Symantec Advanced Threat Protection Deprecated

Deprecated. No available replacement.

Endpoint · Symantec Advanced Threat Protection (Deprecated)

Details

IDSymantec Advanced Threat Protection
ProviderBroadcom
CategoryEndpoint
From Version5.0.0
Supported ModulesAgentix

README

Advanced protection capabilities from Symantec
This integration was integrated and tested with Symantec Advanced Threat Protection v3.0.

Configure Symantec Advanced Threat Protection in Cortex

Parameter Description Required
Server URL (i.e. https://host:port)   True
Client ID as generated in the ATP console   True
Password   True
Trust any certificate (not secure) Trust any certificate (not secure). False
Use system proxy settings Use system proxy settings. False
Incident data source   False
Maximum number of events per fetch.   False
Fetch incidents   False
Incident type   False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days). Maximum is 30 days.   False
Query string for fetch incidents. For example - “updated>=’2020-06-06T15:39:55.616Z’ and updated<‘2020-08-07T00:00:00.000Z’ “   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

satp-appliances

Retrieve the appliances configured with the versions

Base Command

satp-appliances

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
ATPAppliance.appliance_id unknown ID of the ATP appliance
ATPAppliance.appliance_name unknown Name of the ATP appliance
ATPAppliance.software_version unknown Version of the ATP appliance
ATPAppliance.appliance_time unknown Current time on the appliance in UTC
ATPAppliance.role unknown The roles of the appliance

Command Example

!satp-appliances

Human Readable Output

appliance_id appliance_name appliance_time software_version role
56123234-132F-123344-C8EF-1234 test-atd 2021-11-11T05:52:20.063Z 3.0.0-123 endpoint, network scanner, management

satp-command

Issue commands to endpoints managed by Symantec Endpoint Protection

Base Command

satp-command

Input

Argument Name Description Required
action The action to perform on the endpoints. Possible values are: isolate_endpoint, rejoin_endpoint, delete_endpoint_file. Required
targets For isolate and rejoin a list of endpoint ids (array or comma-separated). For delete, array of objects, each with hash and device_uid attributes (supports comma-delimited hash:uid,hash:uid as well). Required

Context Output

Path Type Description
ATPCommand.ID unknown The ID of the executing command
ATPCommand.Action unknown The requested action for the command

Command Example

!satp-command action=isolate_endpoint targets="123e4567-e89b-12d3-a456-426614174000"

Human Readable Output

ID Action
56123234-132F-123344-C8EF-1234 isolate_endpoint

satp-command-state

Retrieve the command state

Base Command

satp-command-state

Input

Argument Name Description Required
command The command ID to retrieve state for. Required

Context Output

Path Type Description
ATPCommand.ID unknown The ID of the executing command
ATPCommand.Action unknown The requested action for the command
ATPCommand.Status.target unknown The target for the state
ATPCommand.Status.state unknown The state of the command
ATPCommand.Status.error_code unknown Error code for the target
ATPCommand.Status.message unknown Message for the target

Command Example

!satp-command-state command="command_id""

Human Readable Output

Symantec ATP Command ID: command_id

ID Action
command_id command_name

satp-command-cancel

Cancel the given command

Base Command

satp-command-cancel

Input

Argument Name Description Required
command The command ID to cancel. Required

Context Output

Path Type Description
ATPCommand.ID unknown The ID of the executing command
ATPCommand.ErrorCode unknown Error code for cancelling - 0 if successful
ATPCommand.Message unknown Message for the cancellation

Command Example

!satp-command-cancel command=command_id

Symantec ATP Command Cancel

Symantec ATP Command ID: command_id

ID Action ErrorCode Message
command_id command_name 0 Message for the cancellation

satp-events

Accepts search requests over a specified time range and returns events that match the search condition. You must specify the time range using the start_time parameter and the end_time parameter (the maximum time range is 7 days). The time in the result schema and is typically the event creation time. This API supports search conditions (such as logical operators and special characters) to narrow the events to be retrieved. See examples at https://help.symantec.com/api-doc/atp_2.2/EN_US/#_events_query_api_example.

Base Command

satp-events

Input

Argument Name Description Required
query Specifies a search condition. See full details at https://help.symantec.com/api-doc/atp_2.2/EN_US/#_eventqueryrequest. Optional
start_time ISO8601 date format - 2017-01-01T00:00:00.000Z. Also accepts milliseconds since epoch. Optional
end_time ISO8601 date format - 2017-01-01T00:00:00.000Z. Also accepts milliseconds since epoch. Optional
limit Maximum number of events to return. Default is 100 and max is 1000. Default is 100. Optional
next Used for events cursoring. Retrieve the next batch of events. Optional

Context Output

Path Type Description
ATPEvents.Total unknown Total number of results
ATPEvents.Next unknown Next batch ID
ATPEvents.Result.type_id unknown The unique identifier for an event type.
ATPEvents.Result.uuid unknown The unique id for this event
ATPEvents.Result.message unknown Human-readable event message or description of the event
ATPEvents.Result.severity_id unknown Severity between 1 (info) and 6 (fatal).
ATPEvents.Result.device_time unknown The timestamp (in ISO 8601 format) that specifies the time at which the event occurred.
ATPEvents.Result.device_uid unknown Unique ID of the device that originated the event.
ATPEvents.Result.device_name unknown The device name (i.e., the name of the endpoint or appliance associated with an event).
ATPEvents.Result.device_ip unknown The IPv6 or IPv4 address of the device that originated the event.
ATPEvents.Result.device_type unknown The type of the device that originated the event.
ATPEvents.Result.device_os_name unknown The operating system running on the device_type that originated the event.
ATPEvents.Result.device_os_ver unknown The version of the operating system that is running on the device_type that originated the event.
ATPEvents.Result.user_uid unknown Unique ID of the user that originated the event or the user on whose behalf the event occurred.
ATPEvents.Result.user_name unknown The user name or ID that originated or caused the event.
ATPEvents.Result.action_id unknown Action taken with respect to the underlying cause of the event. Possible values are: 0 = BLOCK 1 = MONITOR
ATPEvents.Result.internal_hostname unknown The host name of the internal device/machine for the connection
ATPEvents.Result.scanner_name unknown The name of the ATP scanner that generated this event
ATPEvents.Result.internal_ip unknown The IP address of the internal device/machine for the connection
ATPEvents.Result.internal_port unknown The port number identified as the source port in traffic sent to the target device
ATPEvents.Result.external_ip unknown The IP address of the device/machine that accepted the connection
ATPEvents.Result.external_port unknown The port number identified as the target port in traffic sent to the target device
ATPEvents.Result.data_source_url unknown The URL that the traffic came from
ATPEvents.Result.data_source_url_domain unknown The domain from which the file was downloaded. The domain is extracted from the URL for the query performance.
ATPEvents.Result.data_source_url_referer unknown The referer URL used in the download
ATPEvents.Result.sep_installed unknown Indicates whether SEP was installed when the event was generated
ATPEvents.Result.data_direction unknown The direction of the data source. Possible values are: 1 = Inbound. Traffic flow from WAN to LAN. 2 = Outbound. Traffic flow from LAN to WAN.
ATPEvents.Result.network_scanner_type unknown The type of network scanner that detected the event. Possible values are: 0 = ATP-N Scanner (default) 1 = WSS .cloud Scanner
ATPEvents.Result.vlan_id unknown Indicates the VLAN ID (between 0 and 4095) on which the endpoint is deployed. If the value is 0 or missing, the endpoint is deployed in a non-VLAN setup
ATPEvents.Result.device_end_time unknown The end time of an event (in format yyyy-MM-dd’T’HH:mm:ss.SSSZ). This is used with the aggregation count field.
ATPEvents.Result.host_name unknown The host name of the client computer
ATPEvents.Result.domain_name unknown The domain name of the client computer
ATPEvents.Result.data_source_ip unknown The source IP address that the file came from (either IPv4 or IPv6).
ATPEvents.Result.target_ip unknown The local (victim) IP address (IPv4 or IPv6)
ATPEvents.Result.target_port unknown The local (victim) port number
ATPEvents.Result.source_ip unknown The remote IP address (IPv4 or IPv6).
ATPEvents.Result.source_port unknown The remote port number
ATPEvents.Result.parent_file_sha2 unknown The SHA256 of the parent file
ATPEvents.Result.reason unknown This field is overloaded and has following possible interpretations (depending on the corresponding type_id). For type_id 4118, it specifies the Blacklist hash function that was used to identify the file. This field has following possible values: 0 = BY_FILE_BLACKLIST_SHA2 1 = BY_FILE_BLACKLIST_MD5 For type_id 4112, it specifies the Blacklist criteria that identify the traffic. This field has following possible values: 0 = BY_SOURCE_IP 1 = BY_DEST_IP 2 = BY_DEST_URL
ATPEvents.Result.manual_submit unknown Indicates whether the file was manually submitted for analysis
ATPEvents.Result.signature_id unknown The NDC signature ID.
ATPEvents.Result.signature_name unknown The name of the signature
ATPEvents.Result.categories unknown A list of categories an intrusion event may belong to
ATPEvents.Result.intrusion_url unknown The URL from where a malicious script was loaded
ATPEvents.Result.infected unknown Indicates whether the customer machine is infected
ATPEvents.Result.count unknown Event aggregation count
ATPEvents.Result.severity unknown The seriousness of the event. 0 indicates most serious.
ATPEvents.Result.local_host_mac unknown The MAC address of the local computer
ATPEvents.Result.remote_host_mac unknown The MAC address of the remote computer
ATPEvents.Result.app_name unknown The full path of the application involved
ATPEvents.Result.event_desc unknown A description of the event. Usually, the first line of the description is treated as summary
ATPEvents.Result.network_protocol unknown Network protocol as reported by SEP. Possible values are: 1 = Other 2 = TCP 3 = UDP 4 = ICMP
ATPEvents.Result.source unknown This field is overloaded and has possible interpretations (depending on the corresponding type_id).
ATPEvents.Result.no_of_viruses unknown The number of events for the aggregated event record. This number can be due to client-side aggregation, server-side compression, or both
ATPEvents.Result.actual_action_idx unknown This is the ID of action taken on the risk
ATPEvents.Result.actual_action unknown This is the string version of the action taken on the risk (in actual_action_idx).
ATPEvents.Result.virus_name unknown Name of the virus
ATPEvents.Result.virus_def unknown The virus definition version number
ATPEvents.Result.agent_version unknown The version of the client software
ATPEvents.Result.MessageId unknown The unique ID of the email message
ATPEvents.Result.OrigMessageHeaderId unknown The message header ID
ATPEvents.Result.EmailReceivedDate unknown The time when the mail transfer agent received the email. The format is: yyyy-MM-dd’T’HH:mm:ss.SSSZ
ATPEvents.Result.EmailSubject unknown Email subject
ATPEvents.Result.EmailAction unknown The action executed on the email. Possible values are: - blocked - delivered - released
ATPEvents.Result.Direction unknown Indication direction of the email. Possible values are: 0 = Outbound 1 = Inbound
ATPEvents.Result.incident unknown The unique ID of the incident that is related to this event
ATPEvents.Result.event_id unknown The event ID as reported by Symantec Endpoint Protection security log
ATPEvents.Result.file unknown The file object
ATPEvents.Result.threat unknown The threat object
ATPEvents.Result.av unknown The AV object
ATPEvents.Result.cynic unknown Cynic object
ATPEvents.Result.scan unknown Scan object
ATPEvents.Result.bash unknown Bash object
ATPEvents.Result.Sender unknown Email sender object
ATPEvents.Result.Receivers unknown Email receivers array of objects
ATPEvents.Result.intrusion unknown Intrusion object

Command Example

!satp-events

Human Readable Output

satp-files

Retrieve details about file based on given hash

Base Command

satp-files

Input

Argument Name Description Required
hash Hash of the file. Supports either SHA256 or MD5. Required

Context Output

Path Type Description
File.MD5 unknown File MD5
File.SHA256 unknown File SHA256
File.Instances.name unknown Name of file
File.Instances.path unknown Path of file
File.Type unknown MIME type of the file
File.Size unknown Size of file in bytes
File.SignatureCompany unknown The company that signed the file
File.SignatureIssuer unknown The signature issuer
File.Age unknown A code between 1 and 4 representing the file’s global age defined by the time the file was first reported to Symantec. This data is collected from telemetry sent to Symantec by in-field endpoint clients like Symantec Endpoint Protection and Norton. Possible values are: 1 = Years ago 2 = Months ago 3 = Weeks ago 4 = Days ago
File.Threat unknown Name of the threat if the file is determined to be a malware
File.Cynic unknown A code between 0 and 2 representing the verdict given by Symantec’s Cynic sandbox analysis. Possible values are: 0 = Malware 1 = Good 2 = Unknown
File.TargetedAttack unknown A flag that indicates whether this file is a part of targeted attack launched against an organization
File.ReputationBand unknown A code between 1 and 6 representing the file’s reputation. This data is generated by Symantec’s analysis engines based on the telemetry sent to Symantec by in-field endpoint clients like Symantec Endpoint Protection and Norton. Possible values are: 1 = Symantec-trusted 2 = Good 3 = Trending Good 4 = Unproven 5 = Poor 6 = Untrusted
File.PrevalenceBand unknown A code between 1 and 8 representing the file’s prevalence. This data is collected from telemetry sent to Symantec by in-field endpoint clients like Symantec Endpoint Protection and Norton. Possible values are: 1 = Fewer than 5 users 2 = Fewer than 50 users 3 = Fewer than 100 users 4 = Hundreds of users 5 = Thousands of users 6 = Tens of thousands of users 7 = Hundreds of thousands of users 8 = Millions of users
File.Health unknown A code between 0 and 3 representing the file’s health. Possible values are: 0 = Good 1 = Neutral 2 = Suspicious 3 = Bad 4 = Analyzing

Command Example

!satp-events

Human Readable Output

Symantec ATP Events

data_direction data_source_ip data_source_url data_source_url_domain device_ip device_name device_time device_uid external_ip file log_name log_time sep_installed type_id uuid
inbound 62.324.344.170 path_to_source test.123 1234.1234.1234.1234 1234.1234.1234.1234 2021-11-10T23:42:15.779Z 712da396-2dc6-44a9-bb8f-e1234124 1234.1234.1234.1234 {“sha2”:”b75aa777”,”md5”:”4c2e3”,”name”:”AM_Delta.exe”,”folder”:”CSIDL_WINDOWS\”,”size”:2413000,”signature_company_name”:”test”,”signature_issuer”:”test”,”signature_serial_number”:”1234”,”reputation_band”:1344,”prevalence_band”:04354} test 2021-11-10T23:42:16.706Z true 4096 345345-427f-11ec-345345-4t4554

satp-incident-events

Get events that are related to incidents

Base Command

satp-incident-events

Input

Argument Name Description Required
query Specifies a search condition. Optional
start_time ISO8601 date format - 2017-01-01T00:00:00.000Z. Also accepts milliseconds since epoch. Optional
end_time ISO8601 date format - 2017-01-01T00:00:00.000Z. Also accepts milliseconds since epoch. Optional
limit Maximum number of events to return. Default is 20 and max is 1000. Default is 20. Optional
next Used for events cursoring. Retrieve the next batch of events. Optional

Context Output

Path Type Description
ATPIncidentEvents.Total unknown Total number of results
ATPIncidentEvents.Next unknown Next batch ID
ATPIncidentEvents.Result.type_id unknown The unique identifier for an event type.
ATPIncidentEvents.Result.uuid unknown The unique id for this event
ATPIncidentEvents.Result.message unknown Human-readable event message or description of the event
ATPIncidentEvents.Result.severity_id unknown Severity between 1 (info) and 6 (fatal).
ATPIncidentEvents.Result.device_time unknown The timestamp (in ISO 8601 format) that specifies the time at which the event occurred.
ATPIncidentEvents.Result.device_uid unknown Unique ID of the device that originated the event.
ATPIncidentEvents.Result.device_name unknown The device name (i.e., the name of the endpoint or appliance associated with an event).
ATPIncidentEvents.Result.device_ip unknown The IPv6 or IPv4 address of the device that originated the event.
ATPIncidentEvents.Result.device_type unknown The type of the device that originated the event.
ATPIncidentEvents.Result.device_os_name unknown The operating system running on the device_type that originated the event.
ATPIncidentEvents.Result.device_os_ver unknown The version of the operating system that is running on the device_type that originated the event.
ATPIncidentEvents.Result.user_uid unknown Unique ID of the user that originated the event or the user on whose behalf the event occurred.
ATPIncidentEvents.Result.user_name unknown The user name or ID that originated or caused the event.
ATPIncidentEvents.Result.action_id unknown Action taken with respect to the underlying cause of the event. Possible values are: 0 = BLOCK 1 = MONITOR
ATPIncidentEvents.Result.internal_hostname unknown The host name of the internal device/machine for the connection
ATPIncidentEvents.Result.scanner_name unknown The name of the ATP scanner that generated this event
ATPIncidentEvents.Result.internal_ip unknown The IP address of the internal device/machine for the connection
ATPIncidentEvents.Result.internal_port unknown The port number identified as the source port in traffic sent to the target device
ATPIncidentEvents.Result.external_ip unknown The IP address of the device/machine that accepted the connection
ATPIncidentEvents.Result.external_port unknown The port number identified as the target port in traffic sent to the target device
ATPIncidentEvents.Result.data_source_url unknown The URL that the traffic came from
ATPIncidentEvents.Result.data_source_url_domain unknown The domain from which the file was downloaded. The domain is extracted from the URL for the query performance.
ATPIncidentEvents.Result.data_source_url_referer unknown The referer URL used in the download
ATPIncidentEvents.Result.sep_installed unknown Indicates whether SEP was installed when the event was generated
ATPIncidentEvents.Result.data_direction unknown The direction of the data source. Possible values are: 1 = Inbound. Traffic flow from WAN to LAN. 2 = Outbound. Traffic flow from LAN to WAN.
ATPIncidentEvents.Result.network_scanner_type unknown The type of network scanner that detected the event. Possible values are: 0 = ATP-N Scanner (default) 1 = WSS .cloud Scanner
ATPIncidentEvents.Result.vlan_id unknown Indicates the VLAN ID (between 0 and 4095) on which the endpoint is deployed. If the value is 0 or missing, the endpoint is deployed in a non-VLAN setup
ATPIncidentEvents.Result.device_end_time unknown The end time of an event (in format yyyy-MM-dd’T’HH:mm:ss.SSSZ). This is used with the aggregation count field.
ATPIncidentEvents.Result.host_name unknown The host name of the client computer
ATPIncidentEvents.Result.domain_name unknown The domain name of the client computer
ATPIncidentEvents.Result.data_source_ip unknown The source IP address that the file came from (either IPv4 or IPv6).
ATPIncidentEvents.Result.target_ip unknown The local (victim) IP address (IPv4 or IPv6)
ATPIncidentEvents.Result.target_port unknown The local (victim) port number
ATPIncidentEvents.Result.source_ip unknown The remote IP address (IPv4 or IPv6).
ATPIncidentEvents.Result.source_port unknown The remote port number
ATPIncidentEvents.Result.parent_file_sha2 unknown The SHA256 of the parent file
ATPIncidentEvents.Result.reason unknown This field is overloaded and has following possible interpretations (depending on the corresponding type_id). For type_id 4118, it specifies the Blacklist hash function that was used to identify the file. This field has following possible values: 0 = BY_FILE_BLACKLIST_SHA2 1 = BY_FILE_BLACKLIST_MD5 For type_id 4112, it specifies the Blacklist criteria that identify the traffic. This field has following possible values: 0 = BY_SOURCE_IP 1 = BY_DEST_IP 2 = BY_DEST_URL
ATPIncidentEvents.Result.manual_submit unknown Indicates whether the file was manually submitted for analysis
ATPIncidentEvents.Result.signature_id unknown The NDC signature ID.
ATPIncidentEvents.Result.signature_name unknown The name of the signature
ATPIncidentEvents.Result.categories unknown A list of categories an intrusion event may belong to
ATPIncidentEvents.Result.intrusion_url unknown The URL from where a malicious script was loaded
ATPIncidentEvents.Result.infected unknown Indicates whether the customer machine is infected
ATPIncidentEvents.Result.count unknown Event aggregation count
ATPIncidentEvents.Result.severity unknown The seriousness of the event. 0 indicates most serious.
ATPIncidentEvents.Result.local_host_mac unknown The MAC address of the local computer
ATPIncidentEvents.Result.remote_host_mac unknown The MAC address of the remote computer
ATPIncidentEvents.Result.app_name unknown The full path of the application involved
ATPIncidentEvents.Result.event_desc unknown A description of the event. Usually, the first line of the description is treated as summary
ATPIncidentEvents.Result.network_protocol unknown Network protocol as reported by SEP. Possible values are: 1 = Other 2 = TCP 3 = UDP 4 = ICMP
ATPIncidentEvents.Result.source unknown This field is overloaded and has possible interpretations (depending on the corresponding type_id).
ATPIncidentEvents.Result.no_of_viruses unknown The number of events for the aggregated event record. This number can be due to client-side aggregation, server-side compression, or both
ATPIncidentEvents.Result.actual_action_idx unknown This is the ID of action taken on the risk
ATPIncidentEvents.Result.actual_action unknown This is the string version of the action taken on the risk (in actual_action_idx).
ATPIncidentEvents.Result.virus_name unknown Name of the virus
ATPIncidentEvents.Result.virus_def unknown The virus definition version number
ATPIncidentEvents.Result.agent_version unknown The version of the client software
ATPIncidentEvents.Result.MessageId unknown The unique ID of the email message
ATPIncidentEvents.Result.OrigMessageHeaderId unknown The message header ID
ATPIncidentEvents.Result.EmailReceivedDate unknown The time when the mail transfer agent received the email. The format is: yyyy-MM-dd’T’HH:mm:ss.SSSZ
ATPIncidentEvents.Result.EmailSubject unknown Email subject
ATPIncidentEvents.Result.EmailAction unknown The action executed on the email. Possible values are: - blocked - delivered - released
ATPIncidentEvents.Result.Direction unknown Indication direction of the email. Possible values are: 0 = Outbound 1 = Inbound
ATPIncidentEvents.Result.incident unknown The unique ID of the incident that is related to this event
ATPIncidentEvents.Result.event_id unknown The event ID as reported by Symantec Endpoint Protection security log
ATPIncidentEvents.Result.file unknown The file object
ATPIncidentEvents.Result.threat unknown The threat object
ATPIncidentEvents.Result.av unknown The AV object
ATPIncidentEvents.Result.cynic unknown Cynic object
ATPIncidentEvents.Result.scan unknown Scan object
ATPIncidentEvents.Result.bash unknown Bash object
ATPIncidentEvents.Result.Sender unknown Email sender object
ATPIncidentEvents.Result.Receivers unknown Email receivers array of objects
ATPIncidentEvents.Result.intrusion unknown Intrusion object

Command Example

!satp-incident-events

satp-incidents

Query incidents from ATP

Base Command

satp-incidents

Input

Argument Name Description Required
query Specifies a search condition. Optional
start_time ISO8601 date format - 2017-01-01T00:00:00.000Z. Also accepts milliseconds since epoch. Optional
end_time ISO8601 date format - 2017-01-01T00:00:00.000Z. Also accepts milliseconds since epoch. Optional
limit Maximum number of events to return. Default is 20 and max is 1000. Default is 20. Optional
next Used for events cursoring. Retrieve the next batch of events. Optional

Context Output

Path Type Description
ATPIncidents.Result.atp_incident_id unknown A unique identifier for this incident
ATPIncidents.Result.priority_level unknown Priority level of the incident. 1 = LOW, 2 = MED, 3 = HIGH
ATPIncidents.Result.state unknown The state of the incident. 1 = OPEN,2 = WAITING,3 = IN_WORK,4 = CLOSED
ATPIncidents.Result.recommended_action unknown Recommended action for this incident
ATPIncidents.Result.first_event_seen unknown When the first event associated with the incident was created
ATPIncidents.Result.last_event_seen unknown When the last event associated with the incident was created
ATPIncidents.Result.event_count unknown The number of events associated with the incident
ATPIncidents.Result.device_time unknown The timestamp that specifies the time at which the event occurred
ATPIncidents.Result.deviceUid unknown A list of ATP endpoint devices UID on which the events occurred
ATPIncidents.Result.scanners unknown A list of ATP scanners that discovered the threat
ATPIncidents.Result.filehash unknown A list of SHA256 hashes associated with this incident
ATPIncidents.Result.domainid unknown A list of domains associated with this incident
ATPIncidents.Result.summary unknown Summary information about the incident
ATPIncidents.Result.time unknown The creation time (in ISO 8601 format) of the incident
ATPIncidents.Result.updated unknown The time (in ISO 8601 format) of last modification
ATPIncidents.Result.log_name unknown The index/type of the originating event
ATPIncidents.Result.uuid unknown The GUID assigned for this incident

Command Example

!satp-incidents

Configuration parameters

  • url — Server URL (i.e. https://host:port) (required)
  • client — Client ID as generated in the ATP console (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • fetch_incidents_type — Incident data source
  • max_fetch — Maximum number of events per fetch.
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days). Maximum is 30 days.
  • fetch_incidents_query — Query string for fetch incidents. For example - "updated>='2020-06-06T15:39:55.616Z' and updated<'2020-08-07T00:00:00.000Z' "

Commands (8)

  • satp-appliances Deprecated

    Retrieve the appliances configured with the versions

  • satp-command Deprecated

    Issue commands to endpoints managed by Symantec Endpoint Protection

  • satp-command-cancel Deprecated

    Cancel the given command

  • satp-command-state Deprecated

    Retrieve the command state

  • satp-events Deprecated

    Accepts search requests over a specified time range and returns events that match the search condition. You must specify the time range using the start_time parameter and the end_time parameter (the maximum time range is 7 days). The time in the result schema and is typically the event creation time. This API supports search conditions (such as logical operators and special characters) to narrow the events to be retrieved. See examples at https://help.symantec.com/api-doc/atp_2.2/EN_US/#_events_query_api_example.

  • satp-files Deprecated

    Retrieve details about file based on given hash

  • satp-incident-events Deprecated

    Get events that are related to incidents

  • satp-incidents Deprecated

    Query incidents from ATP

Source

SymantecAdvancedThreatProtection.js SymantecAdvancedThreatProtection.yml SymantecAdvancedThreatProtection_description.md
Download History Raw 
commonfields:
  id: Symantec Advanced Threat Protection
  version: -1
name: Symantec Advanced Threat Protection
display: Symantec Advanced Threat Protection (Deprecated)
category: Endpoint
provider: Broadcom
description: Deprecated. No available replacement.
configuration:
- display: Server URL (i.e. https://host:port)
  name: url
  defaultvalue: ""
  type: 0
  required: true
- display: Client ID as generated in the ATP console
  name: client
  defaultvalue: ""
  type: 9
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Incident data source
  name: fetch_incidents_type
  defaultvalue: incidents
  type: 15
  options:
  - incidents
  - events
  - incidentevents
  required: false
- display: Maximum number of events per fetch.
  name: max_fetch
  defaultvalue: "50"
  type: 0
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  defaultvalue: ""
  name: incidentType
  type: 13
  required: false
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days). Maximum is 30 days.
  name: first_fetch
  defaultvalue: 7 days
  type: 0
  required: false
- display: Query string for fetch incidents. For example - "updated>='2020-06-06T15:39:55.616Z' and updated<'2020-08-07T00:00:00.000Z' "
  defaultvalue: ""
  name: fetch_incidents_query
  type: 0
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: satp-appliances
    arguments: []
    outputs:
    - contextPath: ATPAppliance.appliance_id
      description: ID of the ATP appliance
    - contextPath: ATPAppliance.appliance_name
      description: Name of the ATP appliance
    - contextPath: ATPAppliance.software_version
      description: Version of the ATP appliance
    - contextPath: ATPAppliance.appliance_time
      description: Current time on the appliance in UTC
    - contextPath: ATPAppliance.role
      description: The roles of the appliance
    description: Retrieve the appliances configured with the versions
    deprecated: true
  - name: satp-command
    arguments:
    - name: action
      required: true
      auto: PREDEFINED
      predefined:
      - isolate_endpoint
      - rejoin_endpoint
      - delete_endpoint_file
      description: The action to perform on the endpoints
    - name: targets
      required: true
      description: For isolate and rejoin a list of endpoint ids (array or comma-separated). For delete, array of objects, each with hash and device_uid attributes (supports comma-delimited hash:uid,hash:uid as well).
    outputs:
    - contextPath: ATPCommand.ID
      description: The ID of the executing command
    - contextPath: ATPCommand.Action
      description: The requested action for the command
    description: Issue commands to endpoints managed by Symantec Endpoint Protection
    execution: true
    deprecated: true
  - name: satp-command-state
    arguments:
    - name: command
      required: true
      default: true
      description: The command ID to retrieve state for
    outputs:
    - contextPath: ATPCommand.ID
      description: The ID of the executing command
    - contextPath: ATPCommand.Action
      description: The requested action for the command
    - contextPath: ATPCommand.Status.target
      description: The target for the state
    - contextPath: ATPCommand.Status.state
      description: The state of the command
    - contextPath: ATPCommand.Status.error_code
      description: Error code for the target
    - contextPath: ATPCommand.Status.message
      description: Message for the target
    description: Retrieve the command state
    deprecated: true
  - name: satp-command-cancel
    arguments:
    - name: command
      required: true
      default: true
      description: The command ID to cancel
    outputs:
    - contextPath: ATPCommand.ID
      description: The ID of the executing command
    - contextPath: ATPCommand.ErrorCode
      description: Error code for cancelling - 0 if successful
    - contextPath: ATPCommand.Message
      description: Message for the cancellation
    description: Cancel the given command
    execution: true
    deprecated: true
  - name: satp-events
    arguments:
    - name: query
      description: Specifies a search condition. See full details at https://help.symantec.com/api-doc/atp_2.2/EN_US/#_eventqueryrequest
    - name: start_time
      description: ISO8601 date format - 2017-01-01T00:00:00.000Z. Also accepts milliseconds since epoch.
    - name: end_time
      description: ISO8601 date format - 2017-01-01T00:00:00.000Z. Also accepts milliseconds since epoch.
    - name: limit
      description: Maximum number of events to return. Default is 100 and max is 1000.
      defaultValue: "100"
    - name: next
      description: Used for events cursoring. Retrieve the next batch of events.
    outputs:
    - contextPath: ATPEvents.Total
      description: Total number of results
    - contextPath: ATPEvents.Next
      description: Next batch ID
    - contextPath: ATPEvents.Result.type_id
      description: The unique identifier for an event type.
    - contextPath: ATPEvents.Result.uuid
      description: The unique id for this event
    - contextPath: ATPEvents.Result.message
      description: Human-readable event message or description of the event
    - contextPath: ATPEvents.Result.severity_id
      description: Severity between 1 (info) and 6 (fatal).
    - contextPath: ATPEvents.Result.device_time
      description: The timestamp (in ISO 8601 format) that specifies the time at which the event occurred.
    - contextPath: ATPEvents.Result.device_uid
      description: Unique ID of the device that originated the event.
    - contextPath: ATPEvents.Result.device_name
      description: The device name (i.e., the name of the endpoint or appliance associated with an event).
    - contextPath: ATPEvents.Result.device_ip
      description: The IPv6 or IPv4 address of the device that originated the event.
    - contextPath: ATPEvents.Result.device_type
      description: The type of the device that originated the event.
    - contextPath: ATPEvents.Result.device_os_name
      description: The operating system running on the device_type that originated the event.
    - contextPath: ATPEvents.Result.device_os_ver
      description: The version of the operating system that is running on the device_type that originated the event.
    - contextPath: ATPEvents.Result.user_uid
      description: Unique ID of the user that originated the event or the user on whose behalf the event occurred.
    - contextPath: ATPEvents.Result.user_name
      description: The user name or ID that originated or caused the event.
    - contextPath: ATPEvents.Result.action_id
      description: 'Action taken with respect to the underlying cause of the event. Possible values are: 0 = BLOCK 1 = MONITOR'
    - contextPath: ATPEvents.Result.internal_hostname
      description: The host name of the internal device/machine for the connection
    - contextPath: ATPEvents.Result.scanner_name
      description: The name of the ATP scanner that generated this event
    - contextPath: ATPEvents.Result.internal_ip
      description: The IP address of the internal device/machine for the connection
    - contextPath: ATPEvents.Result.internal_port
      description: The port number identified as the source port in traffic sent to the target device
    - contextPath: ATPEvents.Result.external_ip
      description: The IP address of the device/machine that accepted the connection
    - contextPath: ATPEvents.Result.external_port
      description: The port number identified as the target port in traffic sent to the target device
    - contextPath: ATPEvents.Result.data_source_url
      description: The URL that the traffic came from
    - contextPath: ATPEvents.Result.data_source_url_domain
      description: The domain from which the file was downloaded. The domain is extracted from the URL for the query performance.
    - contextPath: ATPEvents.Result.data_source_url_referer
      description: The referer URL used in the download
    - contextPath: ATPEvents.Result.sep_installed
      description: Indicates whether SEP was installed when the event was generated
    - contextPath: ATPEvents.Result.data_direction
      description: 'The direction of the data source. Possible values are: 1 = Inbound. Traffic flow from WAN to LAN. 2 = Outbound. Traffic flow from LAN to WAN.'
    - contextPath: ATPEvents.Result.network_scanner_type
      description: 'The type of network scanner that detected the event. Possible values are: 0 = ATP-N Scanner (default) 1 = WSS .cloud Scanner'
    - contextPath: ATPEvents.Result.vlan_id
      description: Indicates the VLAN ID (between 0 and 4095) on which the endpoint is deployed. If the value is 0 or missing, the endpoint is deployed in a non-VLAN setup
    - contextPath: ATPEvents.Result.device_end_time
      description: The end time of an event (in format yyyy-MM-dd’T’HH:mm:ss.SSSZ). This is used with the aggregation count field.
    - contextPath: ATPEvents.Result.host_name
      description: The host name of the client computer
    - contextPath: ATPEvents.Result.domain_name
      description: The domain name of the client computer
    - contextPath: ATPEvents.Result.data_source_ip
      description: The source IP address that the file came from (either IPv4 or IPv6).
    - contextPath: ATPEvents.Result.target_ip
      description: The local (victim) IP address (IPv4 or IPv6)
    - contextPath: ATPEvents.Result.target_port
      description: The local (victim) port number
    - contextPath: ATPEvents.Result.source_ip
      description: The remote IP address (IPv4 or IPv6).
    - contextPath: ATPEvents.Result.source_port
      description: The remote port number
    - contextPath: ATPEvents.Result.parent_file_sha2
      description: The SHA256 of the parent file
    - contextPath: ATPEvents.Result.reason
      description: 'This field is overloaded and has following possible interpretations (depending on the corresponding type_id).  For type_id 4118, it specifies the block list hash function that was used to identify the file. This field has following possible values: 0 = BY_FILE_BLACKLIST_SHA2 1 = BY_FILE_BLACKLIST_MD5  For type_id 4112, it specifies the block list criteria that identify the traffic. This field has following possible values: 0 = BY_SOURCE_IP 1 = BY_DEST_IP 2 = BY_DEST_URL'
    - contextPath: ATPEvents.Result.manual_submit
      description: Indicates whether the file was manually submitted for analysis
    - contextPath: ATPEvents.Result.signature_id
      description: The NDC signature ID.
    - contextPath: ATPEvents.Result.signature_name
      description: The name of the signature
    - contextPath: ATPEvents.Result.categories
      description: A list of categories an intrusion event may belong to
    - contextPath: ATPEvents.Result.intrusion_url
      description: The URL from where a malicious script was loaded
    - contextPath: ATPEvents.Result.infected
      description: Indicates whether the customer machine is infected
    - contextPath: ATPEvents.Result.count
      description: Event aggregation count
    - contextPath: ATPEvents.Result.severity
      description: The seriousness of the event. 0 indicates most serious.
    - contextPath: ATPEvents.Result.local_host_mac
      description: The MAC address of the local computer
    - contextPath: ATPEvents.Result.remote_host_mac
      description: The MAC address of the remote computer
    - contextPath: ATPEvents.Result.app_name
      description: The full path of the application involved
    - contextPath: ATPEvents.Result.event_desc
      description: A description of the event. Usually, the first line of the description is treated as summary
    - contextPath: ATPEvents.Result.network_protocol
      description: 'Network protocol as reported by SEP. Possible values are: 1 = Other 2 = TCP 3 = UDP 4 = ICMP'
    - contextPath: ATPEvents.Result.source
      description: This field is overloaded and has possible interpretations (depending on the corresponding type_id).
    - contextPath: ATPEvents.Result.no_of_viruses
      description: The number of events for the aggregated event record. This number can be due to client-side aggregation, server-side compression, or both
    - contextPath: ATPEvents.Result.actual_action_idx
      description: This is the ID of action taken on the risk
    - contextPath: ATPEvents.Result.actual_action
      description: This is the string version of the action taken on the risk (in actual_action_idx).
    - contextPath: ATPEvents.Result.virus_name
      description: Name of the virus
    - contextPath: ATPEvents.Result.virus_def
      description: The virus definition version number
    - contextPath: ATPEvents.Result.agent_version
      description: The version of the client software
    - contextPath: ATPEvents.Result.MessageId
      description: The unique ID of the email message
    - contextPath: ATPEvents.Result.OrigMessageHeaderId
      description: The message header ID
    - contextPath: ATPEvents.Result.EmailReceivedDate
      description: 'The time when the mail transfer agent received the email. The format is: yyyy-MM-dd’T’HH:mm:ss.SSSZ'
    - contextPath: ATPEvents.Result.EmailSubject
      description: Email subject
    - contextPath: ATPEvents.Result.EmailAction
      description: 'The action executed on the email. Possible values are: - blocked - delivered - released'
    - contextPath: ATPEvents.Result.Direction
      description: 'Indication direction of the email. Possible values are: 0 = Outbound 1 = Inbound'
    - contextPath: ATPEvents.Result.incident
      description: The unique ID of the incident that is related to this event
    - contextPath: ATPEvents.Result.event_id
      description: The event ID as reported by Symantec Endpoint Protection security log
    - contextPath: ATPEvents.Result.file
      description: The file object
    - contextPath: ATPEvents.Result.threat
      description: The threat object
    - contextPath: ATPEvents.Result.av
      description: The AV object
    - contextPath: ATPEvents.Result.cynic
      description: Cynic object
    - contextPath: ATPEvents.Result.scan
      description: Scan object
    - contextPath: ATPEvents.Result.bash
      description: Bash object
    - contextPath: ATPEvents.Result.Sender
      description: Email sender object
    - contextPath: ATPEvents.Result.Receivers
      description: Email receivers array of objects
    - contextPath: ATPEvents.Result.intrusion
      description: Intrusion object
    description: Accepts search requests over a specified time range and returns events that match the search condition. You must specify the time range using the start_time parameter and the end_time parameter (the maximum time range is 7 days). The time in the result schema and is typically the event creation time. This API supports search conditions (such as logical operators and special characters) to narrow the events to be retrieved. See examples at https://help.symantec.com/api-doc/atp_2.2/EN_US/#_events_query_api_example.
    deprecated: true
  - name: satp-files
    description: Retrieve details about file based on given hash
    arguments:
    - name: hash
      required: true
      description: Hash of the file. Supports either SHA256 or MD5.
    outputs:
    - contextPath: File.MD5
      description: File MD5
    - contextPath: File.SHA256
      description: File SHA256
    - contextPath: File.Instances.name
      description: Name of file
    - contextPath: File.Instances.path
      description: Path of file
    - contextPath: File.Type
      description: MIME type of the file
    - contextPath: File.Size
      description: Size of file in bytes
    - contextPath: File.SignatureCompany
      description: The company that signed the file
    - contextPath: File.SignatureIssuer
      description: The signature issuer
    - contextPath: File.Age
      description: 'A code between 1 and 4 representing the file’s global age defined by the time the file was first reported to Symantec. This data is collected from telemetry sent to Symantec by in-field endpoint clients like Symantec Endpoint Protection and Norton. Possible values are: 1 = Years ago 2 = Months ago 3 = Weeks ago 4 = Days ago'
    - contextPath: File.Threat
      description: Name of the threat if the file is determined to be a malware
    - contextPath: File.Cynic
      description: 'A code between 0 and 2 representing the verdict given by Symantec’s Cynic sandbox analysis. Possible values are: 0 = Malware 1 = Good 2 = Unknown'
    - contextPath: File.TargetedAttack
      description: A flag that indicates whether this file is a part of targeted attack launched against an organization
    - contextPath: File.ReputationBand
      description: 'A code between 1 and 6 representing the file’s reputation. This data is generated by Symantec’s analysis engines based on the telemetry sent to Symantec by in-field endpoint clients like Symantec Endpoint Protection and Norton. Possible values are: 1 = Symantec-trusted 2 = Good 3 = Trending Good 4 = Unproven 5 = Poor 6 = Untrusted'
    - contextPath: File.PrevalenceBand
      description: 'A code between 1 and 8 representing the file’s prevalence. This data is collected from telemetry sent to Symantec by in-field endpoint clients like Symantec Endpoint Protection and Norton. Possible values are: 1 = Fewer than 5 users 2 = Fewer than 50 users 3 = Fewer than 100 users 4 = Hundreds of users 5 = Thousands of users 6 = Tens of thousands of users 7 = Hundreds of thousands of users 8 = Millions of users'
    - contextPath: File.Health
      description: 'A code between 0 and 3 representing the file’s health. Possible values are: 0 = Good 1 = Neutral 2 = Suspicious 3 = Bad 4 = Analyzing'
    deprecated: true
  - name: satp-incident-events
    arguments:
    - name: query
      description: Specifies a search condition.
    - name: start_time
      description: ISO8601 date format - 2017-01-01T00:00:00.000Z. Also accepts milliseconds since epoch.
    - name: end_time
      description: ISO8601 date format - 2017-01-01T00:00:00.000Z. Also accepts milliseconds since epoch.
    - name: limit
      description: Maximum number of events to return. Default is 20 and max is 1000.
      defaultValue: "20"
    - name: next
      description: Used for events cursoring. Retrieve the next batch of events.
    outputs:
    - contextPath: ATPIncidentEvents.Total
      description: Total number of results
    - contextPath: ATPIncidentEvents.Next
      description: Next batch ID
    - contextPath: ATPIncidentEvents.Result.type_id
      description: The unique identifier for an event type.
    - contextPath: ATPIncidentEvents.Result.uuid
      description: The unique id for this event
    - contextPath: ATPIncidentEvents.Result.message
      description: Human-readable event message or description of the event
    - contextPath: ATPIncidentEvents.Result.severity_id
      description: Severity between 1 (info) and 6 (fatal).
    - contextPath: ATPIncidentEvents.Result.device_time
      description: The timestamp (in ISO 8601 format) that specifies the time at which the event occurred.
    - contextPath: ATPIncidentEvents.Result.device_uid
      description: Unique ID of the device that originated the event.
    - contextPath: ATPIncidentEvents.Result.device_name
      description: The device name (i.e., the name of the endpoint or appliance associated with an event).
    - contextPath: ATPIncidentEvents.Result.device_ip
      description: The IPv6 or IPv4 address of the device that originated the event.
    - contextPath: ATPIncidentEvents.Result.device_type
      description: The type of the device that originated the event.
    - contextPath: ATPIncidentEvents.Result.device_os_name
      description: The operating system running on the device_type that originated the event.
    - contextPath: ATPIncidentEvents.Result.device_os_ver
      description: The version of the operating system that is running on the device_type that originated the event.
    - contextPath: ATPIncidentEvents.Result.user_uid
      description: Unique ID of the user that originated the event or the user on whose behalf the event occurred.
    - contextPath: ATPIncidentEvents.Result.user_name
      description: The user name or ID that originated or caused the event.
    - contextPath: ATPIncidentEvents.Result.action_id
      description: 'Action taken with respect to the underlying cause of the event. Possible values are: 0 = BLOCK 1 = MONITOR'
    - contextPath: ATPIncidentEvents.Result.internal_hostname
      description: The host name of the internal device/machine for the connection
    - contextPath: ATPIncidentEvents.Result.scanner_name
      description: The name of the ATP scanner that generated this event
    - contextPath: ATPIncidentEvents.Result.internal_ip
      description: The IP address of the internal device/machine for the connection
    - contextPath: ATPIncidentEvents.Result.internal_port
      description: The port number identified as the source port in traffic sent to the target device
    - contextPath: ATPIncidentEvents.Result.external_ip
      description: The IP address of the device/machine that accepted the connection
    - contextPath: ATPIncidentEvents.Result.external_port
      description: The port number identified as the target port in traffic sent to the target device
    - contextPath: ATPIncidentEvents.Result.data_source_url
      description: The URL that the traffic came from
    - contextPath: ATPIncidentEvents.Result.data_source_url_domain
      description: The domain from which the file was downloaded. The domain is extracted from the URL for the query performance.
    - contextPath: ATPIncidentEvents.Result.data_source_url_referer
      description: The referer URL used in the download
    - contextPath: ATPIncidentEvents.Result.sep_installed
      description: Indicates whether SEP was installed when the event was generated
    - contextPath: ATPIncidentEvents.Result.data_direction
      description: 'The direction of the data source. Possible values are: 1 = Inbound. Traffic flow from WAN to LAN. 2 = Outbound. Traffic flow from LAN to WAN.'
    - contextPath: ATPIncidentEvents.Result.network_scanner_type
      description: 'The type of network scanner that detected the event. Possible values are: 0 = ATP-N Scanner (default) 1 = WSS .cloud Scanner'
    - contextPath: ATPIncidentEvents.Result.vlan_id
      description: Indicates the VLAN ID (between 0 and 4095) on which the endpoint is deployed. If the value is 0 or missing, the endpoint is deployed in a non-VLAN setup
    - contextPath: ATPIncidentEvents.Result.device_end_time
      description: The end time of an event (in format yyyy-MM-dd’T’HH:mm:ss.SSSZ). This is used with the aggregation count field.
    - contextPath: ATPIncidentEvents.Result.host_name
      description: The host name of the client computer
    - contextPath: ATPIncidentEvents.Result.domain_name
      description: The domain name of the client computer
    - contextPath: ATPIncidentEvents.Result.data_source_ip
      description: The source IP address that the file came from (either IPv4 or IPv6).
    - contextPath: ATPIncidentEvents.Result.target_ip
      description: The local (victim) IP address (IPv4 or IPv6)
    - contextPath: ATPIncidentEvents.Result.target_port
      description: The local (victim) port number
    - contextPath: ATPIncidentEvents.Result.source_ip
      description: The remote IP address (IPv4 or IPv6).
    - contextPath: ATPIncidentEvents.Result.source_port
      description: The remote port number
    - contextPath: ATPIncidentEvents.Result.parent_file_sha2
      description: The SHA256 of the parent file
    - contextPath: ATPIncidentEvents.Result.reason
      description: 'This field is overloaded and has following possible interpretations (depending on the corresponding type_id).  For type_id 4118, it specifies the block list hash function that was used to identify the file. This field has following possible values: 0 = BY_FILE_BLACKLIST_SHA2 1 = BY_FILE_BLACKLIST_MD5  For type_id 4112, it specifies the Blacklist criteria that identify the traffic. This field has following possible values: 0 = BY_SOURCE_IP 1 = BY_DEST_IP 2 = BY_DEST_URL'
    - contextPath: ATPIncidentEvents.Result.manual_submit
      description: Indicates whether the file was manually submitted for analysis
    - contextPath: ATPIncidentEvents.Result.signature_id
      description: The NDC signature ID.
    - contextPath: ATPIncidentEvents.Result.signature_name
      description: The name of the signature
    - contextPath: ATPIncidentEvents.Result.categories
      description: A list of categories an intrusion event may belong to
    - contextPath: ATPIncidentEvents.Result.intrusion_url
      description: The URL from where a malicious script was loaded
    - contextPath: ATPIncidentEvents.Result.infected
      description: Indicates whether the customer machine is infected
    - contextPath: ATPIncidentEvents.Result.count
      description: Event aggregation count
    - contextPath: ATPIncidentEvents.Result.severity
      description: The seriousness of the event. 0 indicates most serious.
    - contextPath: ATPIncidentEvents.Result.local_host_mac
      description: The MAC address of the local computer
    - contextPath: ATPIncidentEvents.Result.remote_host_mac
      description: The MAC address of the remote computer
    - contextPath: ATPIncidentEvents.Result.app_name
      description: The full path of the application involved
    - contextPath: ATPIncidentEvents.Result.event_desc
      description: A description of the event. Usually, the first line of the description is treated as summary
    - contextPath: ATPIncidentEvents.Result.network_protocol
      description: 'Network protocol as reported by SEP. Possible values are: 1 = Other 2 = TCP 3 = UDP 4 = ICMP'
    - contextPath: ATPIncidentEvents.Result.source
      description: This field is overloaded and has possible interpretations (depending on the corresponding type_id).
    - contextPath: ATPIncidentEvents.Result.no_of_viruses
      description: The number of events for the aggregated event record. This number can be due to client-side aggregation, server-side compression, or both
    - contextPath: ATPIncidentEvents.Result.actual_action_idx
      description: This is the ID of action taken on the risk
    - contextPath: ATPIncidentEvents.Result.actual_action
      description: This is the string version of the action taken on the risk (in actual_action_idx).
    - contextPath: ATPIncidentEvents.Result.virus_name
      description: Name of the virus
    - contextPath: ATPIncidentEvents.Result.virus_def
      description: The virus definition version number
    - contextPath: ATPIncidentEvents.Result.agent_version
      description: The version of the client software
    - contextPath: ATPIncidentEvents.Result.MessageId
      description: The unique ID of the email message
    - contextPath: ATPIncidentEvents.Result.OrigMessageHeaderId
      description: The message header ID
    - contextPath: ATPIncidentEvents.Result.EmailReceivedDate
      description: 'The time when the mail transfer agent received the email. The format is: yyyy-MM-dd’T’HH:mm:ss.SSSZ'
    - contextPath: ATPIncidentEvents.Result.EmailSubject
      description: Email subject
    - contextPath: ATPIncidentEvents.Result.EmailAction
      description: 'The action executed on the email. Possible values are: - blocked - delivered - released'
    - contextPath: ATPIncidentEvents.Result.Direction
      description: 'Indication direction of the email. Possible values are: 0 = Outbound 1 = Inbound'
    - contextPath: ATPIncidentEvents.Result.incident
      description: The unique ID of the incident that is related to this event
    - contextPath: ATPIncidentEvents.Result.event_id
      description: The event ID as reported by Symantec Endpoint Protection security log
    - contextPath: ATPIncidentEvents.Result.file
      description: The file object
    - contextPath: ATPIncidentEvents.Result.threat
      description: The threat object
    - contextPath: ATPIncidentEvents.Result.av
      description: The AV object
    - contextPath: ATPIncidentEvents.Result.cynic
      description: Cynic object
    - contextPath: ATPIncidentEvents.Result.scan
      description: Scan object
    - contextPath: ATPIncidentEvents.Result.bash
      description: Bash object
    - contextPath: ATPIncidentEvents.Result.Sender
      description: Email sender object
    - contextPath: ATPIncidentEvents.Result.Receivers
      description: Email receivers array of objects
    - contextPath: ATPIncidentEvents.Result.intrusion
      description: Intrusion object
    description: Get events that are related to incidents
    deprecated: true
  - name: satp-incidents
    arguments:
    - name: query
      description: Specifies a search condition.
    - name: start_time
      description: ISO8601 date format - 2017-01-01T00:00:00.000Z. Also accepts milliseconds since epoch.
    - name: end_time
      description: ISO8601 date format - 2017-01-01T00:00:00.000Z. Also accepts milliseconds since epoch.
    - name: limit
      description: Maximum number of events to return. Default is 20 and max is 1000.
      defaultValue: "20"
    - name: next
      description: Used for events cursoring. Retrieve the next batch of events.
    outputs:
    - contextPath: ATPIncidents.Result.atp_incident_id
      description: A unique identifier for this incident
    - contextPath: ATPIncidents.Result.priority_level
      description: Priority level of the incident. 1 = LOW, 2 = MED, 3 = HIGH
    - contextPath: ATPIncidents.Result.state
      description: The state of the incident. 1 = OPEN,2 = WAITING,3 = IN_WORK,4 = CLOSED
    - contextPath: ATPIncidents.Result.recommended_action
      description: Recommended action for this incident
    - contextPath: ATPIncidents.Result.first_event_seen
      description: When the first event associated with the incident was created
    - contextPath: ATPIncidents.Result.last_event_seen
      description: When the last event associated with the incident was created
    - contextPath: ATPIncidents.Result.event_count
      description: The number of events associated with the incident
    - contextPath: ATPIncidents.Result.device_time
      description: The timestamp that specifies the time at which the event occurred
    - contextPath: ATPIncidents.Result.deviceUid
      description: A list of ATP endpoint devices UID on which the events occurred
    - contextPath: ATPIncidents.Result.scanners
      description: A list of ATP scanners that discovered the threat
    - contextPath: ATPIncidents.Result.filehash
      description: A list of SHA256 hashes associated with this incident
    - contextPath: ATPIncidents.Result.domainid
      description: A list of domains associated with this incident
    - contextPath: ATPIncidents.Result.summary
      description: Summary information about the incident
    - contextPath: ATPIncidents.Result.time
      description: The creation time (in ISO 8601 format) of the incident
    - contextPath: ATPIncidents.Result.updated
      description: The time (in ISO 8601 format) of last modification
    - contextPath: ATPIncidents.Result.log_name
      description: The index/type of the originating event
    - contextPath: ATPIncidents.Result.uuid
      description: The GUID assigned for this incident
    description: Query incidents from ATP
    deprecated: true
  isfetch: true
  isFetchSamples: true
fromversion: 5.0.0
deprecated: true
tests:
- No tests (deprecated)