Malwarebytes
Scan and Remediate threats on endpoints in the Malwarebytes cloud.
Endpoint · ThreatDown
Details
| ID | Malwarebytes |
|---|---|
| Provider | Malwarebytes |
| Category | Endpoint |
| From Version | 5.0.0 |
| Docker Image | demisto/auth-utils:1.0.0.10608895 |
| Supported Modules | Agentix XSIAM |
README
Overview
| Scan and Remediate threats on endpoints in the ThreatDown | Nebula. |
| This integration was integrated and tested with ThreatDown | Nebula. |
ThreatDown (powered by Malwarebytes) Playbook
- Malwarebytes - Scan & Remediate Endpoint
- Malwarebytes - Isolate Endpoint
Use Cases
- Trigger ThreatDown Scans and Remediation as part of Cortex XSOAR Playbook.
- Trigger ThreatDown EDR Advanced Capabilities as part of a Cortex XSOAR Playbook.
- Create Cortex XSOAR incidents based on threats detected by ThreatDown.
Configure ThreatDown (powered by Malwarebytes) on Cortex XSOAR
This integration collects your E-mail and Company Name for usage analytics of ThreatDown, if provided in the config.
- Navigate to Settings > Integrations > Servers & Services.
- Search for ThreatDown.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Account ID
- Client ID
- Client Secret
- Region
- Fetch incidents
- Incident type
- Fetch Event List
- RTP Detections Threat Category
- Suspicious Activity Severity
- Trust any certificate (not secure)
- Use system proxy settings
- Company Name
- Click Test to validate the URLs, token, and connection.
Fetched Incidents Data
The fetch incidents command is the function that Cortex XSOAR calls every minute to import new incidents and is triggered by the “Fetches incidents” parameter in the integration configuration.
What kind of objects/entities the integration should fetch (events/alerts/incidents/cases/tickets/etc)?
- Create a Cortex XSOAR incident upon a ThreatDown Real-time protection detections.
- Create a Cortex XSOAR incident upon a ThreatDown Suspicious Activity detections.
Are there any filters available to allow users to filter those incidents (e.g. type, status, etc) ?
Filters like Severity, Malware Category will be provided on the integration config.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
- malwarebytes-scan-and-remediate
- malwarebytes-scan-and-report
- malwarebytes-isolate-endpoint
- malwarebytes-isolate-process
- malwarebytes-isolate-desktop
- malwarebytes-isolate-network
- malwarebytes-deisolate-endpoint
- malwarebytes-list-endpoints
- malwarebytes-list-endpoint-info
- malwarebytes-get-scan-detections
- malwarebytes-get-job-status
- malwarebytes-open-sa-incident
- malwarebytes-remediate-sa-incident
- malwarebytes-close-sa-incident
- malwarebytes-get-sa-activities
1. malwarebytes-scan-and-remediate
Initiate Scan and Remediate action on an endpoint based on IP or Hostname.
Base Command
malwarebytes-scan-and-remediate
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Machine_ID | string | Endpoint ID of the host |
| Malwarebytes.Scan.Job_ID | string | Job ID of the scanned host |
Command Example
!malwarebytes-scan-and-remediate hostname=DESKTOP-LI4MQ7B
Context Example
{
"Malwarebytes.Scan": {
"Machine_ID": "211d8c3e-142c-4849-b1f0-1680b4bd239c",
"Job_ID": "964776a3-9cd8-45a2-9c56-59f692f42cc6"
}
}
Human Readable Output
Scan and Remediate action has been successfully started on the Endpoint: DESKTOP-LI4MQ7B with the job_id: 964776a3-9cd8-45a2-9c56-59f692f42cc6. Use job_id in malwarebytes-get-job-status command to check status and malwarebytes-get-scan-detections command to view results
2. malwarebytes-scan-and-report
Initiate Scan and report action on an endpoint based on IP or Hostname.
Base Command
malwarebytes-scan-and-report
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Machine_ID | string | Endpoint ID of the host |
| Malwarebytes.Scan.Job_ID | string | Job ID of the scanned host |
Command Example
!malwarebytes-scan-and-report hostname=TA-AZ-CLT1
Context Example
{
"Malwarebytes.Scan": {
"Machine_ID": "017febb6-ae68-4c15-9918-d911c72d062a",
"Job_ID": "88c6de27-d7d2-45da-a0b9-239a774afe50"
}
}
Human Readable Output
Scan and Report action has been successfully started on the Endpoint: TA-AZ-CLT1 with the job_id: 88c6de27-d7d2-45da-a0b9-239a774afe50. Use job_id in malwarebytes-get-job-status command to check status and malwarebytes-get-scan-detections command to view results
3. malwarebytes-isolate-endpoint
Initiate Isolation action on an endpoint based on IP or Hostname. This action isolate an endpoint by Process, Network and Desktop.
Base Command
malwarebytes-isolate-endpoint
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Machine_ID | string | Endpoint ID of the host |
| Malwarebytes.Scan.Job_ID | string | Job ID of the scanned host |
Command Example
!malwarebytes-isolate-endpoint hostname=DESKTOP-LI4MQ7B
Context Example
{
"Malwarebytes.Scan": {
"Machine_ID": "211d8c3e-142c-4849-b1f0-1680b4bd239c",
"Job_ID": "c133caaf-2c1c-4c54-86b5-b45354608e4d"
}
}
Human Readable Output
Isolation action has been successfully started on the Endpoint: DESKTOP-LI4MQ7B with the job_id: c133caaf-2c1c-4c54-86b5-b45354608e4d. Use job_id in malwarebytes-get-job-status command to view results
4. malwarebytes-isolate-process
Initiate Process Isolation action on an endpoint based on IP or Hostname.
Base Command
malwarebytes-isolate-process
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Machine_ID | string | Endpoint ID of the host |
| Malwarebytes.Scan.Job_ID | string | Job ID of the scanned host |
Command Example
!malwarebytes-isolate-process hostname=DESKTOP-LI4MQ7B
Context Example
{
"Malwarebytes.Scan": {
"Machine_ID": "211d8c3e-142c-4849-b1f0-1680b4bd239c",
"Job_ID": "72708102-465f-4a3e-8be5-de93cdae6cad"
}
}
Human Readable Output
Process Isolation action has been successfully started on the Endpoint: DESKTOP-LI4MQ7B with the job_id: 72708102-465f-4a3e-8be5-de93cdae6cad. Use job_id in malwarebytes-get-job-status command to view results
5. malwarebytes-isolate-desktop
Initiate Desktop Isolation action on an endpoint based on IP or Hostname.
Base Command
malwarebytes-isolate-desktop
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Machine_ID | string | Endpoint ID of the host |
| Malwarebytes.Scan.Job_ID | string | Job ID of the scanned host |
Command Example
!malwarebytes-isolate-desktop hostname=TA-AZ-CLT1
Context Example
{
"Malwarebytes.Scan": {
"Machine_ID": "017febb6-ae68-4c15-9918-d911c72d062a",
"Job_ID": "6b0d17b7-bb5b-4314-a841-f25ae93c6a8e"
}
}
Human Readable Output
Desktop Isolation action has been successfully started on the Endpoint: TA-AZ-CLT1 with the job_id: 6b0d17b7-bb5b-4314-a841-f25ae93c6a8e. Use job_id in malwarebytes-get-job-status command to view results
6. malwarebytes-isolate-network
Initiate Network Isolation action on an endpoint based on IP or Hostname.
Base Command
malwarebytes-isolate-network
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Machine_ID | string | Endpoint ID of the host |
| Malwarebytes.Scan.Job_ID | string | Job ID of the scanned host |
Command Example
!malwarebytes-isolate-network hostname=TA-AZ-CLT1
Context Example
{
"Malwarebytes.Scan": {
"Machine_ID": "017febb6-ae68-4c15-9918-d911c72d062a",
"Job_ID": "cc92a1f4-7253-415d-a743-64f0ea7afb65"
}
}
Human Readable Output
Network Isolation action has been successfully started on the Endpoint: TA-AZ-CLT1 with the job_id: cc92a1f4-7253-415d-a743-64f0ea7afb65. Use job_id in malwarebytes-get-job-status command to view results
7. malwarebytes-deisolate-endpoint
Initiate Deisolation action on an endpoint based on IP or Hostname. This action deisolate an endpoint by Process, Network and Desktop.
Base Command
malwarebytes-deisolate-endpoint
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Machine_ID | string | Endpoint ID of the host |
| Malwarebytes.Scan.Job_ID | string | Job ID of the scanned host |
Command Example
!malwarebytes-deisolate-endpoint hostname=TA-AZ-CLT1
Context Example
{
"Malwarebytes.Scan": {
"Machine_ID": "017febb6-ae68-4c15-9918-d911c72d062a",
"Job_ID": "8dab60e1-e6d8-47c3-b321-0a74de329d20"
}
}
Human Readable Output
Deisolation action has been successfully started on the Endpoint: TA-AZ-CLT1 with the job_id: 8dab60e1-e6d8-47c3-b321-0a74de329d20. Use job_id in malwarebytes-get-job-status command to view results
8. malwarebytes-list-endpoints
List all/online/offline endpoints available in the Malwarebytes Cloud.
Base Command
malwarebytes-list-endpoints
Input
| Argument Name | Description | Required |
|---|---|---|
| endpoints | Enter value ‘all’ to get all endpoints and value ‘online’ or ‘offline’ to get online/offline endpoints. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Endpoint.total_count | int | total count of all/online/offline endpoints. |
Command Example
!malwarebytes-list-endpoints endpoints=all
Context Example
{
"Malwarebytes.Endpoint": {
"total_count": 5
}
}
Human Readable Output
Found all 5 Endpoints from Malwarebytes Cloud
| created_at | id | last_seen_at | name | online | os_architecture | os_platform | os_release_name |
|---|---|---|---|---|---|---|---|
| 2020-02-05T10:12:55.187467Z | 017febb6-ae68-4c15-9918-d911c72d062a | 2020-04-16T14:05:41.668409Z | TA-AZ-CLT1 | false | AMD64 | WINDOWS | Microsoft Windows 10 Pro |
| 2020-03-31T08:42:14.319976Z | 1d711cdc-6c6c-4457-927f-2528ecc857a0 | 2020-04-15T08:50:42.737922Z | EC2AMAZ-KK7M02P | false | AMD64 | WINDOWS | Microsoft Windows Server 2019 Datacenter |
| 2020-02-05T09:50:02.194556Z | 211d8c3e-142c-4849-b1f0-1680b4bd239c | 2020-04-22T09:07:41.206037Z | DESKTOP-LI4MQ7B | true | AMD64 | WINDOWS | Microsoft Windows 10 Enterprise |
| 2019-11-25T19:47:15.833008Z | b5740188-00a2-434b-a180-5b0fa85cb10b | 2020-04-21T18:17:43.064707Z | DESKTOP-91UJNA1 | false | AMD64 | WINDOWS | Microsoft Windows 10 Pro |
| 2019-10-18T09:26:26.993555Z | 5074ade3-5716-44d8-83c7-5985379c0399 | 2020-04-22T09:32:25.813131Z | DESKTOP-664HFM6 | true | AMD64 | WINDOWS | Microsoft Windows 10 Pro |
9. malwarebytes-list-endpoint-info
Lists more granular information about an endpoint.
Base Command
malwarebytes-list-endpoint-info
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Endpoint.Assets | string | Asset information of the endpoint. |
| Malwarebytes.Endpoint.Hostname | string | The hostname that is mapped to this endpoint. |
| Malwarebytes.Endpoint.IPAddress | string | The IP address of the endpoint. |
| Malwarebytes.Endpoint.Domain | string | The domain of the endpoint. |
| Malwarebytes.Endpoint.MACAddress | string | The MAC address of the endpoint. |
| Malwarebytes.Endpoint.OS | string | Endpoint OS. |
| Malwarebytes.Endpoint.OSVersion | string | OS version. |
| Malwarebytes.Endpoint.Model | string | The model of the machine or device. |
| Malwarebytes.Endpoint.Memory | int | Memory on this endpoint. |
| Endpoint.Hostname | string | The hostname that is mapped to this endpoint. |
| Endpoint.IPAddress | string | The IP address of the endpoint. |
| Endpoint.Domain | string | The domain of the endpoint. |
| Endpoint.MACAddress | string | The MAC address of the endpoint. |
| Endpoint.OS | string | Endpoint OS. |
| Endpoint.OSVersion | string | OS version. |
| Endpoint.Model | string | The model of the machine or device. |
| Endpoint.Memory | int | Memory on this endpoint. |
Command Example
!malwarebytes-list-endpoint-info hostname=TA-AZ-CLT1
Context Example
{
"Malwarebytes.Endpoint": {
"MACAddress": "000D3A0AFEC2",
"Domain": "",
"Assets": {
"computer_info": {
"model": "Virtual Machine",
"manufacturer": "Microsoft Corporation"
},
"plugin_version": "1.2.0.330",
"object_sid": "",
"updates_installed": [],
"dhcp_scope_name": "",
"object_guid": "",
"drives": [
{
"name": "C:\\",
"total_size": 135838822400,
"freespace_available": 124591616000,
"freespace_total": 124591616000,
"volume_label": "Windows",
"drive_format": "NTFS"
},
{
"name": "D:\\",
"total_size": 8588816384,
"freespace_available": 7477661696,
"freespace_total": 7477661696,
"volume_label": "Temporary Storage",
"drive_format": "NTFS"
}
],
"domain_name": "",
"culture": "en-US",
"nics": [
{
"ips": [
"10.0.0.11"
],
"description": "Microsoft Hyper-V Network Adapter",
"mac_address": "000D3A0AFEC2"
}
],
"host_name": "TA-AZ-CLT1",
"software_installed": [
{
"product": "Google Chrome",
"version": "80.0.3987.87",
"vendor": "Google LLC",
"installed_date": "2020-02-05T00:00:00Z"
},
{
"product": "Malwarebytes Endpoint Agent",
"version": "1.2.0.0",
"vendor": "Malwarebytes",
"installed_date": "2020-02-05T00:00:00Z"
}
],
"memory": {
"total_physical": 4294967296,
"total_virtual": 5368094720,
"free_virtual": 2920792064,
"free_physical": 1683750912
},
"time_zone": "Etc/GMT",
"startups": [
{
"value": "explorer.exe",
"name": "Shell",
"key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"
},
{
"value": "",
"name": "System",
"key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"
},
{
"value": "",
"name": "Taskman",
"key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"
},
{
"value": "C:\\windows\\system32\\userinit.exe,",
"name": "Userinit",
"key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"
},
{
"value": "C:\\windows\\system32\\SecurityHealthSystray.exe",
"name": "SecurityHealth",
"key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
},
{
"value": "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}",
"name": "WebCheck",
"key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad"
},
{
"name": "Authentication Packages",
"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa"
},
{
"name": "Notification Packages",
"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa"
},
{
"name": "Security Packages",
"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa"
},
{
"value": "credssp.dll",
"name": "SecurityProviders",
"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders"
}
],
"fully_qualified_host_name": "TA-AZ-CLT1",
"os_info": {
"os_release_name": "Microsoft Windows 10 Pro",
"os_type": "Workstation",
"os_architecture": "Amd64",
"os_platform": "Windows",
"os_version": "10.0.17763"
}
},
"OS": "Windows",
"Hostname": "TA-AZ-CLT1",
"Memory": {
"total_physical": 4294967296,
"total_virtual": 5368094720,
"free_virtual": 2920792064,
"free_physical": 1683750912
},
"Model": "Virtual Machine",
"OSVersion": "10.0.17763",
"IPAddress": [
{
"ips": [
"10.0.0.11"
],
"description": "Microsoft Hyper-V Network Adapter",
"mac_address": "000D3A0AFEC2"
}
]
},
"Endpoint": {
"MACAddress": "000D3A0AFEC2",
"Domain": "",
"OS": "Windows",
"Hostname": "TA-AZ-CLT1",
"Memory": 5368094720,
"Model": "Virtual Machine",
"OSVersion": "10.0.17763",
"IPAddress": "10.0.0.11"
}
}
Human Readable Output
Endpoint Information for the Hostname: TA-AZ-CLT1
| computer_info | culture | dhcp_scope_name | domain_name | drives | fully_qualified_host_name | host_name | memory | nics | object_guid | object_sid | os_info | plugin_version | software_installed | startups | time_zone | updates_installed |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| manufacturer: Microsoft Corporation model: Virtual Machine |
en-US | {‘freespace_available’: 124591616000, ‘volume_label’: ‘Windows’, ‘drive_format’: ‘NTFS’, ‘freespace_total’: 124591616000, ‘name’: ‘C:\’, ‘total_size’: 135838822400}, {‘freespace_available’: 7477661696, ‘volume_label’: ‘Temporary Storage’, ‘drive_format’: ‘NTFS’, ‘freespace_total’: 7477661696, ‘name’: ‘D:\’, ‘total_size’: 8588816384} |
TA-AZ-CLT1 | TA-AZ-CLT1 | total_virtual: 5368094720 free_virtual: 2920792064 total_physical: 4294967296 free_physical: 1683750912 |
{‘mac_address’: ‘000D3A0AFEC2’, ‘description’: ‘Microsoft Hyper-V Network Adapter’, ‘ips’: [‘10.0.0.11’]} | os_platform: Windows os_architecture: Amd64 os_version: 10.0.17763 os_release_name: Microsoft Windows 10 Pro os_type: Workstation |
1.2.0.330 | {‘vendor’: ‘Google LLC’, ‘product’: ‘Google Chrome’, ‘installed_date’: ‘2020-02-05T00:00:00Z’, ‘version’: ‘80.0.3987.87’}, {‘vendor’: ‘Malwarebytes’, ‘product’: ‘Malwarebytes Endpoint Agent’, ‘installed_date’: ‘2020-02-05T00:00:00Z’, ‘version’: ‘1.2.0.0’} |
{‘key’: ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon’, ‘name’: ‘Shell’, ‘value’: ‘explorer.exe’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon’, ‘name’: ‘System’, ‘value’: ‘’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon’, ‘name’: ‘Taskman’, ‘value’: ‘’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon’, ‘name’: ‘Userinit’, ‘value’: ‘C:\windows\system32\userinit.exe,’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run’, ‘name’: ‘SecurityHealth’, ‘value’: ‘C:\windows\system32\SecurityHealthSystray.exe’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad’, ‘name’: ‘WebCheck’, ‘value’: ‘{E6FB5E20-DE35-11CF-9C87-00AA005127ED}’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa’, ‘name’: ‘Authentication Packages’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa’, ‘name’: ‘Notification Packages’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa’, ‘name’: ‘Security Packages’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders’, ‘name’: ‘SecurityProviders’, ‘value’: ‘credssp.dll’} |
Etc/GMT |
10. malwarebytes-get-scan-detections
Lists detections from an endpoint for the scans initiated from Cortex XSOAR.
Base Command
malwarebytes-get-scan-detections
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | Job ID of the initiated Scan actions only. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Job_ID | string | Job_Id of the initiated Scan/Isolation/Deisolation actions. |
| Malwarebytes.Scan.Status | string | Scan Status for the host |
| Malwarebytes.Scan.Detections | string | Scan detections for the host |
Command Example
!malwarebytes-get-scan-detections job_id=931f63ca-e14f-43ad-85d2-3eb8236f1bdd
Context Example
{
"Malwarebytes.Scan": {
"Status": "COMPLETED",
"Detections": [
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\CCOKDBVT\\MHTQR4AW1913.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\CCOKDBVT\\EKATI3479.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\CCOKDBVT\\5WRQN2VY9117.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\AMDSCQBK\\EKATI3234.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\RKSUGKK2\\EKATI1111.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\RKSUGKK2\\5IPWAWNR7377.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\REAQNH4P\\UWAEL22C6434.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\REAQNH4P\\GJL0GTPS2496.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\REAQNH4P\\EKATI5786.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\REAQNH4P\\AAWK4JEC6577.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\R5QH05OL\\EKATI5120.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\QJTCQTO5\\EKATI3976.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\QGZQD505\\EKATI6903.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\QDI3PGI1\\EKATI8011.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\PHVALVXM\\EKATI5172.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\PCHQV24F\\EKATI8221.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\PCHQV24F\\0LI1UX235485.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\OX4R0SZA\\EKATI6865.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\K2LXHNO1\\EKATI6770.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\K1UQJ5KL\\EKATI1034.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\JI4PZP0K\\EKATI5574.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\ICOWWYNX\\EKATI7940.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\HUOBVYD0\\EKATI8486.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\H0LKYXKH\\EKATI6183.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\ZWIZHTVD\\EKATI6050.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\ZAAN0543\\EKATI4385.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\YWDLSBOE\\EKATI7806.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\XXQBCKEL\\Y2YWHFY47970.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\XXQBCKEL\\HVAVEBY58253.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\XXQBCKEL\\EKATI6877.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\XDFR4BMU\\EKATI1611.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\X5IN24J2\\EKATI2562.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\X3DL34QB\\EKATI4718.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\WAWZXFJU\\EKATI3613.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\VAIVLV51\\EKATI2378.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\FW3M1KTG\\NKWWQ5337273.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\FW3M1KTG\\KQDYZ5DZ2805.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\FW3M1KTG\\EKATI8812.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\FNKI23QO\\EKATI9379.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\FMULGDCG\\EKATI5361.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\EZ3VSVR0\\EKATI3626.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\DYEBLIJJ\\EKATI2757.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\DVM05IV0\\EKATI4168.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\DKI4HFKX\\EKATI2083.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\TXS354JE\\EKATI7864.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\TFDVXDEW\\EKATI3594.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\TCERNEHR\\EKATI3060.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\SSODDPVL\\EKATI3273.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\SK4GT55H\\NSMDWPVW1226.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\SK4GT55H\\EKATI6166.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\SJRCS2D5\\EKATI3838.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\S0RPYHDI\\EKATI1244.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\MDX3HHPZ\\EKATI7764.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\MA2EZOX5\\HURT2A3R4366.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\MA2EZOX5\\GVXQMXK04108.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\MA2EZOX5\\EKATI5862.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\LTMZR34O\\EKATI8397.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\5KE1T1MN\\EKATI3121.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\40ASYTIK\\EKATI2489.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\2VR0DR23\\EKATI9180.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\22PMRE41\\EKATI2935.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\1U0KTXL4\\EKATI4859.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\0TNNQOPO\\EKATI4374.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\0TNNQOPO\\CHLGY5ZD1037.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "Malware",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Generic.Malware/Suspicious",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\BIN3333.RAR",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "Malware",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "DDoSTool.Nitol",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\CCTV.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "PUP",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "PUP.Optional.Solimba",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\MICROSOFT OFFICE 2007 SERVICE PACK 2.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "Malware",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Trojan.ServStart",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\FCK_RSC.DUMP",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "Malware",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Generic.Malware/Suspicious",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\2211.RAR",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
}
],
"Job_ID": "931f63ca-e14f-43ad-85d2-3eb8236f1bdd"
}
}
Human Readable Output
Scan Detections Report for the Job_Id: 931f63ca-e14f-43ad-85d2-3eb8236f1bdd
| category | machine_id | machine_name | path | reported_at | status | threat_name | type |
|---|---|---|---|---|---|---|---|
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\CCOKDBVT\MHTQR4AW1913.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\CCOKDBVT\EKATI3479.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\CCOKDBVT\5WRQN2VY9117.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\AMDSCQBK\EKATI3234.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\RKSUGKK2\EKATI1111.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\RKSUGKK2\5IPWAWNR7377.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\REAQNH4P\UWAEL22C6434.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\REAQNH4P\GJL0GTPS2496.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\REAQNH4P\EKATI5786.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\REAQNH4P\AAWK4JEC6577.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\R5QH05OL\EKATI5120.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\QJTCQTO5\EKATI3976.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\QGZQD505\EKATI6903.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\QDI3PGI1\EKATI8011.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\PHVALVXM\EKATI5172.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\PCHQV24F\EKATI8221.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\PCHQV24F\0LI1UX235485.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\OX4R0SZA\EKATI6865.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\K2LXHNO1\EKATI6770.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\K1UQJ5KL\EKATI1034.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\JI4PZP0K\EKATI5574.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\ICOWWYNX\EKATI7940.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\HUOBVYD0\EKATI8486.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\H0LKYXKH\EKATI6183.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\ZWIZHTVD\EKATI6050.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\ZAAN0543\EKATI4385.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\YWDLSBOE\EKATI7806.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\XXQBCKEL\Y2YWHFY47970.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\XXQBCKEL\HVAVEBY58253.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\XXQBCKEL\EKATI6877.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\XDFR4BMU\EKATI1611.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\X5IN24J2\EKATI2562.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\X3DL34QB\EKATI4718.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\WAWZXFJU\EKATI3613.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\VAIVLV51\EKATI2378.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\FW3M1KTG\NKWWQ5337273.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\FW3M1KTG\KQDYZ5DZ2805.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\FW3M1KTG\EKATI8812.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\FNKI23QO\EKATI9379.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\FMULGDCG\EKATI5361.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\EZ3VSVR0\EKATI3626.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\DYEBLIJJ\EKATI2757.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\DVM05IV0\EKATI4168.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\DKI4HFKX\EKATI2083.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\TXS354JE\EKATI7864.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\TFDVXDEW\EKATI3594.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\TCERNEHR\EKATI3060.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\SSODDPVL\EKATI3273.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\SK4GT55H\NSMDWPVW1226.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\SK4GT55H\EKATI6166.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\SJRCS2D5\EKATI3838.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\S0RPYHDI\EKATI1244.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\MDX3HHPZ\EKATI7764.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\MA2EZOX5\HURT2A3R4366.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\MA2EZOX5\GVXQMXK04108.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\MA2EZOX5\EKATI5862.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\LTMZR34O\EKATI8397.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\5KE1T1MN\EKATI3121.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\40ASYTIK\EKATI2489.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\2VR0DR23\EKATI9180.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\22PMRE41\EKATI2935.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\1U0KTXL4\EKATI4859.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\0TNNQOPO\EKATI4374.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\0TNNQOPO\CHLGY5ZD1037.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| Malware | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\BIN3333.RAR | 2020-03-03T13:28:57.393772Z | found | Generic.Malware/Suspicious | file |
| Malware | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\CCTV.EXE | 2020-03-03T13:28:57.393772Z | found | DDoSTool.Nitol | file |
| PUP | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\MICROSOFT OFFICE 2007 SERVICE PACK 2.EXE | 2020-03-03T13:28:57.393772Z | found | PUP.Optional.Solimba | file |
| Malware | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\FCK_RSC.DUMP | 2020-03-03T13:28:57.393772Z | found | Trojan.ServStart | file |
| Malware | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\2211.RAR | 2020-03-03T13:28:57.393772Z | found | Generic.Malware/Suspicious | file |
11. malwarebytes-get-job-status
Lists scan/isolation/deisolation status of the endpoint for the scan/isolation/deisolation initated from Cortex XSOAR.
Base Command
malwarebytes-get-job-status
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | Job_Id of the initiated Scan/Isolation/Deisolation actions. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Job_ID | string | Job_Id of the initiated Scan/Isolation/Deisolation actions. |
| Malwarebytes.Scan.Status | string | Scan Status for the host |
Command Example
!malwarebytes-get-job-status job_id=831afff7-7511-40be-a1ce-eace622e1e3e
Context Example
{
"Malwarebytes.Scan": {
"Status": "EXPIRED",
"Job_ID": "831afff7-7511-40be-a1ce-eace622e1e3e"
}
}
Human Readable Output
Scan Status for the job_id 831afff7-7511-40be-a1ce-eace622e1e3e is EXPIRED
12. malwarebytes-open-sa-incident
Open Suspicious Activity for investigation in Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID.
Base Command
malwarebytes-open-sa-incident
Input
| Argument Name | Description | Required |
|---|---|---|
| machine_id | Machine ID of an endpoint where Suspicious Activity is found. | Required |
| detection_id | Detection ID of the Suspicious Activity. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.SA.Machine_ID | string | Machine ID of the Suspicious host |
Command Example
!malwarebytes-open-sa-incident machine_id=5074ade3-5716-44d8-83c7-5985379c0399 detection_id=69306685
Context Example
{
"Malwarebytes.SA": {
"Machine_ID": "5074ade3-5716-44d8-83c7-5985379c0399"
}
}
Human Readable Output
Open SA Incident action is initiated Successfully for the detection id: 69306685
13. malwarebytes-remediate-sa-incident
Remediate Suspicious Activity from Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID.
Base Command
malwarebytes-remediate-sa-incident
Input
| Argument Name | Description | Required |
|---|---|---|
| machine_id | Machine ID of an endpoint in Malwarebytes Cloud where Suspicious Activity is found. | Required |
| detection_id | Detection ID of the Suspicious Activity | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.SA.Machine_ID | string | Machine ID of the Suspicious host |
Command Example
!malwarebytes-remediate-sa-incident machine_id=5074ade3-5716-44d8-83c7-5985379c0399 detection_id=69306697
Context Example
{
"Malwarebytes.SA": {
"Machine_ID": "5074ade3-5716-44d8-83c7-5985379c0399"
}
}
Human Readable Output
Remediate SA Incident action is initiated Successfully for the detection id: 69306697
14. malwarebytes-close-sa-incident
Close Suspicious Activity Incident in Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID.
Base Command
malwarebytes-close-sa-incident
Input
| Argument Name | Description | Required |
|---|---|---|
| machine_id | Machine ID of an endpoint in Malwarebytes Cloud where Suspicious Activity is found. | Required |
| detection_id | Detection ID of the Suspicious Activity. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.SA.Machine_ID | string | Machine ID of the Suspicious host |
Command Example
!malwarebytes-close-sa-incident machine_id=5074ade3-5716-44d8-83c7-5985379c0399 detection_id=69306685
Context Example
{
"Malwarebytes.SA": {
"Machine_ID": "5074ade3-5716-44d8-83c7-5985379c0399"
}
}
Human Readable Output
Close SA Incident action is initiated Successfully for the detection id: 69306685
15. malwarebytes-get-sa-activities
Lists all suspicious activities from hostname value and list all the hostnames from path of file.
Base Command
malwarebytes-get-sa-activities
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of the endpoint. | Optional |
| path | Path of the file to be searched in suspicious activities. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Endpoint.Suspicious_Activities | string | Suspicious Activities for the host |
Command Example
!malwarebytes-get-sa-activities hostname=DESKTOP-664HFM6
Context Example
{
"Malwarebytes.Endpoint": {
"Suspicious_Activities": [
{
"status": "closed",
"detection_id_list": [
69306685
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-22T00:22:03.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\51I24R0R\\4S4USN157912.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "processing",
"detection_id_list": [
69306697
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-22T00:22:03.000Z",
"detected_by_count": 2,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\51I24R0R\\EKATI3419.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69298563
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-22T00:03:17.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\ZRPQZLD0\\EKATI4166.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69297395
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-22T00:00:18.000Z",
"detected_by_count": 3,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\ULHYC0ZK\\EKATI7387.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69293149
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-21T23:51:31.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\SXM2TCFT\\EKATI7194.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69224002
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T21:26:21.000Z",
"detected_by_count": 3,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\Y20DB3LK\\EKATI3988.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69216054
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-21T21:14:39.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\1VG2J1ZZ\\EKATI9823.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69216153
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T21:13:28.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\CJGQRXFS\\WR1LKLFO5074.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69216169
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T21:13:27.000Z",
"detected_by_count": 2,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\CJGQRXFS\\EKATI7396.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69205108
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-21T20:53:33.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\WGKUJRGM\\EKATI7827.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69199010
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T20:41:41.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\NURKWB4B\\MIYO4ZBX5817.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69199008
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T20:41:40.000Z",
"detected_by_count": 2,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\NURKWB4B\\EKATI1485.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69196909
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-21T20:41:15.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\Z2QEP4IQ\\EKATI1206.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69183153
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T20:18:19.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\R0TZHA1D\\QTVKKU0O3864.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69183344
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T20:18:18.000Z",
"detected_by_count": 2,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\R0TZHA1D\\EKATI3336.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69182161
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-21T20:16:25.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\Y5B35RXH\\EKATI4787.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69182258
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T20:16:06.000Z",
"detected_by_count": 2,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\QI2K3DLV\\EKATI8446.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
68915780
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-21T13:35:33.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\LERQ0DSN\\PFNLX1ZC2666.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
68915910
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-21T13:35:28.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\LERQ0DSN\\EKATI1279.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
68917631
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T13:35:21.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\KGSXOYUY\\1DM4MJK56911.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
68917642
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T13:35:21.000Z",
"detected_by_count": 3,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\KGSXOYUY\\EKATI5694.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67932985
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-20T08:46:20.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\TLX3EVTX\\EKATI4102.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67932021
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-20T08:45:38.000Z",
"detected_by_count": 9,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\LYFB0FPR\\EKATI8717.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67932009
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-20T08:45:35.000Z",
"detected_by_count": 8,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\X0BDZ1FX\\EKATI5156.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67932084
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-20T08:45:32.000Z",
"detected_by_count": 3,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\ZAX2TN0U\\EKATI3331.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67932008
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-20T08:45:08.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\V1YOTCGH\\EKATI1530.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67932145
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-20T08:45:02.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\IJJZUABZ\\E55QEANT8731.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67932186
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-20T08:45:02.000Z",
"detected_by_count": 2,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\IJJZUABZ\\EKATI7353.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "closed",
"detection_id_list": [
67931295
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-20T08:43:34.000Z",
"detected_by_count": 9,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\IMPDUHIQ\\EKATI3476.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "processing",
"detection_id_list": [
67931302
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-20T08:43:31.000Z",
"detected_by_count": 9,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\4KQQJWG5\\EKATI4354.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "processing",
"detection_id_list": [
67931496
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-20T08:43:24.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\AVQCVSEN\\CSF2FQEI8635.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67931509
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-20T08:43:24.000Z",
"detected_by_count": 3,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\AVQCVSEN\\EKATI2270.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67931294
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-20T08:43:16.000Z",
"detected_by_count": 11,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\RGCNKCKH\\EKATI1130.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
}
]
}
}
Human Readable Output
Suspicious Activites found for the host: DESKTOP-664HFM6
| account_id | detected_by_count | detection_id_list | level | machine_id | path | pc_hostname | status | timestamp |
|---|---|---|---|---|---|---|---|---|
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 69306685 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\51I24R0R\4S4USN157912.EXE | DESKTOP-664HFM6 | closed | 2020-04-22T00:22:03.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 2 | 69306697 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\51I24R0R\EKATI3419.EXE | DESKTOP-664HFM6 | processing | 2020-04-22T00:22:03.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 69298563 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\ZRPQZLD0\EKATI4166.EXE | DESKTOP-664HFM6 | detected | 2020-04-22T00:03:17.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 3 | 69297395 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\ULHYC0ZK\EKATI7387.EXE | DESKTOP-664HFM6 | detected | 2020-04-22T00:00:18.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 69293149 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\SXM2TCFT\EKATI7194.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T23:51:31.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 3 | 69224002 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\Y20DB3LK\EKATI3988.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T21:26:21.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 69216054 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\1VG2J1ZZ\EKATI9823.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T21:14:39.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 69216153 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\CJGQRXFS\WR1LKLFO5074.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T21:13:28.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 2 | 69216169 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\CJGQRXFS\EKATI7396.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T21:13:27.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 69205108 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\WGKUJRGM\EKATI7827.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:53:33.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 69199010 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\NURKWB4B\MIYO4ZBX5817.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:41:41.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 2 | 69199008 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\NURKWB4B\EKATI1485.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:41:40.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 69196909 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\Z2QEP4IQ\EKATI1206.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:41:15.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 69183153 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\R0TZHA1D\QTVKKU0O3864.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:18:19.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 2 | 69183344 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\R0TZHA1D\EKATI3336.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:18:18.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 69182161 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\Y5B35RXH\EKATI4787.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:16:25.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 2 | 69182258 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\QI2K3DLV\EKATI8446.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:16:06.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 68915780 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\LERQ0DSN\PFNLX1ZC2666.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T13:35:33.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 68915910 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\LERQ0DSN\EKATI1279.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T13:35:28.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 68917631 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\KGSXOYUY\1DM4MJK56911.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T13:35:21.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 3 | 68917642 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\KGSXOYUY\EKATI5694.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T13:35:21.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 67932985 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\TLX3EVTX\EKATI4102.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:46:20.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 9 | 67932021 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\LYFB0FPR\EKATI8717.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:45:38.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 8 | 67932009 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\X0BDZ1FX\EKATI5156.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:45:35.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 3 | 67932084 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\ZAX2TN0U\EKATI3331.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:45:32.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 67932008 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\V1YOTCGH\EKATI1530.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:45:08.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 67932145 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\IJJZUABZ\E55QEANT8731.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:45:02.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 2 | 67932186 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\IJJZUABZ\EKATI7353.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:45:02.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 9 | 67931295 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\IMPDUHIQ\EKATI3476.EXE | DESKTOP-664HFM6 | closed | 2020-04-20T08:43:34.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 9 | 67931302 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\4KQQJWG5\EKATI4354.EXE | DESKTOP-664HFM6 | processing | 2020-04-20T08:43:31.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 67931496 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\AVQCVSEN\CSF2FQEI8635.EXE | DESKTOP-664HFM6 | processing | 2020-04-20T08:43:24.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 3 | 67931509 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\AVQCVSEN\EKATI2270.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:43:24.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 11 | 67931294 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\RGCNKCKH\EKATI1130.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:43:16.000Z |
Configuration parameters
accountid— Account ID (required)clientid— Client ID (required)clientsecret— Client Secret (required)region— Region (required)isFetch— Fetch incidentsincidentType— Incident typeincidentFetchInterval— Incidents Fetch IntervalFetch_Event_List— Fetch Event Listrtp_threat_category— RTP Detections Threat Categorysuspicious_activity_severity— Suspicious Activity Severityinsecure— Trust any certificate (not secure)proxy— Use system proxy settingsemail— E-Mailcompany_name— Company Name
Commands (15)
-
malwarebytes-close-sa-incidentClose Suspicious Activity Incident in Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID.
-
malwarebytes-deisolate-endpointInitiate Deisolation action on an endpoint based on IP or Hostname. This action deisolate an endpoint by Process, Network and Desktop.
-
malwarebytes-get-job-statusLists scan/isolation/deisolation status of the endpoint for the scan/isolation/deisolation initated from Demisto.
-
malwarebytes-get-sa-activitiesLists all suspicious activities from hostname value and list all the hostnames from path of file.
-
malwarebytes-get-scan-detectionsLists detections from an endpoint for the scans initiated from Demisto.
-
malwarebytes-isolate-desktopInitiate Desktop Isolation action on an endpoint based on IP or Hostname.
-
malwarebytes-isolate-endpointInitiate Isolation action on an endpoint based on IP or Hostname. This action isolate an endpoint by Process, Network and Desktop.
-
malwarebytes-isolate-networkInitiate Network Isolation action on an endpoint based on IP or Hostname.
-
malwarebytes-isolate-processInitiate Process Isolation action on an endpoint based on IP or Hostname.
-
malwarebytes-list-endpoint-infoLists more granular information about an endpoint.
-
malwarebytes-list-endpointsList all/online/offline endpoints available in the Malwarebytes Cloud.
-
malwarebytes-open-sa-incidentOpen Suspicious Activity for investigation in Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID.
-
malwarebytes-remediate-sa-incidentRemediate Suspicious Activity from Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID.
-
malwarebytes-scan-and-remediateInitiate Scan and Remediate action on an endpoint based on IP or Hostname.
-
malwarebytes-scan-and-reportInitiate Scan and report action on an endpoint based on IP or Hostname.
import demistomock as demisto import Malwarebytes from Malwarebytes import ( REGION_URLS, close_sa_incident, deisolate_endpoint, fetch_incidents, get_sa_activities_command, isolate_desktop, isolate_endpoint, isolate_network, isolate_process, list_all_endpoints, list_endpoint_info, main, nebula_url, open_sa_incident, remediate_sa_incident, scan_and_remediate, scan_and_report, scan_detections, scan_status, ) auth_token = "vATEZGHAxu5AoNzZZSR7URcnREqxaHcxGlZy0_3M8aU.j3KdAUwntnzvcjE4-UdVORUGvnR4eBVITn6KxoblFYc" account_id = "XXX-XXX-XXX-XXXX--XXXX" client_id = "NB-XXX-XXXX1234-1234" MOCK_ENDPOINTS = "https://cloud.threatdown.com/api/v2/endpoints" MOCK_ENDPOINT_MACHINE_ID = "https://cloud.threatdown.com/api/v2/endpoints" USE_SSL = False MOCK_ENDPOINT_MACHINE_ID_RESP = { "aggregations": {}, "machines": [ { "link": "/api/v2/machines/8c9df179-a999-4ca2-9c41-9795ae0b08f5", "agent": { "started_at_offset": 0, "last_user": "WIN-TEN8D4FCOUB\\Administrator", "at": "2020-01-01T04:20:49.784113Z", "account_id": "56db16b7-7bcd-404b-9443-f4ed95044c64", "group_id": "57b6dbcd-8243-4f52-b80a-7c102c6b06d3", "nics": [ { "ips": ["192.168.230.140"], "description": "Intel(R) 82574L Gigabit Network Connection #2", "mac_address": "000C29D7A627", }, { "ips": ["172.16.128.100"], "description": "Intel(R) 82574L Gigabit Network Connection", "mac_address": "000C29D7A631", }, ], "os_info": { "os_type": "Server", "os_version": "6.3.9600", "os_platform": "Windows", "os_architecture": "Amd64", "os_release_name": "Microsoft Windows Server 2012 R2 Standard", }, "host_name": "WIN-TEN8D4FCOUB", "fully_qualified_host_name": "WIN-TEN8D4FCOUB", "plugins": { "asset_manager": {"product_name": "Asset Manager", "plugin_version": "1.2.0.329"}, "endpoint_detection_and_response": { "product_name": "Endpoint Detection and Response", "plugin_version": "1.2.0.282", }, }, "engine_version": "1.2.0.726", "policy_etag": "ae2dccc2e3eaa8b33d10f577f76ddc29", }, "machine": { "id": "8c9df179-a999-4ca2-9c41-9795ae0b08f5", "online": False, "account_id": "56db16b7-7bcd-404b-9443-f4ed95044c64", "group_id": "57b6dbcd-8243-4f52-b80a-7c102c6b06d3", "root_group_id": "57b6dbcd-8243-4f52-b80a-7c102c6b06d3", "group_name": "Asia-Group-ServerEPR", "policy_id": "2336247b-a41a-4f9c-8bf8-2e45e6cd41ff", "policy_name": "Asia-ServerEPR-Policy", "last_day_seen": "2020-01-01T04:03:36.046972Z", "isolated": False, "scan_age_days": 2147483647, "suspicious_activity_count": 55, "infection_count": 0, "reboot_required": 0, "is_deleted": False, }, } ], "total_count": 1, "next_cursor": "", } MOCK_HOSTNAME = "WIN-TEN8D4FCOUB" MOCK_IP = "192.168.1.1" MOCK_MACHINES_DATA = { "machines": [ { "created_at": "2020-02-05T10:12:55.187467Z", "id": "017febb6-ae68-4c15-9918-d911c72d062a", "last_seen_at": "2020-02-26T16:36:17.352342Z", "name": "TA-AZ-CLT1", "online": True, "os_architecture": "AMD64", "os_platform": "WINDOWS", "os_release_name": "Microsoft Windows 10 Pro", }, { "created_at": "2020-02-05T09:50:02.194556Z", "id": "211d8c3e-142c-4849-b1f0-1680b4bd239c", "last_seen_at": "2020-03-11T11:00:24.746133Z", "name": "WIN-TEN8D4FCOUB", "online": False, "os_architecture": "AMD64", "os_platform": "WINDOWS", "os_release_name": "Microsoft Windows 10 Enterprise", }, { "created_at": "2019-11-25T19:47:15.833008Z", "id": "b5740188-00a2-434b-a180-5b0fa85cb10b", "last_seen_at": "2020-02-27T15:36:33.68981Z", "name": "DESKTOP-91UJNA1", "online": False, "os_architecture": "AMD64", "os_platform": "WINDOWS", "os_release_name": "Microsoft Windows 10 Pro", }, { "created_at": "2019-10-18T09:26:26.993555Z", "id": "5074ade3-5716-44d8-83c7-5985379c0399", "last_seen_at": "2020-03-05T13:17:15.459352Z", "name": "DESKTOP-664HFM6", "online": False, "os_architecture": "AMD64", "os_platform": "WINDOWS", "os_release_name": "Microsoft Windows 10 Pro", }, ], "total_count": 4, "next_cursor": "", } MOCK_ENDPOINTS_JOBS = "https://cloud.threatdown.com/api/v2" MOCK_POST_JOBS_DATA = { "jobs": [{"machine_id": "8c9df179-a999-4ca2-9c41-9795ae0b08f5", "job_id": "aa104324-6d2f-4023-bfa6-78fc76d67200"}], "total_count": 1, } MOCK_JOBS_MACHINE_ID = "8c9df179-a999-4ca2-9c41-9795ae0b08f5" MOCK_SCAN_ID = "d6d46617-b99c-4758-aad2-0f8235c43d58" MOCK_JOBS_JOB_ID = "aa104324-6d2f-4023-bfa6-78fc76d67200" MOCK_ENDPOINT_JOBS_OUTPUT = { "Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": MOCK_JOBS_MACHINE_ID, "Job_ID": MOCK_JOBS_JOB_ID} } MOCK_GET_JOBS_DATA = { "id": "554e6e03-6a31-4007-aee8-954e88093ef0", "machine_id": "8c9df179-a999-4ca2-9c41-9795ae0b08f5", "machine_name": "DESKTOP-LI4MQ7B", "command": "command.threat.scan", "issued_at": "2020-03-17T14:02:26.562283Z", "issued_by": "54a39a8b-e368-4359-bf74-8358f8d4fc11", "expires_at": "2020-03-20T14:02:26.562285Z", "updated_at": "2020-03-17T14:12:09.230305Z", "state": "COMPLETED", "relay_state": "3fd16624-9d54-4e15-9d07-c222327d19fe", "scan_id": "d6d46617-b99c-4758-aad2-0f8235c43d58", } MOCK_DETECTIONS_PATH = MOCK_ENDPOINT_MACHINE_ID + "/" + MOCK_JOBS_MACHINE_ID + "/scans/" + MOCK_SCAN_ID + "/detections" MOCK_SCAN_DETECTIONS = { "detections": [ { "id": "f21ae327-8987-4d64-a0ed-12ffa5fdd7ba", "scan_id": "74f831d2-2871-4aa5-9030-60ce7247d23a", "machine_id": "211d8c3e-142c-4849-b1f0-1680b4bd239c", "machine_name": "WIN-TEN8D4FCOUB", "group_id": "a8fbe175-6b71-443c-b906-f18d06c7faf6", "detection_id_from_endpoint": "0bd77668-5106-11ea-8531-000c29541586", "scanned_at": "2020-02-16T21:39:20Z", "scanned_at_local": "2020-02-16T13:39:20-08:00", "reported_at": "2020-02-16T21:50:02.358811Z", "status": "quarantined", "threat_name": "Trojan.Agent.SVR", "type": ["file"], "path": "C:\\USERS\\WIN-BOX2\\DESKTOP\\711.RAR", "category": "Malware", "ip_address": "", "url": "", "port": "", "affected_application": "", "md5": "", "process_name": "", }, { "id": "f8707f3f-184c-4388-980f-5c2b4639c7ce", "scan_id": "eeb99e04-ae61-47f7-bfbf-8e023fdfffe2", "machine_id": "211d8c3e-142c-4849-b1f0-1680b4bd239c", "machine_name": "WIN-TEN8D4FCOUB", "group_id": "a8fbe175-6b71-443c-b906-f18d06c7faf6", "detection_id_from_endpoint": "df7bdca4-503c-11ea-8339-000c29541586", "scanned_at": "2020-02-15T21:39:19Z", "scanned_at_local": "2020-02-15T13:39:19-08:00", "reported_at": "2020-02-15T21:49:44.263558Z", "status": "quarantined", "threat_name": "Trojan.Agent.SVR", "type": ["file"], "path": "C:\\USERS\\WIN-BOX2\\DESKTOP\\711.RAR", "category": "Malware", "ip_address": "", "url": "", "port": "", "affected_application": "", "md5": "", "process_name": "", }, { "id": "6d76ebad-dfa3-47a8-8cac-a717fc09ae6d", "scan_id": "ab4623d7-9c07-46fc-95b1-d0d15c64e72b", "machine_id": "211d8c3e-142c-4849-b1f0-1680b4bd239c", "machine_name": "WIN-TEN8D4FCOUB", "group_id": "a8fbe175-6b71-443c-b906-f18d06c7faf6", "detection_id_from_endpoint": "c814b08c-4f73-11ea-9b36-000c29541586", "scanned_at": "2020-02-14T21:39:21Z", "scanned_at_local": "2020-02-14T13:39:21-08:00", "reported_at": "2020-02-14T22:00:57.806491Z", "status": "quarantined", "threat_name": "Trojan.ServStart", "type": ["file"], "path": "C:\\USERS\\WIN-BOX2\\DESKTOP\\518_2.EXE", "category": "Malware", "ip_address": "", "url": "", "port": "", "affected_application": "", "md5": "", "process_name": "", }, ], "total_count": 3, "next_cursor": "", } MOCK_SCAN_DETECTIONS_CLEAR = { "detections": [ { "machine_id": "211d8c3e-142c-4849-b1f0-1680b4bd239c", "machine_name": "WIN-TEN8D4FCOUB", "reported_at": "2020-02-16T21:50:02.358811Z", "status": "quarantined", "threat_name": "Trojan.Agent.SVR", "type": ["file"], "path": "C:\\USERS\\WIN-BOX2\\DESKTOP\\711.RAR", "category": "Malware", }, { "machine_id": "211d8c3e-142c-4849-b1f0-1680b4bd239c", "machine_name": "WIN-TEN8D4FCOUB", "reported_at": "2020-02-15T21:49:44.263558Z", "status": "quarantined", "threat_name": "Trojan.Agent.SVR", "type": ["file"], "path": "C:\\USERS\\WIN-BOX2\\DESKTOP\\711.RAR", "category": "Malware", }, { "machine_id": "211d8c3e-142c-4849-b1f0-1680b4bd239c", "machine_name": "WIN-TEN8D4FCOUB", "reported_at": "2020-02-14T22:00:57.806491Z", "status": "quarantined", "threat_name": "Trojan.ServStart", "type": ["file"], "path": "C:\\USERS\\WIN-BOX2\\DESKTOP\\518_2.EXE", "category": "Malware", }, ], "total_count": 3, "next_cursor": "", } MOCK_SA_CHOICE = "Suspicious Activity (EPR)" MOCK_SA_ENDPOINT = "https://cloud.threatdown.com/api/v2/sa" MOCK_RTP_CHOICE = "RTP Detections (EP)" MOCK_RTP_ENDPOINT = "https://cloud.threatdown.com/api/v2/detections/search" MOCK_SA_DATA = { "sa": [ { "detection_id_list": [34036085], "status": "detected", "timestamp": "2020-03-03T12:27:20.000Z", "path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\MA2EZOX5\\EKATI5862.EXE", "pc_hostname": "DESKTOP-664HFM6", "machine_id": "5074ade3-5716-44d8-83c7-5985379c0399", "account_id": "2020bd17-a809-4102-b744-94fe8ad1c591", "level": 2, "detected_by_count": 1, } ], "total_count": 1, "next_cursor": "", } MOCK_SA_MACHINE_ID = "211d8c3e-142c-4849-b1f0-1680b4bd239c" MOCK_SA_DETECTION_ID = "23606836" MOCK_RTP_DETECTIONS_DATA = { "detections": [ { "id": "1ef4503a-a1d3-4072-adc0-a3113c68662b", "type": ["OutboundConnection"], "status": "blocked", "path": "iptest.malwarebytes.com(100.24.169.13:49792)", "group_id": "e61dd210-1fd1-443c-ae6d-6bc9240a562f", "is_root_detection": True, "machine_id": "e7f1475a-7e9a-409b-b7a9-ccf7e6e68779", "account_id": "56db16b7-7bcd-404b-9443-f4ed95044c64", "detection_id": "d0a49ab4-62f6-11ea-8d88-000c29286b23", "scanned_at": "2020-03-10T17:44:39Z", "scanned_at_offset_seconds": 0, "reported_at": "2020-03-10T17:44:40.42176888Z", "threat_name": "Malicious Website", "category": "MWAC", "is_rtp_stream_event": True, "process_name": "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe", "cleaned_at": "0001-01-01T00:00:00Z", "machine_name": "Wampa.rebelbase.org", } ], "aggregations": {}, "total_count": 1, "next_cursor": "", } def test_scan_and_remediate_ip(requests_mock, mocker): """ Given: - An endpoint identified by IP address. When: - Running the scan and remediate command. Then: - A scan job is created and the correct job output is returned. """ MOCK_ENDPOINT_POST_JOBS = "https://cloud.threatdown.com/api/v2/jobs" # patch the API endpoint requests_mock.post(MOCK_ENDPOINT_MACHINE_ID, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.post(MOCK_ENDPOINT_POST_JOBS, json=MOCK_POST_JOBS_DATA, status_code=201) # patch the inputs mocker.patch.object(demisto, "args", return_value={"ip": MOCK_IP}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") scan_and_remediate(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_JOBS_OUTPUT def test_scan_and_remediate_hostname(requests_mock, mocker): """ Given: - An endpoint identified by hostname. When: - Running the scan and remediate command. Then: - A scan job is created and the correct job output is returned. """ MOCK_ENDPOINT_POST_JOBS = "https://cloud.threatdown.com/api/v2/jobs" # patch the API endpoint requests_mock.post(MOCK_ENDPOINT_MACHINE_ID, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.post(MOCK_ENDPOINT_POST_JOBS, json=MOCK_POST_JOBS_DATA, status_code=201) # patch the inputs mocker.patch.object(demisto, "args", return_value={"hostname": MOCK_HOSTNAME}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") scan_and_remediate(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_JOBS_OUTPUT def test_scan_and_report_ip(requests_mock, mocker): """ Given: - An endpoint identified by IP address. When: - Running the scan and report command. Then: - A scan job is created and the correct job output is returned. """ MOCK_ENDPOINT_POST_JOBS = "https://cloud.threatdown.com/api/v2/jobs" # patch the API endpoint requests_mock.post(MOCK_ENDPOINT_MACHINE_ID, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.post(MOCK_ENDPOINT_POST_JOBS, json=MOCK_POST_JOBS_DATA, status_code=201) # patch the inputs mocker.patch.object(demisto, "args", return_value={"ip": MOCK_IP}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") scan_and_report(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_JOBS_OUTPUT def test_scan_and_report_hostname(requests_mock, mocker): """ Given: - An endpoint identified by hostname. When: - Running the scan and report command. Then: - A scan job is created and the correct job output is returned. """ MOCK_ENDPOINT_POST_JOBS = "https://cloud.threatdown.com/api/v2/jobs" # patch the API endpoint requests_mock.post(MOCK_ENDPOINT_MACHINE_ID, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.post(MOCK_ENDPOINT_POST_JOBS, json=MOCK_POST_JOBS_DATA, status_code=201) # patch the inputs mocker.patch.object(demisto, "args", return_value={"hostname": MOCK_HOSTNAME}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") scan_and_report(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_JOBS_OUTPUT def test_isolate_endpoint_ip(requests_mock, mocker): """ Given: - An endpoint identified by IP address. When: - Running the isolate endpoint command. Then: - An isolation job is created and the correct job output is returned. """ MOCK_ENDPOINT_POST_JOBS = "https://cloud.threatdown.com/api/v2/jobs" # patch the API endpoint requests_mock.post(MOCK_ENDPOINT_MACHINE_ID, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.post(MOCK_ENDPOINT_POST_JOBS + "/endpoints/isolate", json=MOCK_POST_JOBS_DATA, status_code=201) # patch the inputs mocker.patch.object(demisto, "args", return_value={"ip": MOCK_IP}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") isolate_endpoint(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_JOBS_OUTPUT def test_isolate_endpoint_hostname(requests_mock, mocker): """ Given: - An endpoint identified by hostname. When: - Running the isolate endpoint command. Then: - An isolation job is created and the correct job output is returned. """ MOCK_ENDPOINT_POST_JOBS = "https://cloud.threatdown.com/api/v2/jobs" # patch the API endpoint requests_mock.post(MOCK_ENDPOINT_MACHINE_ID, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.post(MOCK_ENDPOINT_POST_JOBS + "/endpoints/isolate", json=MOCK_POST_JOBS_DATA, status_code=201) # patch the inputs mocker.patch.object(demisto, "args", return_value={"hostname": MOCK_HOSTNAME}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") isolate_endpoint(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_JOBS_OUTPUT def test_isolate_process_ip(requests_mock, mocker): """ Given: - An endpoint identified by IP address. When: - Running the isolate process command. Then: - A process isolation job is created and the correct job output is returned. """ MOCK_ENDPOINT_POST_JOBS = "https://cloud.threatdown.com/api/v2/jobs" # patch the API endpoint requests_mock.post(MOCK_ENDPOINT_MACHINE_ID, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.post(MOCK_ENDPOINT_POST_JOBS + "/endpoints/isolate", json=MOCK_POST_JOBS_DATA, status_code=201) # patch the inputs mocker.patch.object(demisto, "args", return_value={"ip": MOCK_IP}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") isolate_process(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_JOBS_OUTPUT def test_isolate_process_hostname(requests_mock, mocker): """ Given: - An endpoint identified by hostname. When: - Running the isolate process command. Then: - A process isolation job is created and the correct job output is returned. """ MOCK_ENDPOINT_POST_JOBS = "https://cloud.threatdown.com/api/v2/jobs" # patch the API endpoint requests_mock.post(MOCK_ENDPOINT_MACHINE_ID, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.post(MOCK_ENDPOINT_POST_JOBS + "/endpoints/isolate", json=MOCK_POST_JOBS_DATA, status_code=201) # patch the inputs mocker.patch.object(demisto, "args", return_value={"hostname": MOCK_HOSTNAME}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") isolate_process(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_JOBS_OUTPUT def test_isolate_desktop_ip(requests_mock, mocker): """ Given: - An endpoint identified by IP address. When: - Running the isolate desktop command. Then: - A desktop isolation job is created and the correct job output is returned. """ MOCK_ENDPOINT_POST_JOBS = "https://cloud.threatdown.com/api/v2/jobs" # patch the API endpoint requests_mock.post(MOCK_ENDPOINT_MACHINE_ID, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.post(MOCK_ENDPOINT_POST_JOBS + "/endpoints/isolate", json=MOCK_POST_JOBS_DATA, status_code=201) # patch the inputs mocker.patch.object(demisto, "args", return_value={"ip": MOCK_IP}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") isolate_desktop(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_JOBS_OUTPUT def test_isolate_desktop_hostname(requests_mock, mocker): """ Given: - An endpoint identified by hostname. When: - Running the isolate desktop command. Then: - A desktop isolation job is created and the correct job output is returned. """ MOCK_ENDPOINT_POST_JOBS = "https://cloud.threatdown.com/api/v2/jobs" # patch the API endpoint requests_mock.post(MOCK_ENDPOINT_MACHINE_ID, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.post(MOCK_ENDPOINT_POST_JOBS + "/endpoints/isolate", json=MOCK_POST_JOBS_DATA, status_code=201) # patch the inputs mocker.patch.object(demisto, "args", return_value={"hostname": MOCK_HOSTNAME}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") isolate_desktop(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_JOBS_OUTPUT def test_isolate_network_ip(requests_mock, mocker): """ Given: - An endpoint identified by IP address. When: - Running the isolate network command. Then: - A network isolation job is created and the correct job output is returned. """ MOCK_ENDPOINT_POST_JOBS = "https://cloud.threatdown.com/api/v2/jobs" # patch the API endpoint requests_mock.post(MOCK_ENDPOINT_MACHINE_ID, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.post(MOCK_ENDPOINT_POST_JOBS + "/endpoints/isolate", json=MOCK_POST_JOBS_DATA, status_code=201) # patch the inputs mocker.patch.object(demisto, "args", return_value={"ip": MOCK_IP}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") isolate_network(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_JOBS_OUTPUT def test_isolate_network_hostname(requests_mock, mocker): """ Given: - An endpoint identified by hostname. When: - Running the isolate network command. Then: - A network isolation job is created and the correct job output is returned. """ MOCK_ENDPOINT_POST_JOBS = "https://cloud.threatdown.com/api/v2/jobs" # patch the API endpoint requests_mock.post(MOCK_ENDPOINT_MACHINE_ID, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.post(MOCK_ENDPOINT_POST_JOBS + "/endpoints/isolate", json=MOCK_POST_JOBS_DATA, status_code=201) # patch the inputs mocker.patch.object(demisto, "args", return_value={"hostname": MOCK_HOSTNAME}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") isolate_network(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_JOBS_OUTPUT def test_deisolate_endpoint_ip(requests_mock, mocker): """ Given: - An endpoint identified by IP address that is currently isolated. When: - Running the deisolate endpoint command. Then: - A deisolation job is created and the correct job output is returned. """ MOCK_ENDPOINT_POST_JOBS = "https://cloud.threatdown.com/api/v2/jobs" # patch the API endpoint requests_mock.post(MOCK_ENDPOINT_MACHINE_ID, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.post(MOCK_ENDPOINT_POST_JOBS + "/endpoints/unlock", json=MOCK_POST_JOBS_DATA, status_code=201) # patch the inputs mocker.patch.object(demisto, "args", return_value={"ip": MOCK_IP}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") deisolate_endpoint(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_JOBS_OUTPUT def test_deisolate_endpoint_hostname(requests_mock, mocker): """ Given: - An endpoint identified by hostname that is currently isolated. When: - Running the deisolate endpoint command. Then: - A deisolation job is created and the correct job output is returned. """ MOCK_ENDPOINT_POST_JOBS = "https://cloud.threatdown.com/api/v2/jobs" # patch the API endpoint requests_mock.post(MOCK_ENDPOINT_MACHINE_ID, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.post(MOCK_ENDPOINT_POST_JOBS + "/endpoints/unlock", json=MOCK_POST_JOBS_DATA, status_code=201) # patch the inputs mocker.patch.object(demisto, "args", return_value={"hostname": MOCK_HOSTNAME}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") deisolate_endpoint(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_JOBS_OUTPUT def test_list_all_endpoints_all(requests_mock, mocker): """ Given: - A request to list all endpoints regardless of status. When: - Running the list endpoints command with endpoint filter set to 'all'. Then: - All endpoints are returned in the output. """ # patch the API endpoint requests_mock.get(MOCK_ENDPOINTS, json=MOCK_MACHINES_DATA) # patch the inputs mocker.patch.object(demisto, "args", return_value={"endpoints": "all"}) # patch the outputs mocker.patch.object(demisto, "results") # run the code endpoint = demisto.args().get("endpoints") list_all_endpoints(account_id, client_id, auth_token, endpoint, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert str(MOCK_MACHINES_DATA["machines"]) == str(outputs["Contents"]) def test_list_all_endpoints_online(requests_mock, mocker): """ Given: - A request to list only online endpoints. When: - Running the list endpoints command with endpoint filter set to 'online'. Then: - Only online endpoints are returned in the output. """ MOCK_MACHINES_DATA_ONLINE = { "machines": [ { "created_at": "2020-02-05T10:12:55.187467Z", "id": "017febb6-ae68-4c15-9918-d911c72d062a", "last_seen_at": "2020-02-26T16:36:17.352342Z", "name": "TA-AZ-CLT1", "online": True, "os_architecture": "AMD64", "os_platform": "WINDOWS", "os_release_name": "Microsoft Windows 10 Pro", } ] } # patch the API endpoint requests_mock.get(MOCK_ENDPOINTS, json=MOCK_MACHINES_DATA) # patch the inputs mocker.patch.object(demisto, "args", return_value={"endpoints": "online"}) # patch the outputs mocker.patch.object(demisto, "results") # run the code endpoint = demisto.args().get("endpoints") list_all_endpoints(account_id, client_id, auth_token, endpoint, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert str(MOCK_MACHINES_DATA_ONLINE["machines"]) == str(outputs["Contents"]) def test_list_all_endpoints_offline(requests_mock, mocker): """ Given: - A request to list only offline endpoints. When: - Running the list endpoints command with endpoint filter set to 'offline'. Then: - Only offline endpoints are returned in the output. """ MOCK_MACHINES_DATA_OFFLINE = { "machines": [ { "created_at": "2020-02-05T09:50:02.194556Z", "id": "211d8c3e-142c-4849-b1f0-1680b4bd239c", "last_seen_at": "2020-03-11T11:00:24.746133Z", "name": "WIN-TEN8D4FCOUB", "online": False, "os_architecture": "AMD64", "os_platform": "WINDOWS", "os_release_name": "Microsoft Windows 10 Enterprise", }, { "created_at": "2019-11-25T19:47:15.833008Z", "id": "b5740188-00a2-434b-a180-5b0fa85cb10b", "last_seen_at": "2020-02-27T15:36:33.68981Z", "name": "DESKTOP-91UJNA1", "online": False, "os_architecture": "AMD64", "os_platform": "WINDOWS", "os_release_name": "Microsoft Windows 10 Pro", }, { "created_at": "2019-10-18T09:26:26.993555Z", "id": "5074ade3-5716-44d8-83c7-5985379c0399", "last_seen_at": "2020-03-05T13:17:15.459352Z", "name": "DESKTOP-664HFM6", "online": False, "os_architecture": "AMD64", "os_platform": "WINDOWS", "os_release_name": "Microsoft Windows 10 Pro", }, ] } # patch the API endpoint requests_mock.get(MOCK_ENDPOINTS, json=MOCK_MACHINES_DATA) # patch the inputs mocker.patch.object(demisto, "args", return_value={"endpoints": "offline"}) # patch the outputs mocker.patch.object(demisto, "results") # run the code endpoint = demisto.args().get("endpoints") list_all_endpoints(account_id, client_id, auth_token, endpoint, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert str(MOCK_MACHINES_DATA_OFFLINE["machines"]) == str(outputs["Contents"]) def test_list_endpoint_info_hostname(requests_mock, mocker): """ Given: - An endpoint identified by hostname. When: - Running the get endpoint info command. Then: - The endpoint asset information is returned correctly. """ MOCK_ASSET_ID = "8c9df179-a999-4ca2-9c41-9795ae0b08f5" MOCK_ASSETS_RESPONSE = { "startups": [ { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "Shell", "value": "explorer.exe", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "System", "value": "", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "Taskman", "value": "", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "Userinit", "value": "C:\\Windows\\system32\\userinit.exe,", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", "name": "VMware User Process", "value": '"C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe" -n vmusr', }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad", "name": "WebCheck", "value": "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}", }, {"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "name": "Authentication Packages"}, {"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "name": "Notification Packages"}, {"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "name": "Security Packages"}, { "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders", "name": "SecurityProviders", "value": "credssp.dll, pwdssp.dll", }, ], "os_info": { "os_platform": "Windows", "os_architecture": "Amd64", "os_version": "6.3.9600", "os_release_name": "Microsoft Windows Server 2012 R2 Standard", "os_type": "Server", }, "memory": { "total_virtual": 2549530624, "free_virtual": 765550592, "total_physical": 2147483648, "free_physical": 873046016, }, "computer_info": {"manufacturer": "VMware, Inc.", "model": "VMware Virtual Platform"}, "software_installed": [ { "vendor": "Microsoft Corporation", "product": "Microsoft Help Viewer 2.2", "installed_date": "2019-01-07T16:00:00Z", "version": "2.2.23107", }, { "vendor": "Malwarebytes", "product": "Malwarebytes Management Console", "installed_date": "2017-03-26T16:00:00Z", "version": "1.8.0.3431", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.1 SDK", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.51641", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148", "installed_date": "2016-12-04T16:00:00Z", "version": "9.0.30729.4148", }, { "vendor": "Microsoft Corporation", "product": "IIS 7.5 Express", "installed_date": "2016-12-04T16:00:00Z", "version": "7.5.1070", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2017 Policies ", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2014 Management Objects ", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.2000.8", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (ENU)", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.51209", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5 Multi-Targeting Pack", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.50710", }, { "vendor": "Malwarebytes", "product": "Malwarebytes Endpoint Agent", "installed_date": "2019-11-15T16:00:00Z", "version": "1.2.0.717", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.1 Multi-Targeting Pack", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.50932", }, { "vendor": "Microsoft Corporation", "product": "Microsoft System CLR Types for SQL Server 2014", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.2402.11", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23026.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.21005.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server Data-Tier Application Framework (x86)", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.4127.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server Management Studio - 17.9.1", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.17289.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual Studio Tools for Applications 2015", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23829", }, { "vendor": "Malwarebytes", "product": "Malwarebytes Management Server", "installed_date": "2017-03-26T16:00:00Z", "version": "1.8.0.3431", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.2 Multi-Targeting Pack", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.51209", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual Studio Tools for Applications 2015 Language Support", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23107.20", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server Browser", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.21005.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual Studio 2015 Shell (Isolated)", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23107.10", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU)", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.50932", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23026.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 R2 (64-bit)", "installed_date": "2016-12-05T16:00:00Z", "version": "", }, { "vendor": "VMware, Inc.", "product": "VMware Tools", "installed_date": "2016-12-04T16:00:00Z", "version": "10.0.10.4301679", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 R2 Native Client", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server VSS Writer", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2012 Native Client ", "installed_date": "2019-01-07T16:00:00Z", "version": "11.3.6540.0", }, { "vendor": "Microsoft Corporation", "product": "Active Directory Authentication Library for SQL Server", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161", "installed_date": "2016-12-04T16:00:00Z", "version": "9.0.30729.6161", }, { "vendor": "Malwarebytes", "product": "Malwarebytes version 3.8.4.2971", "installed_date": "2019-11-15T16:00:00Z", "version": "3.8.4.2971", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 R2 Setup (English)", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft ODBC Driver 13 for SQL Server", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft System CLR Types for SQL Server 2017", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2017 T-SQL Language Service ", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.17289.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 Setup Support Files ", "installed_date": "2016-12-05T16:00:00Z", "version": "10.1.2731.0", }, ], "nics": [ { "mac_address": "000C29D7A627", "description": "Intel(R) 82574L Gigabit Network Connection #2", "ips": ["192.168.230.140"], }, { "mac_address": "000C29D7A631", "description": "Intel(R) 82574L Gigabit Network Connection", "ips": ["172.16.128.100"], }, ], "drives": [ { "freespace_available": 47086694400, "volume_label": "", "drive_format": "NTFS", "freespace_total": 47086694400, "name": "C:\\", "total_size": 64422408192, } ], "updates_installed": [{"installed_date": "2019-01-07T19:04:46Z", "title": "Update for Windows (KB2999226)"}], "domain_name": "", "culture": "en-US", "object_sid": "", "dhcp_scope_name": "", "time_zone": "Asia/Shanghai", "host_name": "WIN-TEN8D4FCOUB", "fully_qualified_host_name": "WIN-TEN8D4FCOUB", "object_guid": "", "plugin_version": "1.2.0.329", } MOCK_ENDPOINT_HOSTNAME_OUTPUT = { "Malwarebytes.Endpoint(val.Hostname == obj.Hostname)": { "Hostname": MOCK_ASSETS_RESPONSE["host_name"], "IPAddress": MOCK_ASSETS_RESPONSE["nics"], "Domain": MOCK_ASSETS_RESPONSE.get("domain_name"), "MACAddress": MOCK_ASSETS_RESPONSE["nics"][0]["mac_address"], "OS": MOCK_ASSETS_RESPONSE["os_info"]["os_platform"], "OSVersion": MOCK_ASSETS_RESPONSE["os_info"]["os_version"], "Model": MOCK_ASSETS_RESPONSE.get("computer_info", {}).get("model"), "Memory": MOCK_ASSETS_RESPONSE.get("memory"), "Assets": MOCK_ASSETS_RESPONSE, }, "Endpoint(val.Hostname == obj.Hostname)": { "Hostname": MOCK_ASSETS_RESPONSE["host_name"], "IPAddress": MOCK_ASSETS_RESPONSE["nics"][0]["ips"][0], "Domain": MOCK_ASSETS_RESPONSE.get("domain_name"), "MACAddress": MOCK_ASSETS_RESPONSE["nics"][0]["mac_address"], "OS": MOCK_ASSETS_RESPONSE["os_info"]["os_platform"], "OSVersion": MOCK_ASSETS_RESPONSE["os_info"]["os_version"], "Model": MOCK_ASSETS_RESPONSE.get("computer_info", {}).get("model"), "Memory": MOCK_ASSETS_RESPONSE.get("memory"), }, } # patch the API endpoint requests_mock.post(MOCK_ENDPOINTS, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.get(MOCK_ENDPOINTS + "/" + MOCK_ASSET_ID + "/assets", json=MOCK_ASSETS_RESPONSE) # patch the inputs mocker.patch.object(demisto, "args", return_value={"hostname": MOCK_HOSTNAME}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") list_endpoint_info(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert str(MOCK_ENDPOINT_HOSTNAME_OUTPUT) == str(outputs["EntryContext"]) def test_list_endpoint_info_ip(requests_mock, mocker): """ Given: - An endpoint identified by IP address. When: - Running the get endpoint info command. Then: - The endpoint asset information is returned correctly. """ MOCK_ASSET_ID = "8c9df179-a999-4ca2-9c41-9795ae0b08f5" MOCK_ASSETS_RESPONSE = { "startups": [ { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "Shell", "value": "explorer.exe", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "System", "value": "", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "Taskman", "value": "", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "Userinit", "value": "C:\\Windows\\system32\\userinit.exe,", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", "name": "VMware User Process", "value": '"C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe" -n vmusr', }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad", "name": "WebCheck", "value": "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}", }, {"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "name": "Authentication Packages"}, {"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "name": "Notification Packages"}, {"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "name": "Security Packages"}, { "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders", "name": "SecurityProviders", "value": "credssp.dll, pwdssp.dll", }, ], "os_info": { "os_platform": "Windows", "os_architecture": "Amd64", "os_version": "6.3.9600", "os_release_name": "Microsoft Windows Server 2012 R2 Standard", "os_type": "Server", }, "memory": { "total_virtual": 2549530624, "free_virtual": 765550592, "total_physical": 2147483648, "free_physical": 873046016, }, "computer_info": {"manufacturer": "VMware, Inc.", "model": "VMware Virtual Platform"}, "software_installed": [ { "vendor": "Microsoft Corporation", "product": "Microsoft Help Viewer 2.2", "installed_date": "2019-01-07T16:00:00Z", "version": "2.2.23107", }, { "vendor": "Malwarebytes", "product": "Malwarebytes Management Console", "installed_date": "2017-03-26T16:00:00Z", "version": "1.8.0.3431", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.1 SDK", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.51641", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148", "installed_date": "2016-12-04T16:00:00Z", "version": "9.0.30729.4148", }, { "vendor": "Microsoft Corporation", "product": "IIS 7.5 Express", "installed_date": "2016-12-04T16:00:00Z", "version": "7.5.1070", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2017 Policies ", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2014 Management Objects ", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.2000.8", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (ENU)", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.51209", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5 Multi-Targeting Pack", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.50710", }, { "vendor": "Malwarebytes", "product": "Malwarebytes Endpoint Agent", "installed_date": "2019-11-15T16:00:00Z", "version": "1.2.0.717", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.1 Multi-Targeting Pack", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.50932", }, { "vendor": "Microsoft Corporation", "product": "Microsoft System CLR Types for SQL Server 2014", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.2402.11", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23026.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.21005.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server Data-Tier Application Framework (x86)", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.4127.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server Management Studio - 17.9.1", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.17289.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual Studio Tools for Applications 2015", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23829", }, { "vendor": "Malwarebytes", "product": "Malwarebytes Management Server", "installed_date": "2017-03-26T16:00:00Z", "version": "1.8.0.3431", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.2 Multi-Targeting Pack", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.51209", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual Studio Tools for Applications 2015 Language Support", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23107.20", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server Browser", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.21005.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual Studio 2015 Shell (Isolated)", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23107.10", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU)", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.50932", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23026.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 R2 (64-bit)", "installed_date": "2016-12-05T16:00:00Z", "version": "", }, { "vendor": "VMware, Inc.", "product": "VMware Tools", "installed_date": "2016-12-04T16:00:00Z", "version": "10.0.10.4301679", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 R2 Native Client", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server VSS Writer", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2012 Native Client ", "installed_date": "2019-01-07T16:00:00Z", "version": "11.3.6540.0", }, { "vendor": "Microsoft Corporation", "product": "Active Directory Authentication Library for SQL Server", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161", "installed_date": "2016-12-04T16:00:00Z", "version": "9.0.30729.6161", }, { "vendor": "Malwarebytes", "product": "Malwarebytes version 3.8.4.2971", "installed_date": "2019-11-15T16:00:00Z", "version": "3.8.4.2971", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 R2 Setup (English)", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft ODBC Driver 13 for SQL Server", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft System CLR Types for SQL Server 2017", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2017 T-SQL Language Service ", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.17289.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 Setup Support Files ", "installed_date": "2016-12-05T16:00:00Z", "version": "10.1.2731.0", }, ], "nics": [ { "mac_address": "000C29D7A627", "description": "Intel(R) 82574L Gigabit Network Connection #2", "ips": ["192.168.230.140"], }, { "mac_address": "000C29D7A631", "description": "Intel(R) 82574L Gigabit Network Connection", "ips": ["172.16.128.100"], }, ], "drives": [ { "freespace_available": 47086694400, "volume_label": "", "drive_format": "NTFS", "freespace_total": 47086694400, "name": "C:\\", "total_size": 64422408192, } ], "updates_installed": [{"installed_date": "2019-01-07T19:04:46Z", "title": "Update for Windows (KB2999226)"}], "domain_name": "", "culture": "en-US", "object_sid": "", "dhcp_scope_name": "", "time_zone": "Asia/Shanghai", "host_name": "WIN-TEN8D4FCOUB", "fully_qualified_host_name": "WIN-TEN8D4FCOUB", "object_guid": "", "plugin_version": "1.2.0.329", } MOCK_ENDPOINT_HOSTNAME_OUTPUT = { "Malwarebytes.Endpoint(val.Hostname == obj.Hostname)": { "Hostname": MOCK_ASSETS_RESPONSE["host_name"], "IPAddress": MOCK_ASSETS_RESPONSE["nics"], "Domain": MOCK_ASSETS_RESPONSE.get("domain_name"), "MACAddress": MOCK_ASSETS_RESPONSE["nics"][0]["mac_address"], "OS": MOCK_ASSETS_RESPONSE["os_info"]["os_platform"], "OSVersion": MOCK_ASSETS_RESPONSE["os_info"]["os_version"], "Model": MOCK_ASSETS_RESPONSE.get("computer_info", {}).get("model"), "Memory": MOCK_ASSETS_RESPONSE.get("memory"), "Assets": MOCK_ASSETS_RESPONSE, }, "Endpoint(val.Hostname == obj.Hostname)": { "Hostname": MOCK_ASSETS_RESPONSE["host_name"], "IPAddress": MOCK_ASSETS_RESPONSE["nics"][0]["ips"][0], "Domain": MOCK_ASSETS_RESPONSE.get("domain_name"), "MACAddress": MOCK_ASSETS_RESPONSE["nics"][0]["mac_address"], "OS": MOCK_ASSETS_RESPONSE["os_info"]["os_platform"], "OSVersion": MOCK_ASSETS_RESPONSE["os_info"]["os_version"], "Model": MOCK_ASSETS_RESPONSE.get("computer_info", {}).get("model"), "Memory": MOCK_ASSETS_RESPONSE.get("memory"), }, } # patch the API endpoint requests_mock.post(MOCK_ENDPOINTS, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.get(MOCK_ENDPOINTS + "/" + MOCK_ASSET_ID + "/assets", json=MOCK_ASSETS_RESPONSE) # patch the inputs mocker.patch.object(demisto, "args", return_value={"ip": MOCK_IP}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") list_endpoint_info(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert str(MOCK_ENDPOINT_HOSTNAME_OUTPUT) == str(outputs["EntryContext"]) def test_list_endpoint_info_hostname_indexerror(requests_mock, mocker): """ Given: - An endpoint identified by hostname with missing NIC data causing an IndexError. When: - Running the get endpoint info command. Then: - The command handles the IndexError gracefully and returns available info. """ MOCK_ASSET_ID = "8c9df179-a999-4ca2-9c41-9795ae0b08f5" MOCK_ASSETS_RESPONSE = { "startups": [ { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "Shell", "value": "explorer.exe", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "System", "value": "", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "Taskman", "value": "", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "Userinit", "value": "C:\\Windows\\system32\\userinit.exe,", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", "name": "VMware User Process", "value": '"C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe" -n vmusr', }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad", "name": "WebCheck", "value": "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}", }, {"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "name": "Authentication Packages"}, {"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "name": "Notification Packages"}, {"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "name": "Security Packages"}, { "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders", "name": "SecurityProviders", "value": "credssp.dll, pwdssp.dll", }, ], "os_info": { "os_platform": "Windows", "os_architecture": "Amd64", "os_version": "6.3.9600", "os_release_name": "Microsoft Windows Server 2012 R2 Standard", "os_type": "Server", }, "memory": { "total_virtual": 2549530624, "free_virtual": 765550592, "total_physical": 2147483648, "free_physical": 873046016, }, "computer_info": {"manufacturer": "VMware, Inc.", "model": "VMware Virtual Platform"}, "software_installed": [ { "vendor": "Microsoft Corporation", "product": "Microsoft Help Viewer 2.2", "installed_date": "2019-01-07T16:00:00Z", "version": "2.2.23107", }, { "vendor": "Malwarebytes", "product": "Malwarebytes Management Console", "installed_date": "2017-03-26T16:00:00Z", "version": "1.8.0.3431", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.1 SDK", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.51641", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148", "installed_date": "2016-12-04T16:00:00Z", "version": "9.0.30729.4148", }, { "vendor": "Microsoft Corporation", "product": "IIS 7.5 Express", "installed_date": "2016-12-04T16:00:00Z", "version": "7.5.1070", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2017 Policies ", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2014 Management Objects ", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.2000.8", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (ENU)", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.51209", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5 Multi-Targeting Pack", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.50710", }, { "vendor": "Malwarebytes", "product": "Malwarebytes Endpoint Agent", "installed_date": "2019-11-15T16:00:00Z", "version": "1.2.0.717", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.1 Multi-Targeting Pack", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.50932", }, { "vendor": "Microsoft Corporation", "product": "Microsoft System CLR Types for SQL Server 2014", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.2402.11", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23026.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.21005.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server Data-Tier Application Framework (x86)", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.4127.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server Management Studio - 17.9.1", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.17289.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual Studio Tools for Applications 2015", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23829", }, { "vendor": "Malwarebytes", "product": "Malwarebytes Management Server", "installed_date": "2017-03-26T16:00:00Z", "version": "1.8.0.3431", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.2 Multi-Targeting Pack", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.51209", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual Studio Tools for Applications 2015 Language Support", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23107.20", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server Browser", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.21005.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual Studio 2015 Shell (Isolated)", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23107.10", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU)", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.50932", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23026.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 R2 (64-bit)", "installed_date": "2016-12-05T16:00:00Z", "version": "", }, { "vendor": "VMware, Inc.", "product": "VMware Tools", "installed_date": "2016-12-04T16:00:00Z", "version": "10.0.10.4301679", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 R2 Native Client", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server VSS Writer", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2012 Native Client ", "installed_date": "2019-01-07T16:00:00Z", "version": "11.3.6540.0", }, { "vendor": "Microsoft Corporation", "product": "Active Directory Authentication Library for SQL Server", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161", "installed_date": "2016-12-04T16:00:00Z", "version": "9.0.30729.6161", }, { "vendor": "Malwarebytes", "product": "Malwarebytes version 3.8.4.2971", "installed_date": "2019-11-15T16:00:00Z", "version": "3.8.4.2971", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 R2 Setup (English)", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft ODBC Driver 13 for SQL Server", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft System CLR Types for SQL Server 2017", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2017 T-SQL Language Service ", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.17289.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 Setup Support Files ", "installed_date": "2016-12-05T16:00:00Z", "version": "10.1.2731.0", }, ], "nics": [], "drives": [ { "freespace_available": 47086694400, "volume_label": "", "drive_format": "NTFS", "freespace_total": 47086694400, "name": "C:\\", "total_size": 64422408192, } ], "updates_installed": [{"installed_date": "2019-01-07T19:04:46Z", "title": "Update for Windows (KB2999226)"}], "domain_name": "", "culture": "en-US", "object_sid": "", "dhcp_scope_name": "", "time_zone": "Asia/Shanghai", "host_name": "WIN-TEN8D4FCOUB", "fully_qualified_host_name": "WIN-TEN8D4FCOUB", "object_guid": "", "plugin_version": "1.2.0.329", } MOCK_ENDPOINT_HOSTNAME_OUTPUT = { "Malwarebytes.Endpoint(val.Hostname == obj.Hostname)": { "Hostname": MOCK_ASSETS_RESPONSE["host_name"], "IPAddress": MOCK_ASSETS_RESPONSE["nics"], "Domain": MOCK_ASSETS_RESPONSE.get("domain_name"), "MACAddress": None, "OS": MOCK_ASSETS_RESPONSE["os_info"]["os_platform"], "OSVersion": MOCK_ASSETS_RESPONSE["os_info"]["os_version"], "Model": MOCK_ASSETS_RESPONSE.get("computer_info", {}).get("model"), "Memory": MOCK_ASSETS_RESPONSE.get("memory"), "Assets": MOCK_ASSETS_RESPONSE, }, "Endpoint(val.Hostname == obj.Hostname)": { "Hostname": MOCK_ASSETS_RESPONSE["host_name"], "IPAddress": None, "Domain": MOCK_ASSETS_RESPONSE.get("domain_name"), "MACAddress": None, "OS": MOCK_ASSETS_RESPONSE["os_info"]["os_platform"], "OSVersion": MOCK_ASSETS_RESPONSE["os_info"]["os_version"], "Model": MOCK_ASSETS_RESPONSE.get("computer_info", {}).get("model"), "Memory": MOCK_ASSETS_RESPONSE.get("memory"), }, } # patch the API endpoint requests_mock.post(MOCK_ENDPOINTS, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.get(MOCK_ENDPOINTS + "/" + MOCK_ASSET_ID + "/assets", json=MOCK_ASSETS_RESPONSE) # patch the inputs mocker.patch.object(demisto, "args", return_value={"hostname": MOCK_HOSTNAME}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") list_endpoint_info(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert str(MOCK_ENDPOINT_HOSTNAME_OUTPUT) == str(outputs["EntryContext"]) def test_list_endpoint_info_ip_indexerror(requests_mock, mocker): """ Given: - An endpoint identified by IP with missing NIC data causing an IndexError. When: - Running the get endpoint info command. Then: - The command handles the IndexError gracefully and returns available info. """ MOCK_ASSET_ID = "8c9df179-a999-4ca2-9c41-9795ae0b08f5" MOCK_ASSETS_RESPONSE = { "startups": [ { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "Shell", "value": "explorer.exe", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "System", "value": "", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "Taskman", "value": "", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "name": "Userinit", "value": "C:\\Windows\\system32\\userinit.exe,", }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", "name": "VMware User Process", "value": '"C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe" -n vmusr', }, { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad", "name": "WebCheck", "value": "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}", }, {"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "name": "Authentication Packages"}, {"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "name": "Notification Packages"}, {"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "name": "Security Packages"}, { "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders", "name": "SecurityProviders", "value": "credssp.dll, pwdssp.dll", }, ], "os_info": { "os_platform": "Windows", "os_architecture": "Amd64", "os_version": "6.3.9600", "os_release_name": "Microsoft Windows Server 2012 R2 Standard", "os_type": "Server", }, "memory": { "total_virtual": 2549530624, "free_virtual": 765550592, "total_physical": 2147483648, "free_physical": 873046016, }, "computer_info": {"manufacturer": "VMware, Inc.", "model": "VMware Virtual Platform"}, "software_installed": [ { "vendor": "Microsoft Corporation", "product": "Microsoft Help Viewer 2.2", "installed_date": "2019-01-07T16:00:00Z", "version": "2.2.23107", }, { "vendor": "Malwarebytes", "product": "Malwarebytes Management Console", "installed_date": "2017-03-26T16:00:00Z", "version": "1.8.0.3431", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.1 SDK", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.51641", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148", "installed_date": "2016-12-04T16:00:00Z", "version": "9.0.30729.4148", }, { "vendor": "Microsoft Corporation", "product": "IIS 7.5 Express", "installed_date": "2016-12-04T16:00:00Z", "version": "7.5.1070", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2017 Policies ", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2014 Management Objects ", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.2000.8", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (ENU)", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.51209", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5 Multi-Targeting Pack", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.50710", }, { "vendor": "Malwarebytes", "product": "Malwarebytes Endpoint Agent", "installed_date": "2019-11-15T16:00:00Z", "version": "1.2.0.717", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.1 Multi-Targeting Pack", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.50932", }, { "vendor": "Microsoft Corporation", "product": "Microsoft System CLR Types for SQL Server 2014", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.2402.11", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23026.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.21005.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server Data-Tier Application Framework (x86)", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.4127.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server Management Studio - 17.9.1", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.17289.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual Studio Tools for Applications 2015", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23829", }, { "vendor": "Malwarebytes", "product": "Malwarebytes Management Server", "installed_date": "2017-03-26T16:00:00Z", "version": "1.8.0.3431", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.2 Multi-Targeting Pack", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.51209", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual Studio Tools for Applications 2015 Language Support", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23107.20", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server Browser", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005", "installed_date": "2019-01-07T16:00:00Z", "version": "12.0.21005.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual Studio 2015 Shell (Isolated)", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23107.10", }, { "vendor": "Microsoft Corporation", "product": "Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU)", "installed_date": "2019-01-07T16:00:00Z", "version": "4.5.50932", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.23026.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 R2 (64-bit)", "installed_date": "2016-12-05T16:00:00Z", "version": "", }, { "vendor": "VMware, Inc.", "product": "VMware Tools", "installed_date": "2016-12-04T16:00:00Z", "version": "10.0.10.4301679", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 R2 Native Client", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server VSS Writer", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2012 Native Client ", "installed_date": "2019-01-07T16:00:00Z", "version": "11.3.6540.0", }, { "vendor": "Microsoft Corporation", "product": "Active Directory Authentication Library for SQL Server", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161", "installed_date": "2016-12-04T16:00:00Z", "version": "9.0.30729.6161", }, { "vendor": "Malwarebytes", "product": "Malwarebytes version 3.8.4.2971", "installed_date": "2019-11-15T16:00:00Z", "version": "3.8.4.2971", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 R2 Setup (English)", "installed_date": "2016-12-05T16:00:00Z", "version": "10.50.1600.1", }, { "vendor": "Microsoft Corporation", "product": "Microsoft ODBC Driver 13 for SQL Server", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft System CLR Types for SQL Server 2017", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.1000.169", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2017 T-SQL Language Service ", "installed_date": "2019-01-07T16:00:00Z", "version": "14.0.17289.0", }, { "vendor": "Microsoft Corporation", "product": "Microsoft SQL Server 2008 Setup Support Files ", "installed_date": "2016-12-05T16:00:00Z", "version": "10.1.2731.0", }, ], "nics": [], "drives": [ { "freespace_available": 47086694400, "volume_label": "", "drive_format": "NTFS", "freespace_total": 47086694400, "name": "C:\\", "total_size": 64422408192, } ], "updates_installed": [{"installed_date": "2019-01-07T19:04:46Z", "title": "Update for Windows (KB2999226)"}], "domain_name": "", "culture": "en-US", "object_sid": "", "dhcp_scope_name": "", "time_zone": "Asia/Shanghai", "host_name": "WIN-TEN8D4FCOUB", "fully_qualified_host_name": "WIN-TEN8D4FCOUB", "object_guid": "", "plugin_version": "1.2.0.329", } MOCK_ENDPOINT_HOSTNAME_OUTPUT = { "Malwarebytes.Endpoint(val.Hostname == obj.Hostname)": { "Hostname": MOCK_ASSETS_RESPONSE["host_name"], "IPAddress": MOCK_ASSETS_RESPONSE["nics"], "Domain": MOCK_ASSETS_RESPONSE.get("domain_name"), "MACAddress": None, "OS": MOCK_ASSETS_RESPONSE["os_info"]["os_platform"], "OSVersion": MOCK_ASSETS_RESPONSE["os_info"]["os_version"], "Model": MOCK_ASSETS_RESPONSE.get("computer_info", {}).get("model"), "Memory": MOCK_ASSETS_RESPONSE.get("memory"), "Assets": MOCK_ASSETS_RESPONSE, }, "Endpoint(val.Hostname == obj.Hostname)": { "Hostname": MOCK_ASSETS_RESPONSE["host_name"], "IPAddress": None, "Domain": MOCK_ASSETS_RESPONSE.get("domain_name"), "MACAddress": None, "OS": MOCK_ASSETS_RESPONSE["os_info"]["os_platform"], "OSVersion": MOCK_ASSETS_RESPONSE["os_info"]["os_version"], "Model": MOCK_ASSETS_RESPONSE.get("computer_info", {}).get("model"), "Memory": MOCK_ASSETS_RESPONSE.get("memory"), }, } # patch the API endpoint requests_mock.post(MOCK_ENDPOINTS, json=MOCK_ENDPOINT_MACHINE_ID_RESP) requests_mock.get(MOCK_ENDPOINTS + "/" + MOCK_ASSET_ID + "/assets", json=MOCK_ASSETS_RESPONSE) # patch the inputs mocker.patch.object(demisto, "args", return_value={"ip": MOCK_IP}) # patch the outputs mocker.patch.object(demisto, "results") # run the code ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") list_endpoint_info(account_id, client_id, auth_token, ip, hostname, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert str(MOCK_ENDPOINT_HOSTNAME_OUTPUT) == str(outputs["EntryContext"]) def test_scan_detections_job_id(requests_mock, mocker): """ Given: - A completed scan job ID. When: - Running the get scan detections command. Then: - The detections found during the scan are returned. """ MOCK_ENDPOINT_DETECTION_OUTPUT = { "Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": { "Job_ID": MOCK_JOBS_JOB_ID, "Status": "COMPLETED", "Detections": MOCK_SCAN_DETECTIONS_CLEAR["detections"], } } # patch the API endpoint requests_mock.get(MOCK_ENDPOINTS_JOBS + "/jobs/" + MOCK_JOBS_JOB_ID, json=MOCK_GET_JOBS_DATA) requests_mock.get(MOCK_ENDPOINTS_JOBS + "/jobs/" + MOCK_JOBS_JOB_ID, json=MOCK_GET_JOBS_DATA) requests_mock.get(MOCK_ENDPOINTS_JOBS + "/jobs/" + MOCK_JOBS_JOB_ID, json=MOCK_GET_JOBS_DATA) requests_mock.get(MOCK_DETECTIONS_PATH, json=MOCK_SCAN_DETECTIONS) # patch the inputs mocker.patch.object(demisto, "args", return_value={"job_id": MOCK_JOBS_JOB_ID}) # patch the outputs mocker.patch.object(demisto, "results") # run the code job_id = demisto.args().get("job_id") scan_detections(account_id, client_id, auth_token, job_id, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_DETECTION_OUTPUT def test_scan_status_job_id(requests_mock, mocker): """ Given: - A scan job ID. When: - Running the get scan status command. Then: - The current status of the scan job is returned. """ MOCK_ENDPOINT_SCANSTATUS_OUTPUT = { "Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Job_ID": MOCK_JOBS_JOB_ID, "Status": "COMPLETED"} } # patch the API endpoint requests_mock.get(MOCK_ENDPOINTS_JOBS + "/jobs/" + MOCK_JOBS_JOB_ID, json=MOCK_GET_JOBS_DATA) # patch the inputs mocker.patch.object(demisto, "args", return_value={"job_id": MOCK_JOBS_JOB_ID}) # patch the outputs mocker.patch.object(demisto, "results") # run the code job_id = demisto.args().get("job_id") scan_status(account_id, client_id, auth_token, job_id, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_ENDPOINT_SCANSTATUS_OUTPUT def test_fetch_incidents_epr(requests_mock, mocker): """ Given: - The integration is configured to fetch Suspicious Activity (EPR) incidents. When: - Running the fetch incidents flow. Then: - Suspicious activity incidents are created correctly. """ # patch the API endpoint requests_mock.get(MOCK_SA_ENDPOINT, json=MOCK_SA_DATA) # patch the inputs mocker.patch.object( demisto, "args", return_value={"Fetch_Event_List": MOCK_SA_CHOICE, "suspicious_activity_severity": "High"} ) # patch the outputs mocker.patch.object(demisto, "results") # run the code event_list = demisto.params().get("Fetch_Event_List") fetch_incidents(account_id, client_id, auth_token, event_list, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["Contents"] == "[]" def test_fetch_incidents_ep(requests_mock, mocker): """ Given: - The integration is configured to fetch RTP Detections (EP) incidents. When: - Running the fetch incidents flow. Then: - RTP detection incidents are created correctly. """ # patch the API endpoint requests_mock.post(MOCK_RTP_ENDPOINT, json=MOCK_RTP_DETECTIONS_DATA) # patch the inputs mocker.patch.object(demisto, "args", return_value={"Fetch_Event_List": MOCK_RTP_CHOICE, "rtp_threat_category": "Malware"}) # patch the outputs mocker.patch.object(demisto, "results") # run the code event_list = demisto.params().get("Fetch_Event_List") fetch_incidents(account_id, client_id, auth_token, event_list, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["Contents"] == "[]" def test_open_sa_incident(requests_mock, mocker): """ Given: - A suspicious activity detection ID and machine ID. When: - Running the open SA incident command. Then: - The SA incident is opened successfully. """ MOCK_OPEN = MOCK_ENDPOINTS + "/" + MOCK_SA_MACHINE_ID + "/sa/" + MOCK_SA_DETECTION_ID + "/open" MOCK_OPEN_OUTPUT = {"Malwarebytes.SA(val.Machine_ID == obj.Machine_ID)": {"Machine_ID": MOCK_SA_MACHINE_ID}} # patch the API endpoint requests_mock.put(MOCK_OPEN, json={}, status_code=201) # path the inputs mocker.patch.object(demisto, "args", return_value={"machine_id": MOCK_SA_MACHINE_ID, "detection_id": MOCK_SA_DETECTION_ID}) # patch the outputs mocker.patch.object(demisto, "results") # run the code machine_id = demisto.args().get("machine_id") detection_id = demisto.args().get("detection_id") open_sa_incident(account_id, client_id, auth_token, machine_id, detection_id, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_OPEN_OUTPUT def test_remediate_sa_incident(requests_mock, mocker): """ Given: - A suspicious activity detection ID and machine ID. When: - Running the remediate SA incident command. Then: - The SA incident remediation is initiated successfully. """ MOCK_REMEDIATE = MOCK_ENDPOINTS + "/" + MOCK_SA_MACHINE_ID + "/sa/" + MOCK_SA_DETECTION_ID + "/remediate" MOCK_REMEDIATE_OUTPUT = {"Malwarebytes.SA(val.Machine_ID == obj.Machine_ID)": {"Machine_ID": MOCK_SA_MACHINE_ID}} # patch the API endpoint requests_mock.post(MOCK_REMEDIATE, json={}, status_code=201) # path the inputs mocker.patch.object(demisto, "args", return_value={"machine_id": MOCK_SA_MACHINE_ID, "detection_id": MOCK_SA_DETECTION_ID}) # patch the outputs mocker.patch.object(demisto, "results") # run the code machine_id = demisto.args().get("machine_id") detection_id = demisto.args().get("detection_id") remediate_sa_incident(account_id, client_id, auth_token, machine_id, detection_id, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_REMEDIATE_OUTPUT def test_close_sa_incident(requests_mock, mocker): """ Given: - A suspicious activity detection ID and machine ID. When: - Running the close SA incident command. Then: - The SA incident is closed successfully. """ MOCK_CLOSE = MOCK_ENDPOINTS + "/" + MOCK_SA_MACHINE_ID + "/sa/" + MOCK_SA_DETECTION_ID + "/close" MOCK_CLOSE_OUTPUT = {"Malwarebytes.SA(val.Machine_ID == obj.Machine_ID)": {"Machine_ID": MOCK_SA_MACHINE_ID}} # patch the API endpoint requests_mock.put(MOCK_CLOSE, json={}, status_code=201) # path the inputs mocker.patch.object(demisto, "args", return_value={"machine_id": MOCK_SA_MACHINE_ID, "detection_id": MOCK_SA_DETECTION_ID}) # patch the outputs mocker.patch.object(demisto, "results") # run the code machine_id = demisto.args().get("machine_id") detection_id = demisto.args().get("detection_id") close_sa_incident(account_id, client_id, auth_token, machine_id, detection_id, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_CLOSE_OUTPUT def test_get_sa_activities_command_hostname(requests_mock, mocker): """ Given: - A hostname to filter suspicious activities. When: - Running the get SA activities command. Then: - Suspicious activities matching the hostname are returned. """ MOCK_SA_OUTPUT = { "Malwarebytes.Endpoint(val.Suspicious_Activities == obj.Suspicious_Activities)": { "Suspicious_Activities": MOCK_SA_DATA["sa"] } } # patch the API endpoint requests_mock.get(MOCK_SA_ENDPOINT, json=MOCK_SA_DATA) # path the inputs mocker.patch.object(demisto, "args", return_value={"hostname": "DESKTOP-664HFM6"}) # patch the outputs mocker.patch.object(demisto, "results") # run the code hostname = demisto.args().get("hostname") path = demisto.args().get("path") get_sa_activities_command(account_id, client_id, auth_token, hostname, path, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_SA_OUTPUT def test_get_sa_activities_command_path(requests_mock, mocker): """ Given: - A file path to filter suspicious activities. When: - Running the get SA activities command. Then: - Suspicious activities matching the path are returned. """ MOCK_SA_OUTPUT = { "Malwarebytes.Endpoint(val.Suspicious_Activities == obj.Suspicious_Activities)": { "Suspicious_Activities": MOCK_SA_DATA["sa"] } } # patch the API endpoint requests_mock.get(MOCK_SA_ENDPOINT, json=MOCK_SA_DATA) # path the inputs mocker.patch.object( demisto, "args", return_value={"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\MA2EZOX5\\EKATI5862.EXE"} ) # patch the outputs mocker.patch.object(demisto, "results") # run the code hostname = demisto.args().get("hostname") path = demisto.args().get("path") get_sa_activities_command(account_id, client_id, auth_token, hostname, path, USE_SSL) # assert the outputs assert demisto.results.call_count == 1 outputs = demisto.results.call_args[0][0] assert outputs["EntryContext"] == MOCK_SA_OUTPUT # --------------------------------------------------------------------------- # Region support tests # --------------------------------------------------------------------------- US_URL = "https://cloud.threatdown.com" EU_URL = "https://cloud.euc1.threatdown.com" def test_region_urls_mapping(): """ Given: - The REGION_URLS mapping used to resolve the API base URL per region. When: - Looking up the US and EU regions. Then: - Each region resolves to the expected ThreatDown Nebula base URL. """ assert REGION_URLS["US"] == US_URL assert REGION_URLS["EU"] == EU_URL def test_nebula_url_uses_global_url(mocker): """ Given: - The module-level URL is set to a specific region's base URL. When: - Building a path with nebula_url(). Then: - The returned URL is prefixed with the currently configured base URL. """ mocker.patch.object(Malwarebytes, "URL", US_URL) assert nebula_url("/oauth2/token") == f"{US_URL}/oauth2/token" mocker.patch.object(Malwarebytes, "URL", EU_URL) assert nebula_url("/oauth2/token") == f"{EU_URL}/oauth2/token" def test_main_sets_eu_url_for_region(mocker): """ Given: - The integration is configured with the EU region. When: - main() runs. Then: - The module-level URL is set to the EU base URL so all API calls target EU. """ mocker.patch.object( demisto, "params", return_value={ "accountid": account_id, "clientid": client_id, "clientsecret": "secret", "region": "EU", "insecure": False, }, ) mocker.patch.object(demisto, "command", return_value="test-module") mocker.patch.object(demisto, "results") mocker.patch.object(Malwarebytes, "get_token", return_value=auth_token) mocker.patch.object(Malwarebytes, "handle_proxy") mocker.patch.object(Malwarebytes, "send_usage_data") mocker.patch.object(Malwarebytes, "test_connectivity", return_value=True) main() assert Malwarebytes.URL == EU_URL def test_main_defaults_to_us_when_region_missing(mocker): """ Given: - The integration is configured without a region (backward compatibility). When: - main() runs. Then: - The module-level URL defaults to the US base URL. """ mocker.patch.object( demisto, "params", return_value={ "accountid": account_id, "clientid": client_id, "clientsecret": "secret", "insecure": False, }, ) mocker.patch.object(demisto, "command", return_value="test-module") mocker.patch.object(demisto, "results") mocker.patch.object(Malwarebytes, "get_token", return_value=auth_token) mocker.patch.object(Malwarebytes, "handle_proxy") mocker.patch.object(Malwarebytes, "send_usage_data") mocker.patch.object(Malwarebytes, "test_connectivity", return_value=True) main() assert Malwarebytes.URL == US_URL def test_main_eu_region_targets_eu_host(requests_mock, mocker): """ Given: - The integration is configured with the EU region. When: - main() runs the test-module command which calls the endpoints API. Then: - The outbound API request is made against the EU host. """ eu_endpoints = f"{EU_URL}/api/v2/endpoints" adapter = requests_mock.get(eu_endpoints, json={"machines": [], "next_cursor": "", "total_count": 0}) mocker.patch.object( demisto, "params", return_value={ "accountid": account_id, "clientid": client_id, "clientsecret": "secret", "region": "EU", "insecure": False, }, ) mocker.patch.object(demisto, "command", return_value="test-module") mocker.patch.object(demisto, "results") mocker.patch.object(Malwarebytes, "get_token", return_value=auth_token) mocker.patch.object(Malwarebytes, "handle_proxy") mocker.patch.object(Malwarebytes, "send_usage_data") main() assert adapter.called assert adapter.last_request.url.startswith(EU_URL)