50.220Z false 405525e0-938c-11ed-b0f8-a7e340234a4e 1791: 1
989: 1
4301: 1		 2023-01-27T21:16:25.995Z open 2023-01-13T21:50:10.238Z 2023-01-13T21:50:10.238Z 3 false
cane.pw cane.pw Spam 2 Disposable email host 2023-01-13T21:49:28.515Z false 304360e0-938c-11ed-b0f8-a7e340234a4e 1791: 1
4301: 1		 2023-01-27T21:16:25.956Z open 2023-01-13T21:49:43.278Z 2023-01-13T21:49:43.278Z 2 true
cek.pm cek.pm Spam 2 Disposable email host 2023-01-13T21:47:46.473Z false f1a7da00-938b-11ed-b0f8-a7e340234a4e 1791: 1
4301: 1		 2023-01-27T21:16:25.744Z open 2023-01-13T21:47:58.240Z 2023-01-13T21:47:58.240Z 2 true
anothercity.ru anothercity.ru Malware 2 Malware family Backdoor.Peg.Php.Generic 2023-01-13T21:46:26.925Z false c329ff00-938b-11ed-b0f8-a7e340234a4e 1791: 1
4301: 1		 2023-01-27T21:16:25.912Z open 2023-01-13T21:46:40.240Z 2023-01-13T21:46:40.240Z 2 false
tormail.org tormail.org Spam 4 Disposable email host 2023-01-13T21:46:15.650Z false bc0a4400-938b-11ed-b0f8-a7e340234a4e 1791: 1
2144: 2
4301: 1		 2023-01-27T21:03:07.761Z open 2023-01-13T21:46:28.288Z 2023-01-13T21:46:28.288Z 3 true
businessbackend.com businessbackend.com Spam 2 Disposable email host 2023-01-13T21:46:06.886Z false ba390670-938b-11ed-b0f8-a7e340234a4e 1791: 1
4301: 1		 2023-01-27T21:03:35.699Z open 2023-01-13T21:46:25.239Z 2023-01-13T21:46:25.239Z 2 true

paginationInfo

Items Next Page
10 2 1

lumu-retrieve-muted-incidents

Get a paginated list of muted incidents for the company. The items are listed by the most recent.

Base Command

lumu-retrieve-muted-incidents

Input

Argument Name Description Required
page page requested . Optional
limit items limit requested . Default is 10. Optional
adversary_types choose types: C2C,Malware,DGA,Mining,Spam,Phishing. Possible values are: C2C, Malware, DGA, Mining, Spam, Phishing. Optional
labels Lumu labels requested . Optional

Context Output

Path Type Description
Lumu.RetrieveMutedIncidents.items.id String Lumu incident id
Lumu.RetrieveMutedIncidents.items.timestamp Date Lumu timestamp
Lumu.RetrieveMutedIncidents.items.statusTimestamp Date Lumu statusTimestamp
Lumu.RetrieveMutedIncidents.items.status String Lumu status
Lumu.RetrieveMutedIncidents.items.contacts Number Lumu contacts
Lumu.RetrieveMutedIncidents.items.adversaries String Lumu adversaries
Lumu.RetrieveMutedIncidents.items.adversaryId String Lumu adversaryId
Lumu.RetrieveMutedIncidents.items.adversaryTypes String Lumu adversaryTypes
Lumu.RetrieveMutedIncidents.items.description String Lumu description
Lumu.RetrieveMutedIncidents.items.labelDistribution Number Lumu labelDistribution
Lumu.RetrieveMutedIncidents.items.totalEndpoints Number Lumu totalEndpoints
Lumu.RetrieveMutedIncidents.items.lastContact Date Lumu lastContact
Lumu.RetrieveMutedIncidents.items.unread Boolean Lumu unread
Lumu.RetrieveMutedIncidents.paginationInfo.page Number current page
Lumu.RetrieveMutedIncidents.paginationInfo.items Number current items

Command example


#### Context Example

```json
{
    "Lumu": {
        "RetrieveMutedIncidents": [
            {
                "adversaries": [
                    "12finance.com"
                ],
                "adversaryId": "12finance.com",
                "adversaryTypes": [
                    "Mining"
                ],
                "contacts": 11,
                "description": "CryptoMining domain",
                "firstContact": "2022-12-23T14:46:54Z",
                "hasPlaybackContacts": false,
                "id": "721ed640-82d2-11ed-a600-d53ba4d2bb70",
                "labelDistribution": {
                    "2148": 1,
                    "2254": 10
                },
                "lastContact": "2022-12-23T22:30:10.448Z",
                "status": "muted",
                "statusTimestamp": "2022-12-27T02:39:14.360Z",
                "timestamp": "2022-12-23T14:59:48.772Z",
                "totalEndpoints": 4,
                "unread": false
            },
            {
                "adversaries": [
                    "www.digeus.com"
                ],
                "adversaryId": "www.digeus.com",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 2,
                "description": "Malware family Application.Deceptor.ANL",
                "firstContact": "2022-12-12T23:20:56.706Z",
                "hasPlaybackContacts": false,
                "id": "ab056a80-7a73-11ed-a600-d53ba4d2bb70",
                "labelDistribution": {
                    "147": 1,
                    "218": 1
                },
                "lastContact": "2022-12-22T20:37:02.228Z",
                "status": "muted",
                "statusTimestamp": "2022-12-15T20:59:51.796Z",
                "timestamp": "2022-12-12T23:21:12.744Z",
                "totalEndpoints": 2,
                "unread": false
            },
            {
                "adversaries": [
                    "jameshallybone.co.uk"
                ],
                "adversaryId": "jameshallybone.co.uk",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 8,
                "description": "Malicious domain",
                "firstContact": "2022-11-21T21:46:01.425Z",
                "hasPlaybackContacts": false,
                "id": "f06a50c0-69e5-11ed-89c2-6136df938368",
                "labelDistribution": {
                    "1651": 1,
                    "3811": 1,
                    "989": 6
                },
                "lastContact": "2022-12-05T16:03:05.322Z",
                "status": "muted",
                "statusTimestamp": "2022-12-13T20:48:09.825Z",
                "timestamp": "2022-11-21T21:46:22.028Z",
                "totalEndpoints": 3,
                "unread": false
            },
            {
                "adversaries": [
                    "3.223.53.1"
                ],
                "adversaryId": "3.223.53.1",
                "adversaryTypes": [
                    "Spam"
                ],
                "contacts": 1,
                "description": "Activity Test Query",
                "firstContact": "2022-12-12T17:09:20.331Z",
                "hasPlaybackContacts": false,
                "id": "8b6f8c70-7a71-11ed-a600-d53ba4d2bb70",
                "labelDistribution": {
                    "218": 1
                },
                "lastContact": "2022-12-12T17:09:20.331Z",
                "status": "muted",
                "statusTimestamp": "2022-12-12T23:21:43.833Z",
                "timestamp": "2022-12-12T23:06:00.759Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "coovigomez.com"
                ],
                "adversaryId": "coovigomez.com",
                "adversaryTypes": [
                    "Mining"
                ],
                "contacts": 1,
                "description": "CryptoMining domain",
                "firstContact": "2022-11-12T23:31:33Z",
                "hasPlaybackContacts": false,
                "id": "149207b0-6471-11ed-b373-192ba321fedf",
                "labelDistribution": {
                    "2148": 1
                },
                "lastContact": "2022-11-12T23:31:33Z",
                "status": "muted",
                "statusTimestamp": "2022-11-17T18:56:09.751Z",
                "timestamp": "2022-11-14T23:07:15.755Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "barbombon.com."
                ],
                "adversaryId": "barbombon.com.",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 2,
                "description": "Malware family Trojan.Script.Generic",
                "firstContact": "2022-10-28T19:39:13.452Z",
                "hasPlaybackContacts": false,
                "id": "47bbc6c0-56f8-11ed-987a-cd6f8ff058b8",
                "labelDistribution": {
                    "1651": 2
                },
                "lastContact": "2022-10-28T19:44:10.172Z",
                "status": "muted",
                "statusTimestamp": "2022-10-31T21:51:02.594Z",
                "timestamp": "2022-10-28T19:39:47.372Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "coasttickets.com"
                ],
                "adversaryId": "coasttickets.com",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family Trojan.Downloader.Psdownload.MSIL.Generic",
                "firstContact": "2022-09-22T15:19:42.152Z",
                "hasPlaybackContacts": true,
                "id": "11c5a410-41fd-11ed-8751-63984e51f242",
                "labelDistribution": {
                    "548": 1
                },
                "lastContact": "2022-09-22T15:19:42.152Z",
                "status": "muted",
                "statusTimestamp": "2022-10-28T17:06:32.994Z",
                "timestamp": "2022-10-02T02:51:09.905Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "dark-utilities.pw"
                ],
                "adversaryId": "dark-utilities.pw",
                "adversaryTypes": [
                    "Mining"
                ],
                "contacts": 2,
                "description": "CryptoMining domain",
                "firstContact": "2022-10-27T16:47:40Z",
                "hasPlaybackContacts": false,
                "id": "8da63fc0-5618-11ed-987a-cd6f8ff058b8",
                "labelDistribution": {
                    "2148": 1,
                    "2267": 1
                },
                "lastContact": "2022-10-27T17:12:45.099Z",
                "status": "muted",
                "statusTimestamp": "2022-10-27T17:57:57.931Z",
                "timestamp": "2022-10-27T16:58:17.404Z",
                "totalEndpoints": 2,
                "unread": false
            },
            {
                "adversaries": [
                    "www.com-about.com"
                ],
                "adversaryId": "www.com-about.com",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family Downloader.Riskware.A.Atoz",
                "firstContact": "2022-10-25T20:45:41.154Z",
                "hasPlaybackContacts": false,
                "id": "046a19c0-54a6-11ed-9df2-6538d9561738",
                "labelDistribution": {
                    "3635": 1
                },
                "lastContact": "2022-10-25T20:45:41.154Z",
                "status": "muted",
                "statusTimestamp": "2022-10-25T21:17:21.376Z",
                "timestamp": "2022-10-25T20:45:53.372Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "nexttime.ovh"
                ],
                "adversaryId": "nexttime.ovh",
                "adversaryTypes": [
                    "Malware",
                    "Mining"
                ],
                "contacts": 5,
                "description": "Malicious domain",
                "firstContact": "2022-10-25T21:13:43.551Z",
                "hasPlaybackContacts": false,
                "id": "ef8ee900-54a9-11ed-9df2-6538d9561738",
                "labelDistribution": {
                    "3635": 5
                },
                "lastContact": "2022-10-26T22:45:31.230Z",
                "status": "muted",
                "statusTimestamp": "2022-10-25T21:16:15.909Z",
                "timestamp": "2022-10-25T21:13:56.368Z",
                "totalEndpoints": 1,
                "unread": false
            }
        ]
    }
}

Human Readable Output

Incidents

Adversaries Adversary Id Adversary Types Contacts Description First Contact Has Playback Contacts Id Label Distribution Last Contact Status Status Timestamp Timestamp Total Endpoints Unread
12finance.com 12finance.com Mining 11 CryptoMining domain 2022-12-23T14:46:54Z false 721ed640-82d2-11ed-a600-d53ba4d2bb70 2148: 1
2254: 10		 2022-12-23T22:30:10.448Z muted 2022-12-27T02:39:14.360Z 2022-12-23T14:59:48.772Z 4 false
www.digeus.com www.digeus.com Malware 2 Malware family Application.Deceptor.ANL 2022-12-12T23:20:56.706Z false ab056a80-7a73-11ed-a600-d53ba4d2bb70 147: 1
218: 1		 2022-12-22T20:37:02.228Z muted 2022-12-15T20:59:51.796Z 2022-12-12T23:21:12.744Z 2 false
jameshallybone.co.uk jameshallybone.co.uk Malware 8 Malicious domain 2022-11-21T21:46:01.425Z false f06a50c0-69e5-11ed-89c2-6136df938368 989: 6
1651: 1
3811: 1		 2022-12-05T16:03:05.322Z muted 2022-12-13T20:48:09.825Z 2022-11-21T21:46:22.028Z 3 false
3.223.53.1 3.223.53.1 Spam 1 Activity Test Query 2022-12-12T17:09:20.331Z false 8b6f8c70-7a71-11ed-a600-d53ba4d2bb70 218: 1 2022-12-12T17:09:20.331Z muted 2022-12-12T23:21:43.833Z 2022-12-12T23:06:00.759Z 1 false
coovigomez.com coovigomez.com Mining 1 CryptoMining domain 2022-11-12T23:31:33Z false 149207b0-6471-11ed-b373-192ba321fedf 2148: 1 2022-11-12T23:31:33Z muted 2022-11-17T18:56:09.751Z 2022-11-14T23:07:15.755Z 1 false
barbombon.com. barbombon.com. Malware 2 Malware family Trojan.Script.Generic 2022-10-28T19:39:13.452Z false 47bbc6c0-56f8-11ed-987a-cd6f8ff058b8 1651: 2 2022-10-28T19:44:10.172Z muted 2022-10-31T21:51:02.594Z 2022-10-28T19:39:47.372Z 1 false
coasttickets.com coasttickets.com Malware 1 Malware family Trojan.Downloader.Psdownload.MSIL.Generic 2022-09-22T15:19:42.152Z true 11c5a410-41fd-11ed-8751-63984e51f242 548: 1 2022-09-22T15:19:42.152Z muted 2022-10-28T17:06:32.994Z 2022-10-02T02:51:09.905Z 1 false
dark-utilities.pw dark-utilities.pw Mining 2 CryptoMining domain 2022-10-27T16:47:40Z false 8da63fc0-5618-11ed-987a-cd6f8ff058b8 2148: 1
2267: 1		 2022-10-27T17:12:45.099Z muted 2022-10-27T17:57:57.931Z 2022-10-27T16:58:17.404Z 2 false
www.com-about.com www.com-about.com Malware 1 Malware family Downloader.Riskware.A.Atoz 2022-10-25T20:45:41.154Z false 046a19c0-54a6-11ed-9df2-6538d9561738 3635: 1 2022-10-25T20:45:41.154Z muted 2022-10-25T21:17:21.376Z 2022-10-25T20:45:53.372Z 1 false
nexttime.ovh nexttime.ovh Malware,
Mining		 5 Malicious domain 2022-10-25T21:13:43.551Z false ef8ee900-54a9-11ed-9df2-6538d9561738 3635: 5 2022-10-26T22:45:31.230Z muted 2022-10-25T21:16:15.909Z 2022-10-25T21:13:56.368Z 1 false

paginationInfo

Items Next Page
10 2 1

Command example

!lumu-retrieve-muted-incidents labels=1651 adversary-types=Malware

Context Example

{
    "Lumu": {
        "RetrieveMutedIncidents": [
            {
                "adversaries": [
                    "jameshallybone.co.uk"
                ],
                "adversaryId": "jameshallybone.co.uk",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 8,
                "description": "Malicious domain",
                "firstContact": "2022-11-21T21:46:01.425Z",
                "hasPlaybackContacts": false,
                "id": "f06a50c0-69e5-11ed-89c2-6136df938368",
                "labelDistribution": {
                    "1651": 1,
                    "3811": 1,
                    "989": 6
                },
                "lastContact": "2022-12-05T16:03:05.322Z",
                "status": "muted",
                "statusTimestamp": "2022-12-13T20:48:09.825Z",
                "timestamp": "2022-11-21T21:46:22.028Z",
                "totalEndpoints": 3,
                "unread": false
            },
            {
                "adversaries": [
                    "barbombon.com."
                ],
                "adversaryId": "barbombon.com.",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 2,
                "description": "Malware family Trojan.Script.Generic",
                "firstContact": "2022-10-28T19:39:13.452Z",
                "hasPlaybackContacts": false,
                "id": "47bbc6c0-56f8-11ed-987a-cd6f8ff058b8",
                "labelDistribution": {
                    "1651": 2
                },
                "lastContact": "2022-10-28T19:44:10.172Z",
                "status": "muted",
                "statusTimestamp": "2022-10-31T21:51:02.594Z",
                "timestamp": "2022-10-28T19:39:47.372Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "secure.runescape.com-oc.ru"
                ],
                "adversaryId": "secure.runescape.com-oc.ru",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 47,
                "description": "Malicious domain",
                "firstContact": "2022-07-07T06:47:29.452Z",
                "hasPlaybackContacts": false,
                "id": "dc758440-fdc0-11ec-80a5-f16f41289f2f",
                "labelDistribution": {
                    "1651": 4,
                    "989": 43
                },
                "lastContact": "2022-12-05T16:03:05.328Z",
                "status": "muted",
                "statusTimestamp": "2022-07-07T20:15:16.997Z",
                "timestamp": "2022-07-07T06:48:51.588Z",
                "totalEndpoints": 2,
                "unread": false
            },
            {
                "adversaries": [
                    "asapcallcenter.net"
                ],
                "adversaryId": "asapcallcenter.net",
                "adversaryTypes": [
                    "C2C"
                ],
                "contacts": 5,
                "description": "Malware family KINS",
                "hasPlaybackContacts": false,
                "id": "2720e2a0-a0c9-11ec-af58-8da2705ed08a",
                "labelDistribution": {
                    "1651": 3,
                    "548": 1,
                    "864": 1
                },
                "lastContact": "2022-07-09T15:53:55.423Z",
                "status": "muted",
                "statusTimestamp": "2022-03-10T23:59:14.933Z",
                "timestamp": "2022-03-10T23:23:54.698Z",
                "totalEndpoints": 3,
                "unread": false
            }
        ]
    }
}

Human Readable Output

Incidents

Adversaries Adversary Id Adversary Types Contacts Description First Contact Has Playback Contacts Id Label Distribution Last Contact Status Status Timestamp Timestamp Total Endpoints Unread
jameshallybone.co.uk jameshallybone.co.uk Malware 8 Malicious domain 2022-11-21T21:46:01.425Z false f06a50c0-69e5-11ed-89c2-6136df938368 989: 6
1651: 1
3811: 1		 2022-12-05T16:03:05.322Z muted 2022-12-13T20:48:09.825Z 2022-11-21T21:46:22.028Z 3 false
barbombon.com. barbombon.com. Malware 2 Malware family Trojan.Script.Generic 2022-10-28T19:39:13.452Z false 47bbc6c0-56f8-11ed-987a-cd6f8ff058b8 1651: 2 2022-10-28T19:44:10.172Z muted 2022-10-31T21:51:02.594Z 2022-10-28T19:39:47.372Z 1 false
secure.runescape.com-oc.ru secure.runescape.com-oc.ru Malware 47 Malicious domain 2022-07-07T06:47:29.452Z false dc758440-fdc0-11ec-80a5-f16f41289f2f 1651: 4
989: 43		 2022-12-05T16:03:05.328Z muted 2022-07-07T20:15:16.997Z 2022-07-07T06:48:51.588Z 2 false
asapcallcenter.net asapcallcenter.net C2C 5 Malware family KINS   false 2720e2a0-a0c9-11ec-af58-8da2705ed08a 864: 1
1651: 3
548: 1		 2022-07-09T15:53:55.423Z muted 2022-03-10T23:59:14.933Z 2022-03-10T23:23:54.698Z 3 false

paginationInfo

Items Page
10 1

lumu-retrieve-closed-incidents

Get a paginated list of closed incidents for the company. The items are listed by the most recent.

Base Command

lumu-retrieve-closed-incidents

Input

Argument Name Description Required
page page requested . Optional
limit items limit requested . Default is 10. Optional
adversary_types choose types: C2C,Malware,DGA,Mining,Spam,Phishing. Possible values are: C2C, Malware, DGA, Mining, Spam, Phishing. Optional
labels Lumu labels requested. Optional

Context Output

Path Type Description
Lumu.RetrieveClosedIncidents.items.id String Lumu incident id
Lumu.RetrieveClosedIncidents.items.timestamp Date Lumu timestamp
Lumu.RetrieveClosedIncidents.items.statusTimestamp Date Lumu statusTimestamp
Lumu.RetrieveClosedIncidents.items.status String Lumu status
Lumu.RetrieveClosedIncidents.items.contacts Number Lumu contacts
Lumu.RetrieveClosedIncidents.items.adversaries String Lumu adversaries
Lumu.RetrieveClosedIncidents.items.adversaryId String Lumu adversaryId
Lumu.RetrieveClosedIncidents.items.adversaryTypes String Lumu adversaryTypes
Lumu.RetrieveClosedIncidents.items.description String Lumu description
Lumu.RetrieveClosedIncidents.items.labelDistribution Number Lumu labelDistribution
Lumu.RetrieveClosedIncidents.items.totalEndpoints Number Lumu totalEndpoints
Lumu.RetrieveClosedIncidents.items.lastContact Date Lumu lastContact
Lumu.RetrieveClosedIncidents.items.unread Boolean Lumu unread
Lumu.RetrieveClosedIncidents.paginationInfo.page Number current page
Lumu.RetrieveClosedIncidents.paginationInfo.items Number current items
Lumu.RetrieveClosedIncidents.paginationInfo.next Number next page

Command example


#### Context Example

```json
{
    "Lumu": {
        "RetrieveClosedIncidents": [
            {
                "adversaries": [
                    "www.chg.com.br"
                ],
                "adversaryId": "www.chg.com.br",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family Win32.Remoteadmin.C.Winvnc.Based",
                "firstContact": "2023-02-15T13:28:25.537Z",
                "hasPlaybackContacts": false,
                "id": "ad2b63c0-ad34-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 1
                },
                "lastContact": "2023-02-15T13:28:25.537Z",
                "status": "closed",
                "statusTimestamp": "2023-02-15T21:53:41.468Z",
                "timestamp": "2023-02-15T13:28:47.356Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "italive.it"
                ],
                "adversaryId": "italive.it",
                "adversaryTypes": [
                    "Phishing"
                ],
                "contacts": 1,
                "description": "Phishing domain",
                "firstContact": "2023-01-28T03:37:56.088Z",
                "hasPlaybackContacts": false,
                "id": "3e5f6480-9ebd-11ed-a0c7-dd6f8e69d343",
                "labelDistribution": {
                    "4301": 1
                },
                "lastContact": "2023-01-28T03:37:56.088Z",
                "status": "closed",
                "statusTimestamp": "2023-02-15T13:28:32.355Z",
                "timestamp": "2023-01-28T03:38:35.080Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "www.chg.com.br"
                ],
                "adversaryId": "www.chg.com.br",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family Win32.Remoteadmin.C.Winvnc.Based",
                "firstContact": "2023-02-10T23:58:44.455Z",
                "hasPlaybackContacts": false,
                "id": "e65b3f60-a99e-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 1
                },
                "lastContact": "2023-02-10T23:58:44.455Z",
                "status": "closed",
                "statusTimestamp": "2023-02-15T13:28:07.991Z",
                "timestamp": "2023-02-10T23:59:05.302Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "portaconexao8.top"
                ],
                "adversaryId": "portaconexao8.top",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 2,
                "description": "Malware hash: 55e57c52cd5e1dcfad4e9bcf0eb2f3a5",
                "firstContact": "2023-02-11T18:40:09.087Z",
                "hasPlaybackContacts": false,
                "id": "89658e80-aa3b-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "147": 2
                },
                "lastContact": "2023-02-11T18:40:09.087Z",
                "status": "closed",
                "statusTimestamp": "2023-02-15T13:26:02.357Z",
                "timestamp": "2023-02-11T18:40:20.328Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "bitmovil.mx"
                ],
                "adversaryId": "bitmovil.mx",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 2,
                "description": "Heodo",
                "firstContact": "2023-02-14T17:05:37.987Z",
                "hasPlaybackContacts": false,
                "id": "0d207a50-ac8a-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "989": 2
                },
                "lastContact": "2023-02-14T17:05:37.987Z",
                "status": "closed",
                "statusTimestamp": "2023-02-14T18:44:09.946Z",
                "timestamp": "2023-02-14T17:07:24.405Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "rea.co.ke"
                ],
                "adversaryId": "rea.co.ke",
                "adversaryTypes": [
                    "C2C",
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family P2PZeuS",
                "firstContact": "2023-02-14T17:27:26.791Z",
                "hasPlaybackContacts": false,
                "id": "e0b39da0-ac8c-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "989": 1
                },
                "lastContact": "2023-02-14T17:27:26.791Z",
                "status": "closed",
                "statusTimestamp": "2023-02-14T18:33:38.315Z",
                "timestamp": "2023-02-14T17:27:38.362Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "rea.co.ke"
                ],
                "adversaryId": "rea.co.ke",
                "adversaryTypes": [
                    "C2C",
                    "Malware"
                ],
                "contacts": 21,
                "description": "Malware family P2PZeuS",
                "firstContact": "2022-12-12T16:36:02.228Z",
                "hasPlaybackContacts": false,
                "id": "726849c0-7a6b-11ed-a600-d53ba4d2bb70",
                "labelDistribution": {
                    "1885": 1,
                    "2254": 19,
                    "2267": 1
                },
                "lastContact": "2023-01-03T23:31:50.938Z",
                "status": "closed",
                "statusTimestamp": "2023-02-14T17:26:47.897Z",
                "timestamp": "2022-12-12T22:22:21.788Z",
                "totalEndpoints": 5,
                "unread": false
            },
            {
                "adversaries": [
                    "www.chg.com.br"
                ],
                "adversaryId": "www.chg.com.br",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family Win32.Remoteadmin.C.Winvnc.Based",
                "firstContact": "2023-02-10T22:39:28.912Z",
                "hasPlaybackContacts": false,
                "id": "d42c40b0-a993-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 1
                },
                "lastContact": "2023-02-10T22:39:28.912Z",
                "status": "closed",
                "statusTimestamp": "2023-02-10T22:41:07.512Z",
                "timestamp": "2023-02-10T22:39:50.331Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "www.chg.com.br"
                ],
                "adversaryId": "www.chg.com.br",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family Win32.Remoteadmin.C.Winvnc.Based",
                "firstContact": "2023-02-10T21:56:41.360Z",
                "hasPlaybackContacts": false,
                "id": "d98a0f20-a98d-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 1
                },
                "lastContact": "2023-02-10T21:56:41.360Z",
                "status": "closed",
                "statusTimestamp": "2023-02-10T22:37:37.379Z",
                "timestamp": "2023-02-10T21:57:02.354Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "www.chg.com.br"
                ],
                "adversaryId": "www.chg.com.br",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family Win32.Remoteadmin.C.Winvnc.Based",
                "firstContact": "2023-02-10T21:41:27.961Z",
                "hasPlaybackContacts": false,
                "id": "b9e93490-a98b-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 1
                },
                "lastContact": "2023-02-10T21:41:27.961Z",
                "status": "closed",
                "statusTimestamp": "2023-02-10T21:56:37.507Z",
                "timestamp": "2023-02-10T21:41:50.297Z",
                "totalEndpoints": 1,
                "unread": false
            }
        ]
    }
}

Human Readable Output

Incidents

Adversaries Adversary Id Adversary Types Contacts Description First Contact Has Playback Contacts Id Label Distribution Last Contact Status Status Timestamp Timestamp Total Endpoints Unread
www.chg.com.br www.chg.com.br Malware 1 Malware family Win32.Remoteadmin.C.Winvnc.Based 2023-02-15T13:28:25.537Z false ad2b63c0-ad34-11ed-9fd0-e5fb50c818f6 0: 1 2023-02-15T13:28:25.537Z closed 2023-02-15T21:53:41.468Z 2023-02-15T13:28:47.356Z 1 false
italive.it italive.it Phishing 1 Phishing domain 2023-01-28T03:37:56.088Z false 3e5f6480-9ebd-11ed-a0c7-dd6f8e69d343 4301: 1 2023-01-28T03:37:56.088Z closed 2023-02-15T13:28:32.355Z 2023-01-28T03:38:35.080Z 1 false
www.chg.com.br www.chg.com.br Malware 1 Malware family Win32.Remoteadmin.C.Winvnc.Based 2023-02-10T23:58:44.455Z false e65b3f60-a99e-11ed-9fd0-e5fb50c818f6 0: 1 2023-02-10T23:58:44.455Z closed 2023-02-15T13:28:07.991Z 2023-02-10T23:59:05.302Z 1 false
portaconexao8.top portaconexao8.top Malware 2 Malware hash: 55e57c52cd5e1dcfad4e9bcf0eb2f3a5 2023-02-11T18:40:09.087Z false 89658e80-aa3b-11ed-9fd0-e5fb50c818f6 147: 2 2023-02-11T18:40:09.087Z closed 2023-02-15T13:26:02.357Z 2023-02-11T18:40:20.328Z 1 false
bitmovil.mx bitmovil.mx Malware 2 Heodo 2023-02-14T17:05:37.987Z false 0d207a50-ac8a-11ed-9fd0-e5fb50c818f6 989: 2 2023-02-14T17:05:37.987Z closed 2023-02-14T18:44:09.946Z 2023-02-14T17:07:24.405Z 1 false
rea.co.ke rea.co.ke C2C,
Malware		 1 Malware family P2PZeuS 2023-02-14T17:27:26.791Z false e0b39da0-ac8c-11ed-9fd0-e5fb50c818f6 989: 1 2023-02-14T17:27:26.791Z closed 2023-02-14T18:33:38.315Z 2023-02-14T17:27:38.362Z 1 false
rea.co.ke rea.co.ke C2C,
Malware		 21 Malware family P2PZeuS 2022-12-12T16:36:02.228Z false 726849c0-7a6b-11ed-a600-d53ba4d2bb70 2267: 1
1885: 1
2254: 19		 2023-01-03T23:31:50.938Z closed 2023-02-14T17:26:47.897Z 2022-12-12T22:22:21.788Z 5 false
www.chg.com.br www.chg.com.br Malware 1 Malware family Win32.Remoteadmin.C.Winvnc.Based 2023-02-10T22:39:28.912Z false d42c40b0-a993-11ed-9fd0-e5fb50c818f6 0: 1 2023-02-10T22:39:28.912Z closed 2023-02-10T22:41:07.512Z 2023-02-10T22:39:50.331Z 1 false
www.chg.com.br www.chg.com.br Malware 1 Malware family Win32.Remoteadmin.C.Winvnc.Based 2023-02-10T21:56:41.360Z false d98a0f20-a98d-11ed-9fd0-e5fb50c818f6 0: 1 2023-02-10T21:56:41.360Z closed 2023-02-10T22:37:37.379Z 2023-02-10T21:57:02.354Z 1 false
www.chg.com.br www.chg.com.br Malware 1 Malware family Win32.Remoteadmin.C.Winvnc.Based 2023-02-10T21:41:27.961Z false b9e93490-a98b-11ed-9fd0-e5fb50c818f6 0: 1 2023-02-10T21:41:27.961Z closed 2023-02-10T21:56:37.507Z 2023-02-10T21:41:50.297Z 1 false

paginationInfo

Items Next Page
10 2 1

Command example

!lumu-retrieve-closed-incidents labels=0 adversary-types=Mining,Spam

Context Example

{
    "Lumu": {
        "RetrieveClosedIncidents": [
            {
                "adversaries": [
                    "www.chg.com.br"
                ],
                "adversaryId": "www.chg.com.br",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family Win32.Remoteadmin.C.Winvnc.Based",
                "firstContact": "2023-02-15T13:28:25.537Z",
                "hasPlaybackContacts": false,
                "id": "ad2b63c0-ad34-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 1
                },
                "lastContact": "2023-02-15T13:28:25.537Z",
                "status": "closed",
                "statusTimestamp": "2023-02-15T21:53:41.468Z",
                "timestamp": "2023-02-15T13:28:47.356Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "www.chg.com.br"
                ],
                "adversaryId": "www.chg.com.br",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family Win32.Remoteadmin.C.Winvnc.Based",
                "firstContact": "2023-02-10T23:58:44.455Z",
                "hasPlaybackContacts": false,
                "id": "e65b3f60-a99e-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 1
                },
                "lastContact": "2023-02-10T23:58:44.455Z",
                "status": "closed",
                "statusTimestamp": "2023-02-15T13:28:07.991Z",
                "timestamp": "2023-02-10T23:59:05.302Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "www.chg.com.br"
                ],
                "adversaryId": "www.chg.com.br",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family Win32.Remoteadmin.C.Winvnc.Based",
                "firstContact": "2023-02-10T22:39:28.912Z",
                "hasPlaybackContacts": false,
                "id": "d42c40b0-a993-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 1
                },
                "lastContact": "2023-02-10T22:39:28.912Z",
                "status": "closed",
                "statusTimestamp": "2023-02-10T22:41:07.512Z",
                "timestamp": "2023-02-10T22:39:50.331Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "www.chg.com.br"
                ],
                "adversaryId": "www.chg.com.br",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family Win32.Remoteadmin.C.Winvnc.Based",
                "firstContact": "2023-02-10T21:56:41.360Z",
                "hasPlaybackContacts": false,
                "id": "d98a0f20-a98d-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 1
                },
                "lastContact": "2023-02-10T21:56:41.360Z",
                "status": "closed",
                "statusTimestamp": "2023-02-10T22:37:37.379Z",
                "timestamp": "2023-02-10T21:57:02.354Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "www.chg.com.br"
                ],
                "adversaryId": "www.chg.com.br",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 1,
                "description": "Malware family Win32.Remoteadmin.C.Winvnc.Based",
                "firstContact": "2023-02-10T21:41:27.961Z",
                "hasPlaybackContacts": false,
                "id": "b9e93490-a98b-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 1
                },
                "lastContact": "2023-02-10T21:41:27.961Z",
                "status": "closed",
                "statusTimestamp": "2023-02-10T21:56:37.507Z",
                "timestamp": "2023-02-10T21:41:50.297Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "www.chg.com.br"
                ],
                "adversaryId": "www.chg.com.br",
                "adversaryTypes": [
                    "Malware"
                ],
                "contacts": 10,
                "description": "Malware family Win32.Remoteadmin.C.Winvnc.Based",
                "firstContact": "2023-02-03T19:01:00Z",
                "hasPlaybackContacts": false,
                "id": "d0ce2800-a3f5-11ed-a0c7-dd6f8e69d343",
                "labelDistribution": {
                    "0": 7,
                    "989": 3
                },
                "lastContact": "2023-02-10T21:40:12.762Z",
                "status": "closed",
                "statusTimestamp": "2023-02-10T21:41:34.408Z",
                "timestamp": "2023-02-03T19:06:08.384Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "activity.lumu.io"
                ],
                "adversaryId": "activity.lumu.io",
                "adversaryTypes": [
                    "Spam"
                ],
                "contacts": 5,
                "description": "Activity Test Query",
                "firstContact": "2022-12-20T14:37:02.228Z",
                "hasPlaybackContacts": false,
                "id": "460dd2d0-a740-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 5
                },
                "lastContact": "2022-12-20T14:37:02.228Z",
                "status": "closed",
                "statusTimestamp": "2023-02-08T00:57:03.424Z",
                "timestamp": "2023-02-07T23:36:41.341Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "activity.lumu.io"
                ],
                "adversaryId": "activity.lumu.io",
                "adversaryTypes": [
                    "Spam"
                ],
                "contacts": 2,
                "description": "Activity Test Query",
                "firstContact": "2022-12-20T14:37:02.228Z",
                "hasPlaybackContacts": false,
                "id": "9e9238e0-a73d-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 2
                },
                "lastContact": "2022-12-20T14:37:02.228Z",
                "status": "closed",
                "statusTimestamp": "2023-02-07T23:20:42.817Z",
                "timestamp": "2023-02-07T23:17:41.358Z",
                "totalEndpoints": 1,
                "unread": false
            },
            {
                "adversaries": [
                    "activity.lumu.io"
                ],
                "adversaryId": "activity.lumu.io",
                "adversaryTypes": [
                    "Spam"
                ],
                "contacts": 12,
                "description": "Activity Test Query",
                "firstContact": "2023-02-07T15:51:15.463Z",
                "hasPlaybackContacts": false,
                "id": "826dd220-a6ff-11ed-9fd0-e5fb50c818f6",
                "labelDistribution": {
                    "0": 11,
                    "989": 1
                },
                "lastContact": "2023-02-07T15:51:15.463Z",
                "status": "closed",
                "statusTimestamp": "2023-02-07T23:08:53.658Z",
                "timestamp": "2023-02-07T15:53:05.346Z",
                "totalEndpoints": 3,
                "unread": false
            },
            {
                "adversaries": [
                    "activity.lumu.io"
                ],
                "adversaryId": "activity.lumu.io",
                "adversaryTypes": [
                    "Spam"
                ],
                "contacts": 3,
                "description": "Activity Test Query",
                "firstContact": "2022-12-20T14:37:02.228Z",
                "hasPlaybackContacts": false,
                "id": "eb611160-a638-11ed-a0c7-dd6f8e69d343",
                "labelDistribution": {
                    "0": 3
                },
                "lastContact": "2022-12-20T14:37:02.228Z",
                "status": "closed",
                "statusTimestamp": "2023-02-06T16:19:52.211Z",
                "timestamp": "2023-02-06T16:11:31.574Z",
                "totalEndpoints": 1,
                "unread": false
            }
        ]
    }
}

Human Readable Output

Incidents

Adversaries Adversary Id Adversary Types Contacts Description First Contact Has Playback Contacts Id Label Distribution Last Contact Status Status Timestamp Timestamp Total Endpoints Unread
www.chg.com.br www.chg.com.br Malware 1 Malware family Win32.Remoteadmin.C.Winvnc.Based 2023-02-15T13:28:25.537Z false ad2b63c0-ad34-11ed-9fd0-e5fb50c818f6 0: 1 2023-02-15T13:28:25.537Z closed 2023-02-15T21:53:41.468Z 2023-02-15T13:28:47.356Z 1 false
www.chg.com.br www.chg.com.br Malware 1 Malware family Win32.Remoteadmin.C.Winvnc.Based 2023-02-10T23:58:44.455Z false e65b3f60-a99e-11ed-9fd0-e5fb50c818f6 0: 1 2023-02-10T23:58:44.455Z closed 2023-02-15T13:28:07.991Z 2023-02-10T23:59:05.302Z 1 false
www.chg.com.br www.chg.com.br Malware 1 Malware family Win32.Remoteadmin.C.Winvnc.Based 2023-02-10T22:39:28.912Z false d42c40b0-a993-11ed-9fd0-e5fb50c818f6 0: 1 2023-02-10T22:39:28.912Z closed 2023-02-10T22:41:07.512Z 2023-02-10T22:39:50.331Z 1 false
www.chg.com.br www.chg.com.br Malware 1 Malware family Win32.Remoteadmin.C.Winvnc.Based 2023-02-10T21:56:41.360Z false d98a0f20-a98d-11ed-9fd0-e5fb50c818f6 0: 1 2023-02-10T21:56:41.360Z closed 2023-02-10T22:37:37.379Z 2023-02-10T21:57:02.354Z 1 false
www.chg.com.br www.chg.com.br Malware 1 Malware family Win32.Remoteadmin.C.Winvnc.Based 2023-02-10T21:41:27.961Z false b9e93490-a98b-11ed-9fd0-e5fb50c818f6 0: 1 2023-02-10T21:41:27.961Z closed 2023-02-10T21:56:37.507Z 2023-02-10T21:41:50.297Z 1 false
www.chg.com.br www.chg.com.br Malware 10 Malware family Win32.Remoteadmin.C.Winvnc.Based 2023-02-03T19:01:00Z false d0ce2800-a3f5-11ed-a0c7-dd6f8e69d343 989: 3
0: 7		 2023-02-10T21:40:12.762Z closed 2023-02-10T21:41:34.408Z 2023-02-03T19:06:08.384Z 1 false
activity.lumu.io activity.lumu.io Spam 5 Activity Test Query 2022-12-20T14:37:02.228Z false 460dd2d0-a740-11ed-9fd0-e5fb50c818f6 0: 5 2022-12-20T14:37:02.228Z closed 2023-02-08T00:57:03.424Z 2023-02-07T23:36:41.341Z 1 false
activity.lumu.io activity.lumu.io Spam 2 Activity Test Query 2022-12-20T14:37:02.228Z false 9e9238e0-a73d-11ed-9fd0-e5fb50c818f6 0: 2 2022-12-20T14:37:02.228Z closed 2023-02-07T23:20:42.817Z 2023-02-07T23:17:41.358Z 1 false
activity.lumu.io activity.lumu.io Spam 12 Activity Test Query 2023-02-07T15:51:15.463Z false 826dd220-a6ff-11ed-9fd0-e5fb50c818f6 989: 1
0: 11		 2023-02-07T15:51:15.463Z closed 2023-02-07T23:08:53.658Z 2023-02-07T15:53:05.346Z 3 false
activity.lumu.io activity.lumu.io Spam 3 Activity Test Query 2022-12-20T14:37:02.228Z false eb611160-a638-11ed-a0c7-dd6f8e69d343 0: 3 2022-12-20T14:37:02.228Z closed 2023-02-06T16:19:52.211Z 2023-02-06T16:11:31.574Z 1 false

paginationInfo

Items Next Page
10 2 1

lumu-retrieve-endpoints-by-incident

Get a paginated summary of the endpoints affected by a specified incident.

| {incident-uuid} | uuid of the specific incident |
|—|—|

Base Command

lumu-retrieve-endpoints-by-incident

Input

Argument Name Description Required
lumu_incident_id Lumu incident id requested. Required
page page requested . Optional
limit items limit requested . Default is 10. Optional

Context Output

Path Type Description
Lumu.RetrieveEndpointsByIncident.items.label Number Lumu label
Lumu.RetrieveEndpointsByIncident.items.endpoint String Lumu endpoint
Lumu.RetrieveEndpointsByIncident.items.total Number Lumu total
Lumu.RetrieveEndpointsByIncident.items.first Date Lumu first
Lumu.RetrieveEndpointsByIncident.items.last Date Lumu last
Lumu.RetrieveEndpointsByIncident.paginationInfo.page Number current page
Lumu.RetrieveEndpointsByIncident.paginationInfo.items Number current items

Command example

!lumu-retrieve-endpoints-by-incident lumu_incident_id=7c40be00-a7cf-11ed-9fd0-e5fb50c818f6

Context Example

{
    "Lumu": {
        "RetrieveEndpointsByIncident": [
            {
                "endpoint": "LUMU-100",
                "first": "2023-02-15T16:59:47.142Z",
                "label": 0,
                "last": "2023-02-15T16:59:47.142Z",
                "lastSourceId": "6d942a7a-d287-415e-9c09-3d6632a6a976",
                "lastSourceType": "custom_collector",
                "total": 1
            },
            {
                "endpoint": "Loacal-nesfapdm",
                "first": "2022-12-20T14:37:02.228Z",
                "label": 0,
                "last": "2022-12-20T14:37:02.228Z",
                "lastSourceId": "6d942a7a-d287-415e-9c09-3d6632a6a976",
                "lastSourceType": "custom_collector",
                "total": 1
            },
            {
                "endpoint": "cd-ho",
                "first": "2023-02-08T16:41:35.613Z",
                "label": 147,
                "last": "2023-02-08T16:41:35.613Z",
                "lastSourceId": "587ec9d348053ca03a58aeddeccb1b93",
                "lastSourceType": "PublicResolver",
                "total": 1
            },
            {
                "endpoint": "fgiraldo",
                "first": "2023-02-10T14:23:45Z",
                "label": 1885,
                "last": "2023-02-10T15:15:16Z",
                "lastSourceId": "c91a9a48-274f-430e-989e-cc237b594621",
                "lastSourceType": "integration",
                "total": 2
            },
            {
                "endpoint": "63620343863.instance-1",
                "first": "2023-02-13T17:01:43.204Z",
                "label": 2254,
                "last": "2023-02-13T17:01:43.204Z",
                "lastSourceId": "4358d167-3af0-4821-9f7b-ee58824ff87b",
                "lastSourceType": "integration",
                "total": 1
            },
            {
                "endpoint": "DESKTOP-LUMU",
                "first": "2023-02-09T15:22:01.450Z",
                "label": 989,
                "last": "2023-02-09T15:22:30.732Z",
                "lastSourceId": "c5ae44a0-8c53-11ed-8008-11cbedd55f0c",
                "lastSourceType": "windows_agent",
                "total": 2
            }
        ]
    }
}

Human Readable Output

Incident endpoints

Endpoint First Label Last Last Source Id Last Source Type Total
LUMU-100 2023-02-15T16:59:47.142Z 0 2023-02-15T16:59:47.142Z 6d942a7a-d287-415e-9c09-3d6632a6a976 custom_collector 1
Loacal-nesfapdm 2022-12-20T14:37:02.228Z 0 2022-12-20T14:37:02.228Z 6d942a7a-d287-415e-9c09-3d6632a6a976 custom_collector 1
cd-ho 2023-02-08T16:41:35.613Z 147 2023-02-08T16:41:35.613Z 587ec9d348053ca03a58aeddeccb1b93 PublicResolver 1
fgiraldo 2023-02-10T14:23:45Z 1885 2023-02-10T15:15:16Z c91a9a48-274f-430e-989e-cc237b594621 integration 2
63620343863.instance-1 2023-02-13T17:01:43.204Z 2254 2023-02-13T17:01:43.204Z 4358d167-3af0-4821-9f7b-ee58824ff87b integration 1
DESKTOP-LUMU 2023-02-09T15:22:01.450Z 989 2023-02-09T15:22:30.732Z c5ae44a0-8c53-11ed-8008-11cbedd55f0c windows_agent 2

paginationInfo

Items Page
10 1

lumu-mark-incident-as-read

This transaction does not require any additional body parameters.

| {incident-uuid} | uuid of the specific incident |
|—|—|

To associate a specific user to this transaction, include the header Lumu-User-Id with the user id as a value. Read more.

Base Command

lumu-mark-incident-as-read

Input

Argument Name Description Required
lumu_incident_id Lumu incident id. Required

Context Output

Path Type Description
Lumu.MarkIncidentAsRead.statusCode unknown Lumu statusCode

Command example

!lumu-mark-incident-as-read lumu_incident_id=7c40be00-a7cf-11ed-9fd0-e5fb50c818f6

Context Example

{
    "Lumu": {
        "MarkIncidentAsRead": ""
    }
}

Human Readable Output

Marked as read the incident successfully.

lumu-mute-incident

| {incident-uuid} | uuid of the specific incident |
|—|—|

To associate a specific user to this transaction, include the header Lumu-User-Id with the user id as a value. Read more.

Base Command

lumu-mute-incident

Input

Argument Name Description Required
lumu_incident_id Lumu incident id requested. Required
comment Lumu comment requested. Optional

Context Output

Path Type Description
Lumu.MuteIncident.statusCode unknown Lumu statusCode

Command example

!lumu-mute-incident lumu_incident_id=7c40be00-a7cf-11ed-9fd0-e5fb50c818f6 comment="mute from cortex"

Context Example

{
    "Lumu": {
        "MuteIncident": {
            "response": "",
            "statusCode": 200
        }
    }
}

Human Readable Output

Muted the incident successfully.

lumu-unmute-incident

| {incident-uuid} | uuid of the specific incident |
|—|—|

To associate a specific user to this transaction, include the header Lumu-User-Id with the user id as a value. Read more.

Base Command

lumu-unmute-incident

Input

Argument Name Description Required
lumu_incident_id Lumu incident id requested. Required
comment Lumu comment requested. Optional

Context Output

Path Type Description
Lumu.UnmuteIncident.statusCode unknown Lumu statusCode

Command example

!lumu-unmute-incident lumu_incident_id=7c40be00-a7cf-11ed-9fd0-e5fb50c818f6 comment="unmute from cortex"

Context Example

{
    "Lumu": {
        "UnmuteIncident": {
            "response": "",
            "statusCode": 200
        }
    }
}

Human Readable Output

Unmute the incident successfully.

lumu-consult-incidents-updates-through-rest

Lumu provides an endpoint to consult real-time updates on incident operations through REST when Websocket is not available.

Note: the date format in the updates received from the endpoint is in the UTC time zone and follows standards published in RFC 3339 and ISO 8601

| {company-key} | Your company’s unique API key available at the Lumu Portal |
| — | — |

Base Command

lumu-consult-incidents-updates-through-rest

Input

Argument Name Description Required
offset Lumu offset requested. Optional
limit items limit requested . Default is 10. Optional
time time requested . Optional

Context Output

Path Type Description
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.companyId String Lumu companyId
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.id String Lumu incident id
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.timestamp Date Lumu timestamp
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.statusTimestamp Date Lumu statusTimestamp
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.status String Lumu status
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.contacts Number Lumu contacts
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.adversaries String Lumu adversaries
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.adversaryId String Lumu adversaryId
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.adversaryTypes String Lumu adversaryTypes
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.description String Lumu description
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.labelDistribution Number Lumu labelDistribution
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.totalEndpoints Number Lumu totalEndpoints
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.lastContact Date Lumu lastContact
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.unread Boolean Lumu unread
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.hasPlaybackContacts Boolean Lumu hasPlaybackContacts
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.incident.firstContact Date Lumu firstContact
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentClosed.comment String Lumu comment
Lumu.ConsultIncidentsUpdatesThroughRest.updates.OpenIncidentsStatusUpdated.companyId String Lumu companyId
Lumu.ConsultIncidentsUpdatesThroughRest.updates.OpenIncidentsStatusUpdated.openIncidentsStatus.openIncidents Number Lumu openIncidents
Lumu.ConsultIncidentsUpdatesThroughRest.updates.OpenIncidentsStatusUpdated.openIncidentsStatus.totalContacts Number Lumu totalContacts
Lumu.ConsultIncidentsUpdatesThroughRest.updates.OpenIncidentsStatusUpdated.openIncidentsStatus.typeDistribution.DGA Number Lumu DGA
Lumu.ConsultIncidentsUpdatesThroughRest.updates.OpenIncidentsStatusUpdated.openIncidentsStatus.typeDistribution.C2C Number Lumu C2C
Lumu.ConsultIncidentsUpdatesThroughRest.updates.OpenIncidentsStatusUpdated.openIncidentsStatus.typeDistribution.Network Scan Number Lumu Network Scan
Lumu.ConsultIncidentsUpdatesThroughRest.updates.OpenIncidentsStatusUpdated.openIncidentsStatus.typeDistribution.Mining Number Lumu Mining
Lumu.ConsultIncidentsUpdatesThroughRest.updates.OpenIncidentsStatusUpdated.openIncidentsStatus.typeDistribution.Phishing Number Lumu Phishing
Lumu.ConsultIncidentsUpdatesThroughRest.updates.OpenIncidentsStatusUpdated.openIncidentsStatus.typeDistribution.Spam Number Lumu Spam
Lumu.ConsultIncidentsUpdatesThroughRest.updates.OpenIncidentsStatusUpdated.openIncidentsStatus.typeDistribution.Malware Number Lumu Malware
Lumu.ConsultIncidentsUpdatesThroughRest.updates.OpenIncidentsStatusUpdated.openIncidentsStatus.totalEndpoints Number Lumu totalEndpoints
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.companyId String Lumu companyId
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.id String Lumu id
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.timestamp Date Lumu timestamp
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.statusTimestamp Date Lumu statusTimestamp
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.status String Lumu status
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.contacts Number Lumu contacts
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.adversaries String Lumu adversaries
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.adversaryId String Lumu adversaryId
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.adversaryTypes String Lumu adversaryTypes
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.description String Lumu description
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.labelDistribution Number Lumu labelDistribution
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.totalEndpoints Number Lumu totalEndpoints
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.lastContact Date Lumu lastContact
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.unread Boolean Lumu unread
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.hasPlaybackContacts Boolean Lumu hasPlaybackContacts
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.incident.firstContact Date Lumu firstContact
Lumu.ConsultIncidentsUpdatesThroughRest.updates.IncidentUnmuted.comment String Lumu comment
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.companyId String Lumu companyId
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.id String Lumu id
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.timestamp Date Lumu timestamp
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.statusTimestamp Date Lumu statusTimestamp
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.status String Lumu status
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.contacts Number Lumu contacts
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.adversaries String Lumu adversaries
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.adversaryId String Lumu adversaryId
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.adversaryTypes String Lumu adversaryTypes
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.description String Lumu description
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.labelDistribution Number Lumu labelDistribution
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.totalEndpoints Number Lumu totalEndpoints
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.lastContact Date Lumu lastContact
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.unread Boolean Lumu unread
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.hasPlaybackContacts Boolean Lumu hasPlaybackContacts
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.incident.firstContact Date Lumu firstContact
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.openIncidentsStats.openIncidents Number Lumu openIncidents
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.openIncidentsStats.totalContacts Number Lumu totalContacts
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.openIncidentsStats.typeDistribution.DGA Number Lumu DGA
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.openIncidentsStats.typeDistribution.C2C Number Lumu C2C
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.openIncidentsStats.typeDistribution.Network Scan Number Lumu Network Scan
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.openIncidentsStats.typeDistribution.Mining Number Lumu Mining
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.openIncidentsStats.typeDistribution.Phishing Number Lumu Phishing
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.openIncidentsStats.typeDistribution.Spam Number Lumu Spam
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.openIncidentsStats.typeDistribution.Malware Number Lumu Malware
Lumu.ConsultIncidentsUpdatesThroughRest.updates.NewIncidentCreated.openIncidentsStats.totalEndpoints Number Lumu totalEndpoints
Lumu.ConsultIncidentsUpdatesThroughRest.offset Number Lumu next offset

Command example

!lumu-consult-incidents-updates-through-rest items=4 offset=1096305 time=4

Context Example

{
    "Lumu": {
        "ConsultIncidentsUpdatesThroughRest": {
            "offset": 1096578,
            "updates": [
                {
                    "IncidentUpdated": {
                        "companyId": "10228d9c-ff18-4251-ac19-514185e00f17",
                        "contactSummary": {
                            "adversaryHost": "activity.lumu.io",
                            "endpointIp": "192.168.0.13",
                            "endpointName": "Loacal-nesfpdm",
                            "fromPlayback": false,
                            "timestamp": "2022-12-20T14:37:02.228Z",
                            "uuid": "c45b8540-8073-11ed-b5ad-23f20297b7bb"
                        },
                        "incident": {
                            "adversaries": [
                                "activity.lumu.io"
                            ],
                            "adversaryId": "activity.lumu.io",
                            "adversaryTypes": [
                                "Spam"
                            ],
                            "contacts": 15,
                            "description": "Activity Test Query",
                            "firstContact": "2023-02-01T15:13:41.904Z",
                            "hasPlaybackContacts": false,
                            "id": "182f3950-a243-11ed-a0c7-dd6f8e69d343",
                            "labelDistribution": {
                                "0": 2,
                                "1792": 1,
                                "989": 12
                            },
                            "lastContact": "2023-02-03T16:44:00.395Z",
                            "status": "open",
                            "statusTimestamp": "2023-02-01T15:14:17.061Z",
                            "timestamp": "2023-02-01T15:14:17.061Z",
                            "totalEndpoints": 5,
                            "unread": false
                        },
                        "openIncidentsStats": {
                            "labelDistribution": {
                                "0": 35,
                                "1179": 2,
                                "147": 27,
                                "1580": 147,
                                "1651": 14,
                                "1791": 81,
                                "1792": 2,
                                "1885": 3,
                                "2144": 29,
                                "2148": 247,
                                "218": 4,
                                "2254": 89,
                                "2267": 11,
                                "2280": 28,
                                "2692": 1,
                                "2821": 1,
                                "2974": 20,
                                "3005": 1,
                                "3077": 30,
                                "3179": 1,
                                "3182": 4,
                                "3628": 1,
                                "3635": 2,
                                "3771": 1,
                                "3774": 1,
                                "3811": 7,
                                "4055": 134,
                                "4061": 10,
                                "4232": 2,
                                "4301": 393,
                                "548": 25,
                                "805": 9,
                                "864": 3,
                                "989": 72
                            },
                            "openIncidents": 1124,
                            "totalContacts": 10311,
                            "totalEndpoints": 209,
                            "typeDistribution": {
                                "C2C": 106,
                                "DGA": 10,
                                "Inappropriate content": 1,
                                "Malware": 666,
                                "Mining": 274,
                                "Network Scan": 6,
                                "Phishing": 31,
                                "Spam": 265
                            }
                        }
                    }
                },
                {
                    "IncidentUpdated": {
                        "companyId": "10228d9c-ff18-4251-ac19-514185e00f17",
                        "contactSummary": {
                            "adversaryHost": "activity.lumu.io",
                            "endpointIp": "192.168.0.13",
                            "endpointName": "Loacal-nesfpdm",
                            "fromPlayback": false,
                            "timestamp": "2022-12-20T14:37:02.228Z",
                            "uuid": "c45b8540-8073-11ed-ab18-23f2022bdf77"
                        },
                        "incident": {
                            "adversaries": [
                                "activity.lumu.io"
                            ],
                            "adversaryId": "activity.lumu.io",
                            "adversaryTypes": [
                                "Spam"
                            ],
                            "contacts": 16,
                            "description": "Activity Test Query",
                            "firstContact": "2023-02-01T15:13:41.904Z",
                            "hasPlaybackContacts": false,
                            "id": "182f3950-a243-11ed-a0c7-dd6f8e69d343",
                            "labelDistribution": {
                                "0": 3,
                                "1792": 1,
                                "989": 12
                            },
                            "lastContact": "2023-02-03T16:44:00.395Z",
                            "status": "open",
                            "statusTimestamp": "2023-02-01T15:14:17.061Z",
                            "timestamp": "2023-02-01T15:14:17.061Z",
                            "totalEndpoints": 5,
                            "unread": false
                        },
                        "openIncidentsStats": {
                            "labelDistribution": {
                                "0": 35,
                                "1179": 2,
                                "147": 27,
                                "1580": 147,
                                "1651": 14,
                                "1791": 81,
                                "1792": 2,
                                "1885": 3,
                                "2144": 29,
                                "2148": 247,
                                "218": 4,
                                "2254": 89,
                                "2267": 11,
                                "2280": 28,
                                "2692": 1,
                                "2821": 1,
                                "2974": 20,
                                "3005": 1,
                                "3077": 30,
                                "3179": 1,
                                "3182": 4,
                                "3628": 1,
                                "3635": 2,
                                "3771": 1,
                                "3774": 1,
                                "3811": 7,
                                "4055": 134,
                                "4061": 10,
                                "4232": 2,
                                "4301": 393,
                                "548": 25,
                                "805": 9,
                                "864": 3,
                                "989": 72
                            },
                            "openIncidents": 1124,
                            "totalContacts": 10312,
                            "totalEndpoints": 209,
                            "typeDistribution": {
                                "C2C": 106,
                                "DGA": 10,
                                "Inappropriate content": 1,
                                "Malware": 666,
                                "Mining": 274,
                                "Network Scan": 6,
                                "Phishing": 31,
                                "Spam": 265
                            }
                        }
                    }
                },
                {
                    "IncidentUpdated": {
                        "companyId": "10228d9c-ff18-4251-ac19-514185e00f17",
                        "contactSummary": {
                            "adversaryHost": "activity.lumu.io",
                            "endpointIp": "192.168.0.13",
                            "endpointName": "Loacal-nesfpdm",
                            "fromPlayback": false,
                            "timestamp": "2022-12-20T14:37:02.228Z",
                            "uuid": "c45b8540-8073-11ed-a675-23f2020a8d4c"
                        },
                        "incident": {
                            "adversaries": [
                                "activity.lumu.io"
                            ],
                            "adversaryId": "activity.lumu.io",
                            "adversaryTypes": [
                                "Spam"
                            ],
                            "contacts": 17,
                            "description": "Activity Test Query",
                            "firstContact": "2023-02-01T15:13:41.904Z",
                            "hasPlaybackContacts": false,
                            "id": "182f3950-a243-11ed-a0c7-dd6f8e69d343",
                            "labelDistribution": {
                                "0": 4,
                                "1792": 1,
                                "989": 12
                            },
                            "lastContact": "2023-02-03T16:44:00.395Z",
                            "status": "open",
                            "statusTimestamp": "2023-02-01T15:14:17.061Z",
                            "timestamp": "2023-02-01T15:14:17.061Z",
                            "totalEndpoints": 5,
                            "unread": false
                        },
                        "openIncidentsStats": {
                            "labelDistribution": {
                                "0": 35,
                                "1179": 2,
                                "147": 27,
                                "1580": 147,
                                "1651": 14,
                                "1791": 81,
                                "1792": 2,
                                "1885": 3,
                                "2144": 29,
                                "2148": 247,
                                "218": 4,
                                "2254": 89,
                                "2267": 11,
                                "2280": 28,
                                "2692": 1,
                                "2821": 1,
                                "2974": 20,
                                "3005": 1,
                                "3077": 30,
                                "3179": 1,
                                "3182": 4,
                                "3628": 1,
                                "3635": 2,
                                "3771": 1,
                                "3774": 1,
                                "3811": 7,
                                "4055": 134,
                                "4061": 10,
                                "4232": 2,
                                "4301": 393,
                                "548": 25,
                                "805": 9,
                                "864": 3,
                                "989": 72
                            },
                            "openIncidents": 1124,
                            "totalContacts": 10313,
                            "totalEndpoints": 209,
                            "typeDistribution": {
                                "C2C": 106,
                                "DGA": 10,
                                "Inappropriate content": 1,
                                "Malware": 666,
                                "Mining": 274,
                                "Network Scan": 6,
                                "Phishing": 31,
                                "Spam": 265
                            }
                        }
                    }
                },
                {
                    "IncidentUpdated": {
                        "companyId": "10228d9c-ff18-4251-ac19-514185e00f17",
                        "contactSummary": {
                            "adversaryHost": "activity.lumu.io",
                            "endpointIp": "192.168.0.13",
                            "endpointName": "Loacal-nesfpdm",
                            "fromPlayback": false,
                            "timestamp": "2022-12-20T14:37:02.228Z",
                            "uuid": "c45b8540-8073-11ed-ba29-23f202e1cb1a"
                        },
                        "incident": {
                            "adversaries": [
                                "activity.lumu.io"
                            ],
                            "adversaryId": "activity.lumu.io",
                            "adversaryTypes": [
                                "Spam"
                            ],
                            "contacts": 18,
                            "description": "Activity Test Query",
                            "firstContact": "2023-02-01T15:13:41.904Z",
                            "hasPlaybackContacts": false,
                            "id": "182f3950-a243-11ed-a0c7-dd6f8e69d343",
                            "labelDistribution": {
                                "0": 5,
                                "1792": 1,
                                "989": 12
                            },
                            "lastContact": "2023-02-03T16:44:00.395Z",
                            "status": "open",
                            "statusTimestamp": "2023-02-01T15:14:17.061Z",
                            "timestamp": "2023-02-01T15:14:17.061Z",
                            "totalEndpoints": 5,
                            "unread": false
                        },
                        "openIncidentsStats": {
                            "labelDistribution": {
                                "0": 35,
                                "1179": 2,
                                "147": 27,
                                "1580": 147,
                                "1651": 14,
                                "1791": 81,
                                "1792": 2,
                                "1885": 3,
                                "2144": 29,
                                "2148": 247,
                                "218": 4,
                                "2254": 89,
                                "2267": 11,
                                "2280": 28,
                                "2692": 1,
                                "2821": 1,
                                "2974": 20,
                                "3005": 1,
                                "3077": 30,
                                "3179": 1,
                                "3182": 4,
                                "3628": 1,
                                "3635": 2,
                                "3771": 1,
                                "3774": 1,
                                "3811": 7,
                                "4055": 134,
                                "4061": 10,
                                "4232": 2,
                                "4301": 393,
                                "548": 25,
                                "805": 9,
                                "864": 3,
                                "989": 72
                            },
                            "openIncidents": 1124,
                            "totalContacts": 10314,
                            "totalEndpoints": 209,
                            "typeDistribution": {
                                "C2C": 106,
                                "DGA": 10,
                                "Inappropriate content": 1,
                                "Malware": 666,
                                "Mining": 274,
                                "Network Scan": 6,
                                "Phishing": 31,
                                "Spam": 265
                            }
                        }
                    }
                },
                {
                    "IncidentUpdated": {
                        "companyId": "10228d9c-ff18-4251-ac19-514185e00f17",
                        "contactSummary": {
                            "adversaryHost": "activity.lumu.io",
                            "endpointIp": "192.168.0.13",
                            "endpointName": "Loacal-nesfpdm",
                            "fromPlayback": false,
                            "timestamp": "2022-12-20T14:37:02.228Z",
                            "uuid": "c45b8540-8073-11ed-8392-23f20218d429"
                        },
                        "incident": {
                            "adversaries": [
                                "activity.lumu.io"
                            ],
                            "adversaryId": "activity.lumu.io",
                            "adversaryTypes": [
                                "Spam"
                            ],
                            "contacts": 19,
                            "description": "Activity Test Query",
                            "firstContact": "2023-02-01T15:13:41.904Z",
                            "hasPlaybackContacts": false,
                            "id": "182f3950-a243-11ed-a0c7-dd6f8e69d343",
                            "labelDistribution": {
                                "0": 6,
                                "1792": 1,
                                "989": 12
                            },
                            "lastContact": "2023-02-03T16:44:00.395Z",
                            "status": "open",
                            "statusTimestamp": "2023-02-01T15:14:17.061Z",
                            "timestamp": "2023-02-01T15:14:17.061Z",
                            "totalEndpoints": 5,
                            "unread": false
                        },
                        "openIncidentsStats": {
                            "labelDistribution": {
                                "0": 35,
                                "1179": 2,
                                "147": 27,
                                "1580": 147,
                                "1651": 14,
                                "1791": 81,
                                "1792": 2,
                                "1885": 3,
                                "2144": 29,
                                "2148": 247,
                                "218": 4,
                                "2254": 89,
                                "2267": 11,
                                "2280": 28,
                                "2692": 1,
                                "2821": 1,
                                "2974": 20,
                                "3005": 1,
                                "3077": 30,
                                "3179": 1,
                                "3182": 4,
                                "3628": 1,
                                "3635": 2,
                                "3771": 1,
                                "3774": 1,
                                "3811": 7,
                                "4055": 134,
                                "4061": 10,
                                "4232": 2,
                                "4301": 393,
                                "548": 25,
                                "805": 9,
                                "864": 3,
                                "989": 72
                            },
                            "openIncidents": 1124,
                            "totalContacts": 10315,
                            "totalEndpoints": 209,
                            "typeDistribution": {
                                "C2C": 106,
                                "DGA": 10,
                                "Inappropriate content": 1,
                                "Malware": 666,
                                "Mining": 274,
                                "Network Scan": 6,
                                "Phishing": 31,
                                "Spam": 265
                            }
                        }
                    }
                },
                {
                    "IncidentUpdated": {
                        "companyId": "10228d9c-ff18-4251-ac19-514185e00f17",
                        "contactSummary": {
                            "adversaryHost": "activity.lumu.io",
                            "endpointIp": "192.168.0.13",
                            "endpointName": "Loacal-nesfpdm",
                            "fromPlayback": false,
                            "timestamp": "2022-12-20T14:37:02.228Z",
                            "uuid": "c45b8540-8073-11ed-abb1-23f202b7a63d"
                        },
                        "incident": {
                            "adversaries": [
                                "activity.lumu.io"
                            ],
                            "adversaryId": "activity.lumu.io",
                            "adversaryTypes": [
                                "Spam"
                            ],
                            "contacts": 20,
                            "description": "Activity Test Query",
                            "firstContact": "2023-02-01T15:13:41.904Z",
                            "hasPlaybackContacts": false,
                            "id": "182f3950-a243-11ed-a0c7-dd6f8e69d343",
                            "labelDistribution": {
                                "0": 7,
                                "1792": 1,
                                "989": 12
                            },
                            "lastContact": "2023-02-03T16:44:00.395Z",
                            "status": "open",
                            "statusTimestamp": "2023-02-01T15:14:17.061Z",
                            "timestamp": "2023-02-01T15:14:17.061Z",
                            "totalEndpoints": 5,
                            "unread": false
                        },
                        "openIncidentsStats": {
                            "labelDistribution": {
                                "0": 35,
                                "1179": 2,
                                "147": 27,
                                "1580": 147,
                                "1651": 14,
                                "1791": 81,
                                "1792": 2,
                                "1885": 3,
                                "2144": 29,
                                "2148": 247,
                                "218": 4,
                                "2254": 89,
                                "2267": 11,
                                "2280": 28,
                                "2692": 1,
                                "2821": 1,
                                "2974": 20,
                                "3005": 1,
                                "3077": 30,
                                "3179": 1,
                                "3182": 4,
                                "3628": 1,
                                "3635": 2,
                                "3771": 1,
                                "3774": 1,
                                "3811": 7,
                                "4055": 134,
                                "4061": 10,
                                "4232": 2,
                                "4301": 393,
                                "548": 25,
                                "805": 9,
                                "864": 3,
                                "989": 72
                            },
                            "openIncidents": 1124,
                            "totalContacts": 10316,
                            "totalEndpoints": 209,
                            "typeDistribution": {
                                "C2C": 106,
                                "DGA": 10,
                                "Inappropriate content": 1,
                                "Malware": 666,
                                "Mining": 274,
                                "Network Scan": 6,
                                "Phishing": 31,
                                "Spam": 265
                            }
                        }
                    }
                },
                {
                    "IncidentCommentAdded": {
                        "comment": "from XSOAR Cortex 20230206_135000 test comment, hmacsha256:efa407ced8d7cdedef4ed94e3730e3242996bd7ebf394c1e694d0b9a3f1087c6",
                        "companyId": "10228d9c-ff18-4251-ac19-514185e00f17",
                        "incidentId": "182f3950-a243-11ed-a0c7-dd6f8e69d343"
                    }
                },
                {
                    "IncidentCommentAdded": {
                        "comment": "comment 854",
                        "companyId": "10228d9c-ff18-4251-ac19-514185e00f17",
                        "incidentId": "182f3950-a243-11ed-a0c7-dd6f8e69d343"
                    }
                },
                {
                    "IncidentMarkedAsRead": {
                        "companyId": "10228d9c-ff18-4251-ac19-514185e00f17",
                        "incidentId": "790f0700-9ec4-11ed-a0c7-dd6f8e69d343"
                    }
                },
                {
                    "IncidentMuted": {
                        "comment": "test",
                        "companyId": "10228d9c-ff18-4251-ac19-514185e00f17",
                        "incident": {
                            "adversaries": [
                                "obobbo.com"
                            ],
                            "adversaryId": "obobbo.com",
                            "adversaryTypes": [
                                "Spam"
                            ],
                            "contacts": 1,
                            "description": "Disposable email host",
                            "firstContact": "2023-01-28T04:29:57.692Z",
                            "hasPlaybackContacts": false,
                            "id": "790f0700-9ec4-11ed-a0c7-dd6f8e69d343",
                            "labelDistribution": {
                                "4301": 1
                            },
                            "lastContact": "2023-01-28T04:29:57.692Z",
                            "status": "muted",
                            "statusTimestamp": "2023-02-06T15:01:54.199Z",
                            "timestamp": "2023-01-28T04:30:20.016Z",
                            "totalEndpoints": 1,
                            "unread": false
                        },
                        "reason": "irrelevant"
                    }
                }
            ]
        }
    }
}

Human Readable Output

Results

offset updates
1096578 {‘IncidentUpdated’: {‘companyId’: ‘10228d9c-ff18-4251-ac19-514185e00f17’, ‘incident’: {‘id’: ‘182f3950-a243-11ed-a0c7-dd6f8e69d343’, ‘timestamp’: ‘2023-02-01T15:14:17.061Z’, ‘statusTimestamp’: ‘2023-02-01T15:14:17.061Z’, ‘status’: ‘open’, ‘contacts’: 15, ‘adversaries’: [‘activity.lumu.io’], ‘adversaryId’: ‘activity.lumu.io’, ‘adversaryTypes’: [‘Spam’], ‘description’: ‘Activity Test Query’, ‘labelDistribution’: {‘1792’: 1, ‘989’: 12, ‘0’: 2}, ‘totalEndpoints’: 5, ‘lastContact’: ‘2023-02-03T16:44:00.395Z’, ‘unread’: False, ‘hasPlaybackContacts’: False, ‘firstContact’: ‘2023-02-01T15:13:41.904Z’}, ‘openIncidentsStats’: {‘openIncidents’: 1124, ‘totalContacts’: 10311, ‘typeDistribution’: {‘DGA’: 10, ‘C2C’: 106, ‘Network Scan’: 6, ‘Mining’: 274, ‘Inappropriate content’: 1, ‘Phishing’: 31, ‘Spam’: 265, ‘Malware’: 666}, ‘labelDistribution’: {‘1792’: 2, ‘147’: 27, ‘3771’: 1, ‘2254’: 89, ‘4061’: 10, ‘3774’: 1, ‘3077’: 30, ‘2280’: 28, ‘3182’: 4, ‘1885’: 3, ‘2267’: 11, ‘805’: 9, ‘1791’: 81, ‘2148’: 247, ‘548’: 25, ‘3635’: 2, ‘989’: 72, ‘3179’: 1, ‘3005’: 1, ‘4055’: 134, ‘4301’: 393, ‘1179’: 2, ‘864’: 3, ‘2144’: 29, ‘1580’: 147, ‘3811’: 7, ‘4232’: 2, ‘0’: 35, ‘2974’: 20, ‘3628’: 1, ‘218’: 4, ‘2692’: 1, ‘1651’: 14, ‘2821’: 1}, ‘totalEndpoints’: 209}, ‘contactSummary’: {‘uuid’: ‘c45b8540-8073-11ed-b5ad-23f20297b7bb’, ‘timestamp’: ‘2022-12-20T14:37:02.228Z’, ‘adversaryHost’: ‘activity.lumu.io’, ‘endpointIp’: ‘192.168.0.13’, ‘endpointName’: ‘Loacal-nesfpdm’, ‘fromPlayback’: False}}},
{‘IncidentUpdated’: {‘companyId’: ‘10228d9c-ff18-4251-ac19-514185e00f17’, ‘incident’: {‘id’: ‘182f3950-a243-11ed-a0c7-dd6f8e69d343’, ‘timestamp’: ‘2023-02-01T15:14:17.061Z’, ‘statusTimestamp’: ‘2023-02-01T15:14:17.061Z’, ‘status’: ‘open’, ‘contacts’: 16, ‘adversaries’: [‘activity.lumu.io’], ‘adversaryId’: ‘activity.lumu.io’, ‘adversaryTypes’: [‘Spam’], ‘description’: ‘Activity Test Query’, ‘labelDistribution’: {‘1792’: 1, ‘989’: 12, ‘0’: 3}, ‘totalEndpoints’: 5, ‘lastContact’: ‘2023-02-03T16:44:00.395Z’, ‘unread’: False, ‘hasPlaybackContacts’: False, ‘firstContact’: ‘2023-02-01T15:13:41.904Z’}, ‘openIncidentsStats’: {‘openIncidents’: 1124, ‘totalContacts’: 10312, ‘typeDistribution’: {‘DGA’: 10, ‘C2C’: 106, ‘Network Scan’: 6, ‘Mining’: 274, ‘Inappropriate content’: 1, ‘Phishing’: 31, ‘Spam’: 265, ‘Malware’: 666}, ‘labelDistribution’: {‘1792’: 2, ‘147’: 27, ‘3771’: 1, ‘2254’: 89, ‘4061’: 10, ‘3774’: 1, ‘3077’: 30, ‘2280’: 28, ‘3182’: 4, ‘1885’: 3, ‘2267’: 11, ‘805’: 9, ‘1791’: 81, ‘2148’: 247, ‘548’: 25, ‘3635’: 2, ‘989’: 72, ‘3179’: 1, ‘3005’: 1, ‘4055’: 134, ‘4301’: 393, ‘1179’: 2, ‘864’: 3, ‘2144’: 29, ‘1580’: 147, ‘3811’: 7, ‘4232’: 2, ‘0’: 35, ‘2974’: 20, ‘3628’: 1, ‘218’: 4, ‘2692’: 1, ‘1651’: 14, ‘2821’: 1}, ‘totalEndpoints’: 209}, ‘contactSummary’: {‘uuid’: ‘c45b8540-8073-11ed-ab18-23f2022bdf77’, ‘timestamp’: ‘2022-12-20T14:37:02.228Z’, ‘adversaryHost’: ‘activity.lumu.io’, ‘endpointIp’: ‘192.168.0.13’, ‘endpointName’: ‘Loacal-nesfpdm’, ‘fromPlayback’: False}}},
{‘IncidentUpdated’: {‘companyId’: ‘10228d9c-ff18-4251-ac19-514185e00f17’, ‘incident’: {‘id’: ‘182f3950-a243-11ed-a0c7-dd6f8e69d343’, ‘timestamp’: ‘2023-02-01T15:14:17.061Z’, ‘statusTimestamp’: ‘2023-02-01T15:14:17.061Z’, ‘status’: ‘open’, ‘contacts’: 17, ‘adversaries’: [‘activity.lumu.io’], ‘adversaryId’: ‘activity.lumu.io’, ‘adversaryTypes’: [‘Spam’], ‘description’: ‘Activity Test Query’, ‘labelDistribution’: {‘1792’: 1, ‘989’: 12, ‘0’: 4}, ‘totalEndpoints’: 5, ‘lastContact’: ‘2023-02-03T16:44:00.395Z’, ‘unread’: False, ‘hasPlaybackContacts’: False, ‘firstContact’: ‘2023-02-01T15:13:41.904Z’}, ‘openIncidentsStats’: {‘openIncidents’: 1124, ‘totalContacts’: 10313, ‘typeDistribution’: {‘DGA’: 10, ‘C2C’: 106, ‘Network Scan’: 6, ‘Mining’: 274, ‘Inappropriate content’: 1, ‘Phishing’: 31, ‘Spam’: 265, ‘Malware’: 666}, ‘labelDistribution’: {‘1792’: 2, ‘147’: 27, ‘3771’: 1, ‘2254’: 89, ‘4061’: 10, ‘3774’: 1, ‘3077’: 30, ‘2280’: 28, ‘3182’: 4, ‘1885’: 3, ‘2267’: 11, ‘805’: 9, ‘1791’: 81, ‘2148’: 247, ‘548’: 25, ‘3635’: 2, ‘989’: 72, ‘3179’: 1, ‘3005’: 1, ‘4055’: 134, ‘4301’: 393, ‘1179’: 2, ‘864’: 3, ‘2144’: 29, ‘1580’: 147, ‘3811’: 7, ‘4232’: 2, ‘0’: 35, ‘2974’: 20, ‘3628’: 1, ‘218’: 4, ‘2692’: 1, ‘1651’: 14, ‘2821’: 1}, ‘totalEndpoints’: 209}, ‘contactSummary’: {‘uuid’: ‘c45b8540-8073-11ed-a675-23f2020a8d4c’, ‘timestamp’: ‘2022-12-20T14:37:02.228Z’, ‘adversaryHost’: ‘activity.lumu.io’, ‘endpointIp’: ‘192.168.0.13’, ‘endpointName’: ‘Loacal-nesfpdm’, ‘fromPlayback’: False}}},
{‘IncidentUpdated’: {‘companyId’: ‘10228d9c-ff18-4251-ac19-514185e00f17’, ‘incident’: {‘id’: ‘182f3950-a243-11ed-a0c7-dd6f8e69d343’, ‘timestamp’: ‘2023-02-01T15:14:17.061Z’, ‘statusTimestamp’: ‘2023-02-01T15:14:17.061Z’, ‘status’: ‘open’, ‘contacts’: 18, ‘adversaries’: [‘activity.lumu.io’], ‘adversaryId’: ‘activity.lumu.io’, ‘adversaryTypes’: [‘Spam’], ‘description’: ‘Activity Test Query’, ‘labelDistribution’: {‘1792’: 1, ‘989’: 12, ‘0’: 5}, ‘totalEndpoints’: 5, ‘lastContact’: ‘2023-02-03T16:44:00.395Z’, ‘unread’: False, ‘hasPlaybackContacts’: False, ‘firstContact’: ‘2023-02-01T15:13:41.904Z’}, ‘openIncidentsStats’: {‘openIncidents’: 1124, ‘totalContacts’: 10314, ‘typeDistribution’: {‘DGA’: 10, ‘C2C’: 106, ‘Network Scan’: 6, ‘Mining’: 274, ‘Inappropriate content’: 1, ‘Phishing’: 31, ‘Spam’: 265, ‘Malware’: 666}, ‘labelDistribution’: {‘1792’: 2, ‘147’: 27, ‘3771’: 1, ‘2254’: 89, ‘4061’: 10, ‘3774’: 1, ‘3077’: 30, ‘2280’: 28, ‘3182’: 4, ‘1885’: 3, ‘2267’: 11, ‘805’: 9, ‘1791’: 81, ‘2148’: 247, ‘548’: 25, ‘3635’: 2, ‘989’: 72, ‘3179’: 1, ‘3005’: 1, ‘4055’: 134, ‘4301’: 393, ‘1179’: 2, ‘864’: 3, ‘2144’: 29, ‘1580’: 147, ‘3811’: 7, ‘4232’: 2, ‘0’: 35, ‘2974’: 20, ‘3628’: 1, ‘218’: 4, ‘2692’: 1, ‘1651’: 14, ‘2821’: 1}, ‘totalEndpoints’: 209}, ‘contactSummary’: {‘uuid’: ‘c45b8540-8073-11ed-ba29-23f202e1cb1a’, ‘timestamp’: ‘2022-12-20T14:37:02.228Z’, ‘adversaryHost’: ‘activity.lumu.io’, ‘endpointIp’: ‘192.168.0.13’, ‘endpointName’: ‘Loacal-nesfpdm’, ‘fromPlayback’: False}}},
{‘IncidentUpdated’: {‘companyId’: ‘10228d9c-ff18-4251-ac19-514185e00f17’, ‘incident’: {‘id’: ‘182f3950-a243-11ed-a0c7-dd6f8e69d343’, ‘timestamp’: ‘2023-02-01T15:14:17.061Z’, ‘statusTimestamp’: ‘2023-02-01T15:14:17.061Z’, ‘status’: ‘open’, ‘contacts’: 19, ‘adversaries’: [‘activity.lumu.io’], ‘adversaryId’: ‘activity.lumu.io’, ‘adversaryTypes’: [‘Spam’], ‘description’: ‘Activity Test Query’, ‘labelDistribution’: {‘1792’: 1, ‘989’: 12, ‘0’: 6}, ‘totalEndpoints’: 5, ‘lastContact’: ‘2023-02-03T16:44:00.395Z’, ‘unread’: False, ‘hasPlaybackContacts’: False, ‘firstContact’: ‘2023-02-01T15:13:41.904Z’}, ‘openIncidentsStats’: {‘openIncidents’: 1124, ‘totalContacts’: 10315, ‘typeDistribution’: {‘DGA’: 10, ‘C2C’: 106, ‘Network Scan’: 6, ‘Mining’: 274, ‘Inappropriate content’: 1, ‘Phishing’: 31, ‘Spam’: 265, ‘Malware’: 666}, ‘labelDistribution’: {‘1792’: 2, ‘147’: 27, ‘3771’: 1, ‘2254’: 89, ‘4061’: 10, ‘3774’: 1, ‘3077’: 30, ‘2280’: 28, ‘3182’: 4, ‘1885’: 3, ‘2267’: 11, ‘805’: 9, ‘1791’: 81, ‘2148’: 247, ‘548’: 25, ‘3635’: 2, ‘989’: 72, ‘3179’: 1, ‘3005’: 1, ‘4055’: 134, ‘4301’: 393, ‘1179’: 2, ‘864’: 3, ‘2144’: 29, ‘1580’: 147, ‘3811’: 7, ‘4232’: 2, ‘0’: 35, ‘2974’: 20, ‘3628’: 1, ‘218’: 4, ‘2692’: 1, ‘1651’: 14, ‘2821’: 1}, ‘totalEndpoints’: 209}, ‘contactSummary’: {‘uuid’: ‘c45b8540-8073-11ed-8392-23f20218d429’, ‘timestamp’: ‘2022-12-20T14:37:02.228Z’, ‘adversaryHost’: ‘activity.lumu.io’, ‘endpointIp’: ‘192.168.0.13’, ‘endpointName’: ‘Loacal-nesfpdm’, ‘fromPlayback’: False}}},
{‘IncidentUpdated’: {‘companyId’: ‘10228d9c-ff18-4251-ac19-514185e00f17’, ‘incident’: {‘id’: ‘182f3950-a243-11ed-a0c7-dd6f8e69d343’, ‘timestamp’: ‘2023-02-01T15:14:17.061Z’, ‘statusTimestamp’: ‘2023-02-01T15:14:17.061Z’, ‘status’: ‘open’, ‘contacts’: 20, ‘adversaries’: [‘activity.lumu.io’], ‘adversaryId’: ‘activity.lumu.io’, ‘adversaryTypes’: [‘Spam’], ‘description’: ‘Activity Test Query’, ‘labelDistribution’: {‘1792’: 1, ‘989’: 12, ‘0’: 7}, ‘totalEndpoints’: 5, ‘lastContact’: ‘2023-02-03T16:44:00.395Z’, ‘unread’: False, ‘hasPlaybackContacts’: False, ‘firstContact’: ‘2023-02-01T15:13:41.904Z’}, ‘openIncidentsStats’: {‘openIncidents’: 1124, ‘totalContacts’: 10316, ‘typeDistribution’: {‘DGA’: 10, ‘C2C’: 106, ‘Network Scan’: 6, ‘Mining’: 274, ‘Inappropriate content’: 1, ‘Phishing’: 31, ‘Spam’: 265, ‘Malware’: 666}, ‘labelDistribution’: {‘1792’: 2, ‘147’: 27, ‘3771’: 1, ‘2254’: 89, ‘4061’: 10, ‘3774’: 1, ‘3077’: 30, ‘2280’: 28, ‘3182’: 4, ‘1885’: 3, ‘2267’: 11, ‘805’: 9, ‘1791’: 81, ‘2148’: 247, ‘548’: 25, ‘3635’: 2, ‘989’: 72, ‘3179’: 1, ‘3005’: 1, ‘4055’: 134, ‘4301’: 393, ‘1179’: 2, ‘864’: 3, ‘2144’: 29, ‘1580’: 147, ‘3811’: 7, ‘4232’: 2, ‘0’: 35, ‘2974’: 20, ‘3628’: 1, ‘218’: 4, ‘2692’: 1, ‘1651’: 14, ‘2821’: 1}, ‘totalEndpoints’: 209}, ‘contactSummary’: {‘uuid’: ‘c45b8540-8073-11ed-abb1-23f202b7a63d’, ‘timestamp’: ‘2022-12-20T14:37:02.228Z’, ‘adversaryHost’: ‘activity.lumu.io’, ‘endpointIp’: ‘192.168.0.13’, ‘endpointName’: ‘Loacal-nesfpdm’, ‘fromPlayback’: False}}},
{‘IncidentCommentAdded’: {‘companyId’: ‘10228d9c-ff18-4251-ac19-514185e00f17’, ‘incidentId’: ‘182f3950-a243-11ed-a0c7-dd6f8e69d343’, ‘comment’: ‘from XSOAR Cortex 20230206_135000 test comment, hmacsha256:efa407ced8d7cdedef4ed94e3730e3242996bd7ebf394c1e694d0b9a3f1087c6’}},
{‘IncidentCommentAdded’: {‘companyId’: ‘10228d9c-ff18-4251-ac19-514185e00f17’, ‘incidentId’: ‘182f3950-a243-11ed-a0c7-dd6f8e69d343’, ‘comment’: ‘comment 854’}},
{‘IncidentMarkedAsRead’: {‘companyId’: ‘10228d9c-ff18-4251-ac19-514185e00f17’, ‘incidentId’: ‘790f0700-9ec4-11ed-a0c7-dd6f8e69d343’}},
{‘IncidentMuted’: {‘companyId’: ‘10228d9c-ff18-4251-ac19-514185e00f17’, ‘incident’: {‘id’: ‘790f0700-9ec4-11ed-a0c7-dd6f8e69d343’, ‘timestamp’: ‘2023-01-28T04:30:20.016Z’, ‘statusTimestamp’: ‘2023-02-06T15:01:54.199Z’, ‘status’: ‘muted’, ‘contacts’: 1, ‘adversaries’: [‘obobbo.com’], ‘adversaryId’: ‘obobbo.com’, ‘adversaryTypes’: [‘Spam’], ‘description’: ‘Disposable email host’, ‘labelDistribution’: {‘4301’: 1}, ‘totalEndpoints’: 1, ‘lastContact’: ‘2023-01-28T04:29:57.692Z’, ‘unread’: False, ‘hasPlaybackContacts’: False, ‘firstContact’: ‘2023-01-28T04:29:57.692Z’}, ‘comment’: ‘test’, ‘reason’: ‘irrelevant’}}

lumu-close-incident

| {incident-uuid} | uuid of the specific incident |
|—|—|

To associate a specific user to this transaction, include the header Lumu-User-Id with the user id as a value. Read more.

Base Command

lumu-close-incident

Input

Argument Name Description Required
lumu_incident_id Lumu incident id. Required
comment Lumu comment requested. Optional

Context Output

Path Type Description
Lumu.CloseIncident.statusCode unknown Lumu statusCode

Command example

!lumu-close-incident lumu_incident_id=7c40be00-a7cf-11ed-9fd0-e5fb50c818f6 comment="closed from Cortex"

Context Example

{
    "Lumu": {
        "CloseIncident": {
            "response": "",
            "statusCode": 200
        }
    }
}

Human Readable Output

Closed the incident successfully.

get-modified-remote-data

mirror process

Base Command

get-modified-remote-data

Input

Argument Name Description Required
lastUpdate lastUpdate . Optional

Context Output

There is no context output for this command.

get-remote-data

mirror process

Base Command

get-remote-data

Input

Argument Name Description Required
lastUpdate lastUpdate . Required
id id . Required

Context Output

There is no context output for this command.

get-mapping-fields

mirror process

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

lumu-clear-cache

Lumu clear cache, only trigger if it mandatory

Base Command

lumu-clear-cache

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
Lumu.ClearCache string Lumu clear cache

Command example


#### Context Example

```json
{
    "Lumu": {
        "ClearCache": "cache cleared get_integration_context()={'cache': [], 'lumu_incidentsId': []}"
    }
}

Human Readable Output

cache cleared get_integration_context()={‘cache’: [], ‘lumu_incidentsId’: []}

update-remote-system

mirror process

Base Command

update-remote-system

Input

Argument Name Description Required
data data . Required
entries entries . Optional
incident_changed incident_changed . Optional
remote_incident_id remote_incident_id . Optional

Context Output

There is no context output for this command.

lumu-get-cache

Lumu get cache

Base Command

lumu-get-cache

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
Lumu.GetCache.cache string Lumu cache
Lumu.GetCache.lumu_incidentsId string Lumu incident ids processed

Command example


#### Context Example

```json
{
    "Lumu": {
        "GetCache": {
            "cache": [],
            "lumu_incidentsId": [
                "e65b3f60-a99e-11ed-9fd0-e5fb50c818f6",
                "8c5efc90-aca5-11ed-9fd0-e5fb50c818f6",
                "903c5580-abef-11ed-9fd0-e5fb50c818f6",
                "ad2b63c0-ad34-11ed-9fd0-e5fb50c818f6",
                "229d4030-9eba-11ed-a0c7-dd6f8e69d343",
                "50240240-9ec0-11ed-a0c7-dd6f8e69d343",
                "02355f90-9ecd-11ed-a0c7-dd6f8e69d343",
                "099a9e80-2ec0-11ed-9b90-a51546bb08b5",
                "0fe32870-9ec3-11ed-a0c7-dd6f8e69d343",
                "73661810-9ec5-11ed-a0c7-dd6f8e69d343",
                "3e5f6480-9ebd-11ed-a0c7-dd6f8e69d343",
                "89658e80-aa3b-11ed-9fd0-e5fb50c818f6",
                "f2571f00-aa43-11ed-9fd0-e5fb50c818f6",
                "853e3020-aca5-11ed-9fd0-e5fb50c818f6",
                "6522d180-9ec5-11ed-a0c7-dd6f8e69d343",
                "fd6788c0-561b-11ed-987a-cd6f8ff058b8",
                "e6a0cc30-a893-11ed-9fd0-e5fb50c818f6",
                "38183850-8bbb-11ed-b0f8-a7e340234a4e",
                "a82e5550-9ec8-11ed-a0c7-dd6f8e69d343",
                "0d207a50-ac8a-11ed-9fd0-e5fb50c818f6",
                "7c40be00-a7cf-11ed-9fd0-e5fb50c818f6",
                "99b7bf10-ac84-11ed-9fd0-e5fb50c818f6",
                "91aaaf20-ac8a-11ed-9fd0-e5fb50c818f6",
                "726849c0-7a6b-11ed-a600-d53ba4d2bb70",
                "e0b39da0-ac8c-11ed-9fd0-e5fb50c818f6",
                "ec869190-85aa-11ed-a600-d53ba4d2bb70",
                "672a8c90-9ebe-11ed-a0c7-dd6f8e69d343"
            ]
        }
    }
}

Human Readable Output

Cache

Lumu _ Incidents Id
e65b3f60-a99e-11ed-9fd0-e5fb50c818f6,
8c5efc90-aca5-11ed-9fd0-e5fb50c818f6,
903c5580-abef-11ed-9fd0-e5fb50c818f6,
ad2b63c0-ad34-11ed-9fd0-e5fb50c818f6,
229d4030-9eba-11ed-a0c7-dd6f8e69d343,
50240240-9ec0-11ed-a0c7-dd6f8e69d343,
02355f90-9ecd-11ed-a0c7-dd6f8e69d343,
099a9e80-2ec0-11ed-9b90-a51546bb08b5,
0fe32870-9ec3-11ed-a0c7-dd6f8e69d343,
73661810-9ec5-11ed-a0c7-dd6f8e69d343,
3e5f6480-9ebd-11ed-a0c7-dd6f8e69d343,
89658e80-aa3b-11ed-9fd0-e5fb50c818f6,
f2571f00-aa43-11ed-9fd0-e5fb50c818f6,
853e3020-aca5-11ed-9fd0-e5fb50c818f6,
6522d180-9ec5-11ed-a0c7-dd6f8e69d343,
fd6788c0-561b-11ed-987a-cd6f8ff058b8,
e6a0cc30-a893-11ed-9fd0-e5fb50c818f6,
38183850-8bbb-11ed-b0f8-a7e340234a4e,
a82e5550-9ec8-11ed-a0c7-dd6f8e69d343,
0d207a50-ac8a-11ed-9fd0-e5fb50c818f6,
7c40be00-a7cf-11ed-9fd0-e5fb50c818f6,
99b7bf10-ac84-11ed-9fd0-e5fb50c818f6,
91aaaf20-ac8a-11ed-9fd0-e5fb50c818f6,
726849c0-7a6b-11ed-a600-d53ba4d2bb70,
e0b39da0-ac8c-11ed-9fd0-e5fb50c818f6,
ec869190-85aa-11ed-a600-d53ba4d2bb70,
672a8c90-9ebe-11ed-a0c7-dd6f8e69d343

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and Lumu corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

  1. Enable Fetching incidents in your instance configuration.

  2. In the Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:

    Option Description
    None Turns off incident mirroring.
    Incoming Any changes in Lumu events (mirroring incoming fields) will be reflected in Cortex XSOAR incidents.
    Outgoing Any changes in Cortex XSOAR incidents will be reflected in Lumu events (outgoing mirrored fields).
    Incoming And Outgoing Changes in Cortex XSOAR incidents and Lumu events will be reflected in both directions.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and Lumu.

Configuration parameters

  • max_fetch — Maximum number of incidents to fetch every time
  • first_fetch — First fetch time interval
  • url — Server URL (required)
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • api_key — API Key (required)
  • fetch_offset — Incident Offset
  • total_items_per_lumu_fetch — Total Incident per fetching using lumu endpoint
  • max_time_fetching_lumu_incident — Max time in seconds per fetching using lumu endpoint
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • mirror_direction — Incident Mirroring Direction
  • mirror_tags — Mirror tags

Commands (21)

  • get-mapping-fields

    mirror process.

  • get-modified-remote-data

    mirror process.

  • get-remote-data

    mirror process.

  • lumu-clear-cache

    Lumu clear cache, only trigger if it mandatory.

  • lumu-close-incident

    | `{incident-uuid}` | uuid of the specific incident | |---|---| >To associate a specific user to this transaction, include the header `Lumu-User-Id` with the user id as a value. [Read more](#user-identification-considerations).

  • lumu-comment-a-specific-incident

    Get a paginated list of open incidents for the company. The items are listed by the most recent.

  • lumu-consult-incidents-updates-through-rest

    Lumu provides an endpoint to consult real-time updates on incident operations through REST when Websocket is not available. Note: the date format in the updates received from the endpoint is in the UTC time zone and follows standards published in RFC 3339 and ISO 8601 | `{company-key}` | Your company's unique API key available at the [Lumu Portal](#access-and-authentication) | | --- | --- |.

  • lumu-get-cache

    Lumu get cache.

  • lumu-mark-incident-as-read

    This transaction does not require any additional body parameters. | `{incident-uuid}` | uuid of the specific incident | |---|---| >To associate a specific user to this transaction, include the header `Lumu-User-Id` with the user id as a value. [Read more](#user-identification-considerations).

  • lumu-mute-incident

    | `{incident-uuid}` | uuid of the specific incident | |---|---| >To associate a specific user to this transaction, include the header `Lumu-User-Id` with the user id as a value. [Read more](#user-identification-considerations).

  • lumu-retrieve-a-specific-incident-context

    Get details of a specific Incident. | `{incident-uuid}` | uuid of the specific incident | |---|---|.

  • lumu-retrieve-a-specific-incident-details

    Get details of a specific Incident. | `{incident-uuid}` | uuid of the specific incident | |---|---|.

  • lumu-retrieve-a-specific-label

    Get details such as id, name and business relevance from a specific label. | `{label-id}` | ID of the specific label | |---|---|.

  • lumu-retrieve-closed-incidents

    Get a paginated list of closed incidents for the company. The items are listed by the most recent.

  • lumu-retrieve-endpoints-by-incident

    Get a paginated summary of the endpoints affected by a specified incident. | `{incident-uuid}` | uuid of the specific incident | |---|---|.

  • lumu-retrieve-incidents

    Get a paginated list of incidents for the company. The items are listed by the most recent.

  • lumu-retrieve-labels

    Get a paginated list of all the labels created for the company and its details such as id, name and business relevance. The items are sorted by the label id in ascending order.

  • lumu-retrieve-muted-incidents

    Get a paginated list of muted incidents for the company. The items are listed by the most recent.

  • lumu-retrieve-open-incidents

    Get a paginated list of open incidents for the company. The items are listed by the most recent.

  • lumu-unmute-incident

    | `{incident-uuid}` | uuid of the specific incident | |---|---| >To associate a specific user to this transaction, include the header `Lumu-User-Id` with the user id as a value. [Read more](#user-identification-considerations).

  • update-remote-system

    mirror process.

Source

Lumu.py Lumu_test.py Lumu.yml Lumu_description.md command_examples.txt
Download History Raw 
import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

""" IMPORTS """


import hashlib
import urllib3
import hmac
from collections import Counter

""" CONSTANTS """

params = demisto.params()
DATE_FORMAT = "%Y-%m-%dT%H:%M:%S.000Z"
MIRROR_DIRECTION = {
    "Incoming": "In",
    "Outgoing": "Out",
    "Incoming And Outgoing": "Both",
}.get(params.get("mirror_direction"))
MIRROR_TAGS = params.get("mirror_tags") or []
INTEGRATION_INSTANCE = demisto.integrationInstance()
FIELDS_TO_REMOVE_FROM_MIROR_IN = ["url", "id", "created_at"]

status_msg_types = [
    "IncidentMuted",
    "IncidentUnmuted",
    "IncidentClosed",
    "IncidentCommentAdded",
]

""" CLIENT CLASS """


class Client(BaseClient):
    def __init__(self, server_url, verify, proxy, headers):
        super().__init__(base_url=server_url, verify=verify, proxy=proxy, headers=headers, auth=None)
        self.api_key = None

    def retrieve_labels_request(self, page, items):
        params = assign_params(page=page, items=items, key=self.api_key)

        response = self._http_request("GET", "api/administration/labels", params=params)

        return response

    def retrieve_a_specific_label_request(self, label_id):
        params = assign_params(key=self.api_key)

        response = self._http_request("GET", f"api/administration/labels/{label_id}", params=params)

        return response

    def retrieve_incidents_request(self, page, items, fromdate, todate, status, adversary_types, labels):
        params = assign_params(page=page, items=items, key=self.api_key)
        data = {
            "adversary-types": adversary_types,
            "fromDate": fromdate,
            "labels": labels,
            "status": status,
            "toDate": todate,
        }

        response = self._http_request("POST", "api/incidents/all", params=params, json_data=data)

        return response

    def retrieve_a_specific_incident_details_request(self, lumu_incident_id):
        params = assign_params(key=self.api_key)

        response = self._http_request("GET", f"api/incidents/{lumu_incident_id}/details", params=params)

        return response

    def retrieve_a_specific_incident_context_request(self, lumu_incident_id, hash):
        params = assign_params(hash=hash, key=self.api_key)

        response = self._http_request("GET", f"api/incidents/{lumu_incident_id}/context", params=params)

        return response

    def comment_a_specific_incident_request(self, lumu_incident_id, comment):
        params = assign_params(key=self.api_key)
        data = {"comment": comment}

        response = self._http_request(
            "POST", f"api/incidents/{lumu_incident_id}/comment", params=params, json_data=data, resp_type="text"
        )

        return response

    def retrieve_open_incidents_request(self, page, items, adversary_types, labels):
        params = assign_params(page=page, items=items, key=self.api_key)
        data = {"adversary-types": adversary_types, "labels": labels}

        response = self._http_request("POST", "api/incidents/open", params=params, json_data=data)

        return response

    def retrieve_muted_incidents_request(self, page, items, adversary_types, labels):
        params = assign_params(page=page, items=items, key=self.api_key)
        data = {"adversary-types": adversary_types, "labels": labels}

        response = self._http_request(
            "POST",
            "api/incidents/muted",
            params=params,
            json_data=data,
        )

        return response

    def retrieve_closed_incidents_request(self, page, items, adversary_types, labels):
        params = assign_params(page=page, items=items, key=self.api_key)
        data = {"adversary-types": adversary_types, "labels": labels}

        response = self._http_request("POST", "api/incidents/closed", params=params, json_data=data)

        return response

    def retrieve_endpoints_by_incident_request(self, lumu_incident_id, page, items):
        params = assign_params(page=page, items=items, key=self.api_key)

        response = self._http_request("POST", f"api/incidents/{lumu_incident_id}/endpoints-contacts", params=params)

        return response

    def mark_incident_as_read_request(self, lumu_incident_id):
        params = assign_params(key=self.api_key)

        response = self._http_request("POST", f"api/incidents/{lumu_incident_id}/mark-as-read", params=params, resp_type="text")

        return response

    def mute_incident_request(self, lumu_incident_id, comment):
        params = assign_params(key=self.api_key)
        data = {"comment": comment}

        response = self._http_request(
            "POST", f"api/incidents/{lumu_incident_id}/mute", params=params, json_data=data, resp_type="text"
        )

        return response

    def unmute_incident_request(self, lumu_incident_id, comment):
        params = assign_params(key=self.api_key)
        data = {"comment": comment}

        response = self._http_request(
            "POST", f"api/incidents/{lumu_incident_id}/unmute", params=params, json_data=data, resp_type="text"
        )

        return response

    def consult_incidents_updates_through_rest_request(self, offset, items, time):
        params = assign_params(offset=offset, items=items, time=time, key=self.api_key)

        response = self._http_request("GET", "api/incidents/open-incidents/updates", params=params)

        return response

    def close_incident_request(self, lumu_incident_id, comment):
        params = assign_params(key=self.api_key)
        data = {"comment": comment}

        response = self._http_request(
            "POST", f"api/incidents/{lumu_incident_id}/close", params=params, json_data=data, resp_type="text"
        )

        return response


""" HELPER FUNCTIONS """


def get_hmac_sha256(key: Optional[str], comment: str):
    if key is None:
        key = ""
    return hmac.new(key.encode(), comment.encode(), hashlib.sha256).hexdigest()


def generate_hmac_sha256_msg(key: Optional[str], comment: str):
    hmac_code = get_hmac_sha256(key, comment)
    return f"{comment} hmacsha256:{hmac_code}"


def validate_hmac_sha256(key: str, comment_w_hmac: str, separator="hmacsha256:"):
    """

    :param key:
    :param comment_w_hmac: Resolved, from: ServiceNow Thu Nov 10 2022 07:56:13 GMT-0800 (PST),
    close_code: Solution provided, close_notes: ddddddddddddd hmacsha256:
    a9d7947047c371a10a44d07b381152951c46b0c954f8ddf1eeefc29fd120b8ae
    :param separator:
    :return:
    """
    result = [piece.strip() for piece in comment_w_hmac.split(separator)]
    if len(result) != 2:
        return False
    comment, hash_mac = result
    return get_hmac_sha256(key, comment) == hash_mac


def is_msg_from_third_party(key, comment):
    return comment and validate_hmac_sha256(key=key, comment_w_hmac=comment)


def add_prefix_to_comment(commnet: Optional[str]) -> str:
    return f"from XSOAR Cortex {datetime.today():%Y%m%d_%H%M%S} {commnet},"


""" COMMAND FUNCTIONS """


def retrieve_labels_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    page = args.get("page")
    items = args.get("limit")

    response = client.retrieve_labels_request(page, items)
    command_results = CommandResults(
        outputs_prefix="Lumu.RetrieveLabels",
        outputs_key_field="id",
        outputs=response,
        raw_response=response,
        readable_output=tableToMarkdown("Labels", response.get("labels", []), headerTransform=pascalToSpace, removeNull=True)
        + "\n"
        + tableToMarkdown("paginationInfo", response.get("paginationInfo", []), headerTransform=pascalToSpace, removeNull=True),
    )

    return command_results


def retrieve_a_specific_label_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    label_id = args.get("label_id")

    response = client.retrieve_a_specific_label_request(label_id)

    command_results = CommandResults(
        outputs_prefix="Lumu.RetrieveASpecificLabel",
        outputs_key_field="id",
        outputs=response,
        raw_response=response,
        readable_output=tableToMarkdown("Label", response, headerTransform=pascalToSpace, removeNull=True),
    )

    return command_results


def retrieve_incidents_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    page = args.get("page")
    items = args.get("limit")
    fromdate = args.get("fromdate")
    todate = args.get("todate")
    status = args.get("status")
    adversary_types = args.get("adversary_types")
    labels = args.get("labels")

    status = argToList(status)
    adversary_types = argToList(adversary_types)
    labels = argToList(labels)
    labels = [int(label) for label in labels]

    response = client.retrieve_incidents_request(page, items, fromdate, todate, status, adversary_types, labels)
    command_results = CommandResults(
        outputs_prefix="Lumu.RetrieveIncidents",
        outputs_key_field="id",
        outputs=response.get("items"),
        raw_response=response,
        readable_output=tableToMarkdown("Incidents", response.get("items", []), headerTransform=pascalToSpace, removeNull=True)
        + "\n"
        + tableToMarkdown("paginationInfo", response.get("paginationInfo", []), headerTransform=pascalToSpace, removeNull=True),
    )
    return command_results


def retrieve_a_specific_incident_details_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    lumu_incident_id = args.get("lumu_incident_id")

    response = client.retrieve_a_specific_incident_details_request(lumu_incident_id)
    human_response = response.copy()
    actions = human_response.pop("actions", [])
    command_results = CommandResults(
        outputs_prefix="Lumu.RetrieveASpecificIncidentDetails",
        outputs_key_field="id",
        outputs=response,
        raw_response=response,
        readable_output=tableToMarkdown("Incident", human_response, headerTransform=pascalToSpace, removeNull=True)
        + "\n"
        + tableToMarkdown("Actions", actions, headerTransform=pascalToSpace, removeNull=True),
    )

    return command_results


def retrieve_a_specific_incident_context_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    lumu_incident_id = args.get("lumu_incident_id")
    hash = args.get("hash")

    response = client.retrieve_a_specific_incident_context_request(lumu_incident_id, hash)
    command_results = CommandResults(
        outputs_prefix="Lumu.RetrieveASpecificIncidentContext",
        outputs_key_field="adversary_id",
        outputs=response,
        raw_response=response,
        readable_output=tableToMarkdown("Incident", response, headerTransform=pascalToSpace, removeNull=True),
    )

    return command_results


def comment_a_specific_incident_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    lumu_incident_id = args.get("lumu_incident_id")
    comment = generate_hmac_sha256_msg(client.api_key, add_prefix_to_comment(args.get("comment")))

    response = client.comment_a_specific_incident_request(lumu_incident_id, comment)
    response = {"statusCode": 200, "response": response}

    command_results = CommandResults(
        outputs_prefix="Lumu.CommentASpecificIncident",
        outputs=response,
        raw_response=response,
        readable_output="Comment added to the incident successfully.",
    )

    return command_results


def retrieve_open_incidents_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    page = args.get("page")
    items = args.get("limit")
    adversary_types = args.get("adversary_types")
    labels = args.get("labels")

    adversary_types = argToList(adversary_types)
    labels = argToList(labels)
    labels = [int(label) for label in labels]

    response = client.retrieve_open_incidents_request(page, items, adversary_types, labels)
    command_results = CommandResults(
        outputs_prefix="Lumu.RetrieveOpenIncidents",
        outputs_key_field="id",
        outputs=response.get("items"),
        raw_response=response,
        readable_output=tableToMarkdown("Incidents", response.get("items", []), headerTransform=pascalToSpace, removeNull=True)
        + "\n"
        + tableToMarkdown("paginationInfo", response.get("paginationInfo", []), headerTransform=pascalToSpace, removeNull=True),
    )

    return command_results


def retrieve_muted_incidents_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    page = args.get("page")
    items = args.get("limit")
    adversary_types = args.get("adversary_types")
    labels = args.get("labels")

    adversary_types = argToList(adversary_types)
    labels = argToList(labels)
    labels = [int(label) for label in labels]

    response = client.retrieve_muted_incidents_request(page, items, adversary_types, labels)
    command_results = CommandResults(
        outputs_prefix="Lumu.RetrieveMutedIncidents",
        outputs_key_field="id",
        outputs=response.get("items"),
        raw_response=response,
        readable_output=tableToMarkdown("Incidents", response.get("items", []), headerTransform=pascalToSpace, removeNull=True)
        + "\n"
        + tableToMarkdown("paginationInfo", response.get("paginationInfo", []), headerTransform=pascalToSpace, removeNull=True),
    )

    return command_results


def retrieve_closed_incidents_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    page = args.get("page")
    items = args.get("limit")
    adversary_types = args.get("adversary_types")
    labels = args.get("labels")

    adversary_types = argToList(adversary_types)
    labels = argToList(labels)
    labels = [int(label) for label in labels]

    response = client.retrieve_closed_incidents_request(page, items, adversary_types, labels)
    command_results = CommandResults(
        outputs_prefix="Lumu.RetrieveClosedIncidents",
        outputs_key_field="id",
        outputs=response.get("items"),
        raw_response=response,
        readable_output=tableToMarkdown("Incidents", response.get("items", []), headerTransform=pascalToSpace, removeNull=True)
        + "\n"
        + tableToMarkdown("paginationInfo", response.get("paginationInfo", []), headerTransform=pascalToSpace, removeNull=True),
    )

    return command_results


def retrieve_endpoints_by_incident_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    lumu_incident_id = args.get("lumu_incident_id")
    page = args.get("page")
    items = args.get("limit")

    response = client.retrieve_endpoints_by_incident_request(lumu_incident_id, page, items)
    command_results = CommandResults(
        outputs_prefix="Lumu.RetrieveEndpointsByIncident",
        outputs_key_field="label",
        outputs=response.get("items"),
        raw_response=response,
        readable_output=tableToMarkdown(
            "Incident endpoints", response.get("items", []), headerTransform=pascalToSpace, removeNull=True
        )
        + "\n"
        + tableToMarkdown("paginationInfo", response.get("paginationInfo", []), headerTransform=pascalToSpace, removeNull=True),
    )

    return command_results


def mark_incident_as_read_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    lumu_incident_id = args.get("lumu_incident_id")
    try:
        response = client.mark_incident_as_read_request(lumu_incident_id)
    except DemistoException as err:
        error_msg = "Failed to parse json object from response: b''"
        if str(err) == error_msg:
            response = {"statusCode": 200}
        else:
            raise DemistoException(err)
    command_results = CommandResults(
        outputs_prefix="Lumu.MarkIncidentAsRead",
        outputs=response,
        raw_response=response,
        readable_output="Marked as read the incident successfully.",
    )

    return command_results


def mute_incident_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    lumu_incident_id = args.get("lumu_incident_id")
    comment = generate_hmac_sha256_msg(client.api_key, add_prefix_to_comment(args.get("comment")))
    response = client.mute_incident_request(lumu_incident_id, comment)
    response = {"statusCode": 200, "response": response}

    command_results = CommandResults(
        outputs_prefix="Lumu.MuteIncident",
        outputs=response,
        raw_response=response,
        readable_output="Muted the incident successfully.",
    )

    return command_results


def unmute_incident_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    lumu_incident_id = args.get("lumu_incident_id")
    comment = generate_hmac_sha256_msg(client.api_key, add_prefix_to_comment(args.get("comment")))
    response = client.unmute_incident_request(lumu_incident_id, comment)
    response = {"statusCode": 200, "response": response}

    command_results = CommandResults(
        outputs_prefix="Lumu.UnmuteIncident",
        outputs=response,
        raw_response=response,
        readable_output="Unmute the incident successfully.",
    )

    return command_results


def close_incident_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    lumu_incident_id = args.get("lumu_incident_id")
    comment = generate_hmac_sha256_msg(client.api_key, add_prefix_to_comment(args.get("comment")))
    response = client.close_incident_request(lumu_incident_id, comment)
    response = {"statusCode": 200, "response": response}

    command_results = CommandResults(
        outputs_prefix="Lumu.CloseIncident",
        outputs=response,
        raw_response=response,
        readable_output="Closed the incident successfully.",
    )

    return command_results


def consult_incidents_updates_through_rest_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    offset = args.get("offset")
    items = args.get("limit")
    time = args.get("time")

    response = client.consult_incidents_updates_through_rest_request(offset, items, time)
    command_results = CommandResults(
        outputs_prefix="Lumu.ConsultIncidentsUpdatesThroughRest",
        outputs=response,
        raw_response=response,
    )

    return command_results


def fetch_incidents(client: Client, first_fetch_time, last_run, items, time):
    last_fetch = last_run.get("last_fetch", None)
    last_fetch = int(last_fetch or first_fetch_time)

    response = client.consult_incidents_updates_through_rest_request(last_fetch, items, time)

    events = response["updates"]
    next_start_time = str(response["offset"])
    incidents = []
    incidents_id = []
    today = datetime.now().strftime(DATE_FORMAT)

    for event in events:
        if "OpenIncidentsStatusUpdated" in event:
            continue
        lumu_event_type_name = list(event.keys())[0]
        event_doc = event[lumu_event_type_name]
        event_doc["lumu_event_type"] = lumu_event_type_name
        event_doc["lumu_source_name"] = "lumu"

        if "openIncidentsStats" in event_doc:
            del event_doc["openIncidentsStats"]

        if "incident" in event_doc:
            inc_id = event_doc["incident"]["id"]
            del event_doc["incident"]["id"]
            event_doc.update(event_doc["incident"].copy())
            del event_doc["incident"]
        else:
            inc_id = event_doc["incidentId"]

        event_doc["lumu_incidentId"] = inc_id
        event_doc["lumu_status"] = event_doc.get("status", "N/A")

        if lumu_event_type_name in status_msg_types and is_msg_from_third_party(
            key=client.api_key, comment=event_doc.get("comment", "na")
        ):
            # ignore to avoid a loop
            demisto.debug(
                f"Ignoring Message ({lumu_event_type_name} - {inc_id}) from Cortex to not create a loop between both parties"
            )
            continue

        event_doc["comment"] = event_doc.get("comment") or "from fetching process"

        event_doc |= {
            "severity": 2,
            "status": 1,
            "mirror_instance": INTEGRATION_INSTANCE,
            "mirror_id": str(inc_id),
            "mirror_direction": MIRROR_DIRECTION,
            "mirror_last_sync": datetime.now().strftime("%Y-%m-%dT%H:%M:%SZ"),
            "mirror_tags": MIRROR_TAGS,
        }

        incident = {
            "name": f'lumu - {event_doc.get("description","")} - {inc_id}',
            "occurred": event_doc.get("timestamp", today),
            "dbotMirrorId": str(inc_id),
            "rawJSON": json.dumps(event_doc),
        }
        incidents.append(incident)
        incidents_id.append(str(inc_id))

    incs_to_cortex = []
    if incidents_id:
        cache = get_integration_context()
        if not cache:
            cache["cache"] = []
            cache["lumu_incidentsId"] = []

        incidents_id = list(set(incidents_id))
        cache["cache"].append(incidents_id)

        for inc in incidents:
            if inc["dbotMirrorId"] in cache["lumu_incidentsId"]:
                # skip incident, avoid duplication in cortex
                # do not add the incident, already exist
                continue
            else:
                incs_to_cortex.append(inc)
                cache["lumu_incidentsId"].append(inc["dbotMirrorId"])
        cache["lumu_incidentsId"] = list(set(cache["lumu_incidentsId"]))
        demisto.debug(f'There are {len(cache["cache"])} events queued ready to process their updates')
        set_integration_context(cache)
    next_run = {"last_fetch": str(next_start_time)}

    return next_run, incs_to_cortex


def get_modified_remote_data_command(client: Client, args: Dict[str, str]) -> GetModifiedRemoteDataResponse:
    incidents_id = []
    try:
        cache = get_integration_context()

        incidents_id = cache["cache"].pop(0)
        demisto.debug(f'FIFO processing, there are {len(cache["cache"])} events left to process')

    except IndexError:
        incidents_id = []
    finally:
        set_integration_context(cache)
        return GetModifiedRemoteDataResponse(incidents_id)


def get_remote_data_command(client, args):
    parsed_args = GetRemoteDataArgs(args)
    try:
        new_incident_data: Dict = client.retrieve_a_specific_incident_details_request(parsed_args.remote_incident_id)

        parsed_entries = []

        new_incident_data["lumu_incidentId"] = new_incident_data["id"]

        if lumu_actions := new_incident_data.get("actions"):
            new_incident_data["comment"] = f'{lumu_actions[0]["action"]} - {lumu_actions[0]["comment"]}'

            entry_comment = {
                "Type": EntryType.NOTE,
                "Contents": f'{lumu_actions[0]["action"]} - {lumu_actions[0]["comment"]}',
                "ContentsFormat": EntryFormat.MARKDOWN,
                "Note": True,
            }
            parsed_entries.append(entry_comment)

        new_incident_data["incomming_mirror_error"] = ""

        if inc_desc := new_incident_data.get("description"):
            new_incident_data["name"] = f'lumu - {inc_desc} - {new_incident_data["lumu_incidentId"]}'

        for field_to_delete in FIELDS_TO_REMOVE_FROM_MIROR_IN:
            if field_to_delete in new_incident_data:
                del new_incident_data[field_to_delete]

        inc_id = new_incident_data["lumu_incidentId"]
        lumu_first_contact = new_incident_data.get("firstContactDetails", {}).get("datetime", "N/A")
        lumu_adversary_types = ", ".join(new_incident_data.get("adversaryTypes", ""))
        lumu_desc = new_incident_data.get("description")
        lumu_total_contacts = new_incident_data.get("contacts", "N/A")
        lumu_total_endpoint = new_incident_data.get("totalEndpoints", "N/A")
        lumu_url = f"https://portal.lumu.io/compromise/incidents/show/{inc_id}/detections"

        description = (
            f"Incident ID:  {inc_id} \nDate of first contact: {lumu_first_contact} \nAdversary type:"
            f" {lumu_adversary_types} \nDescription: {lumu_desc} \nTotal contacts: {lumu_total_contacts} "
            f"\nTotal Endpoints: {lumu_total_endpoint} "
            f"\nURL: {lumu_url}"
        )

        new_incident_data["description"] = new_incident_data["description"] + " - " + description
        entry_comment = {
            "Type": EntryType.NOTE,
            "Contents": description,
            "ContentsFormat": EntryFormat.MARKDOWN,
            "Note": True,
        }
        parsed_entries.append(entry_comment)

        if "close" in new_incident_data.get("status", ""):
            entry_comment = {
                "Type": EntryType.NOTE,
                "Contents": {
                    "dbotIncidentClose": True,
                    "closeReason": f'Lumu Portal : {lumu_actions[0]["comment"]}',  # type: ignore[index]
                },
                "ContentsFormat": EntryFormat.JSON,
            }
            parsed_entries.append(entry_comment)
            demisto.debug(f"incident closed from Lumu, sync with Cortex {lumu_desc:$^40}")
        new_incident_data["lumu_status"] = new_incident_data.get("status", "N/A")

        return GetRemoteDataResponse(new_incident_data, parsed_entries)
    except Exception as e:
        demisto.debug(f"get_remote_data_command error {e}")
        if "Rate limit exceeded" in str(e):  # modify this according to the vendor's spesific message
            return_error("API rate limit")


def get_mapping_fields_command():
    lumu_type_scheme = SchemeTypeMapping(type_name="incident type Lumu")
    for field in [
        "mute",
        "comment",
        "unmute",
        "close",
        "description",
        "lumu_status",
        "status",
    ]:
        lumu_type_scheme.add_field(name=field, description="the description for the Lumu field")

    return GetMappingFieldsResponse(lumu_type_scheme)


def update_remote_system_command(client: Client, args: Dict[str, Any]) -> str:
    """update-remote-system command: pushes local changes to the remote system

    :type client: ``Client``
    :param client: XSOAR client to use

    :type args: ``Dict[str, Any]``
    :param args:
        all command arguments, usually passed from ``demisto.args()``.
        ``args['data']`` the data to send to the remote system
        ``args['entries']`` the entries to send to the remote system
        ``args['incidentChanged']`` boolean telling us if the local incident indeed changed or not
        ``args['remoteId']`` the remote incident id

    :return:
        ``str`` containing the remote incident id - really important if the incident is newly created remotely

    :rtype: ``str``
    """
    parsed_args = UpdateRemoteSystemArgs(args)
    new_incident_id: str = parsed_args.remote_incident_id

    if (not parsed_args.entries) and (not parsed_args.delta):
        return new_incident_id

    if parsed_args.delta:
        original_commnet = parsed_args.delta.get("comment", "")
        new_comment = add_prefix_to_comment(original_commnet)
        key = client.api_key
        try:
            if reason := parsed_args.delta.get("closeReason"):
                notes = parsed_args.delta.get("closeNotes", "")
                user = parsed_args.delta.get("closingUserId", "")
                new_comment += f", {notes=}, {reason=}, {user=}"
                new_comment = generate_hmac_sha256_msg(key, new_comment)
                response = client.close_incident_request(new_incident_id, new_comment)
                response = {"statusCode": 200, "response": response}

            elif (lumu_status := parsed_args.delta.get("lumustatus")) or (lumu_status := parsed_args.delta.get("lumu_status")):
                if lumu_status in ["mute", "muted"]:
                    new_comment = generate_hmac_sha256_msg(key, new_comment)

                    response = client.mute_incident_request(new_incident_id, new_comment)
                    response = {"statusCode": 200, "response": response}

                elif lumu_status in ["unmute", "unmuted"]:
                    new_comment = generate_hmac_sha256_msg(key, new_comment)
                    response = client.unmute_incident_request(new_incident_id, new_comment)
                    response = {"statusCode": 200, "response": response}

                elif lumu_status in ["close", "closed"]:
                    msg = "to close an incident, it has to be in the CLOSE INCIDENT option in the ACTION button"
                    response = {"statusCode": 404, "reason": msg}
                    demisto.debug(msg)

                elif original_commnet:
                    new_comment = generate_hmac_sha256_msg(key, new_comment)
                    response = client.comment_a_specific_incident_request(new_incident_id, new_comment)
                    response = {"statusCode": 200, "response": response}

                else:
                    response = {"statusCode": 404, "reason": "lumu status not found"}

            elif original_commnet:
                new_comment = generate_hmac_sha256_msg(key, new_comment)

                response = client.comment_a_specific_incident_request(new_incident_id, new_comment)
                response = {"statusCode": 200, "response": response}

        except DemistoException as err:
            raise DemistoException(repr(err))

    demisto.debug(f"{response=}, {parsed_args.delta=}, {parsed_args.remote_incident_id=}, {parsed_args.incident_changed}")

    return new_incident_id


def clear_cache_command():
    cache: Dict = {}
    cache["cache"] = []
    cache["lumu_incidentsId"] = []
    set_integration_context(cache)
    command_results = CommandResults(
        outputs_prefix="Lumu.ClearCache",
        outputs=f"cache cleared {get_integration_context()=}",
        raw_response=f"cache cleared {get_integration_context()=}",
        readable_output=f"cache cleared {get_integration_context()=}",
    )

    return command_results


def get_cache_command():
    cache = get_integration_context()
    command_results = CommandResults(
        outputs_prefix="Lumu.GetCache",
        outputs=cache,
        raw_response=cache,
        readable_output=tableToMarkdown("Cache", cache, headerTransform=pascalToSpace, removeNull=True),
    )

    return command_results


def test_module(client: Client, args: Dict[str, Any]) -> None:
    # Test functions here
    try:
        page = args.get("page")
        items = args.get("limit")
        client.retrieve_labels_request(page, items)
        return_results("ok")
    except Exception as e:
        msg_err = f"verify Lumu API Key and Network Connections - {e.__class__} - {repr(e)} - {e}"
        return_results(msg_err)


""" MAIN FUNCTION """


def main() -> None:
    params: Dict[str, Any] = demisto.params()
    args: Dict[str, Any] = demisto.args()
    url = params.get("url")
    verify_certificate: bool = not params.get("insecure", False)
    proxy = params.get("proxy", False)
    offset_set_off = params.get("fetch_offset", "0")
    items = int(params.get("total_items_per_lumu_fetch", 30))
    time_last = int(params.get("max_time_fetching_lumu_incident", 4))

    headers: Dict = {"Content-Type": "application/json"}

    command = demisto.command()
    demisto.debug(f"Command being called is {command.upper():*^40}")

    try:
        urllib3.disable_warnings()
        client: Client = Client(url, verify_certificate, proxy, headers=headers)
        client.api_key = params.get("api_key")
        commands = {
            "lumu-retrieve-labels": retrieve_labels_command,
            "lumu-retrieve-a-specific-label": retrieve_a_specific_label_command,
            "lumu-retrieve-incidents": retrieve_incidents_command,
            "lumu-retrieve-a-specific-incident-details": retrieve_a_specific_incident_details_command,
            "lumu-retrieve-a-specific-incident-context": retrieve_a_specific_incident_context_command,
            "lumu-comment-a-specific-incident": comment_a_specific_incident_command,
            "lumu-retrieve-open-incidents": retrieve_open_incidents_command,
            "lumu-retrieve-muted-incidents": retrieve_muted_incidents_command,
            "lumu-retrieve-closed-incidents": retrieve_closed_incidents_command,
            "lumu-retrieve-endpoints-by-incident": retrieve_endpoints_by_incident_command,
            "lumu-mark-incident-as-read": mark_incident_as_read_command,
            "lumu-mute-incident": mute_incident_command,
            "lumu-unmute-incident": unmute_incident_command,
            "lumu-consult-incidents-updates-through-rest": consult_incidents_updates_through_rest_command,
            "lumu-close-incident": close_incident_command,
            "get-modified-remote-data": get_modified_remote_data_command,
            "get-remote-data": get_remote_data_command,
            "update-remote-system": update_remote_system_command,
        }

        if command == "test-module":
            test_module(client, args)
        elif "fetch-incidents" in command or command == "fetch-incidents":
            last_run = demisto.getLastRun()
            next_run, incidents = fetch_incidents(client, offset_set_off, last_run, items, time_last)

            demisto.setLastRun(next_run)
            demisto.incidents(incidents)
            count = Counter([inc["dbotMirrorId"] for inc in incidents])
            demisto.debug(f"total inc found: {len(incidents)}, {count=} {last_run=} {next_run=}")

        elif command == "get-modified-remote-data":
            incidents_id = get_modified_remote_data_command(client, args)
            return_results(incidents_id)

        elif command == "get-remote-data":
            return_results(get_remote_data_command(client, args))

        elif command == "get-mapping-fields":
            return_results(get_mapping_fields_command())

        elif command == "update-remote-system":
            return_results(update_remote_system_command(client, args))

        elif command == "lumu-clear-cache":
            return_results(clear_cache_command())

        elif command == "lumu-get-cache":
            return_results(get_cache_command())

        elif command in commands:
            return_results(commands[command](client, args))
        else:
            raise NotImplementedError(f"{command} command is not implemented.")

    except Exception as e:
        return_error(str(e))


if __name__ in ["__main__", "builtin", "builtins"]:
    main()