SymantecEDR

Symantec EDR (On Prem) endpoints help to detect threats in your network by filter endpoints data to find Indicators of Compromise (IoCs) and take actions to remediate the threat(s). EDR on-premise capabilities allow incident responders to quickly search, identify, and contain all impacted endpoints while investigating threats using a choice of on-premises.

Network Security · Symantec Endpoint Detection and Response

Configuration parameters

  • url — Server URL (i.e., https://host:port) (required)
  • credentials — Client ID (required)
  • isFetch — Fetch incidents
  • fetch_incidents_events_type — Incident data source
  • isIncidentsEvent — Fetch incidents alerts
  • isIncidentComment — Fetch incident comments
  • fetch_status — Incidents "Status" to filter out fetching as incidents. Comma-separated lists are supported, e.g., Open, In-Progress
  • fetch_priority — Incidents "Priority" to filter out fetching as incidents. Comma-separated lists are supported, e.g., Medium,High.
  • fetch_event_status — Events "Status" to filter out fetching as incidents. Comma-separated lists are supported, e.g., Unknown, Success
  • fetch_severity — Events "Severity" to filter out fetching as incidents. Comma-separated lists are supported, e.g., Info, Warning
  • fetch_incidents_query — Query string to fetch incidents/events. For example - "updated:[2017-01-01T00:00:00.000Z TO 2017-01-08T00:00:00.000Z]"
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 10 minutes, 12 hours, 7 days)
  • max_fetch — Maximum number of incidents to fetch
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentType — Incident type
  • integration_reliability — Source Reliability

Commands (21)

  • file

    Issue a sandbox command of a specific SHA2.

  • symantec-edr-allow-list-policy-get

    Get allow list policies.

  • symantec-edr-audit-event-list

    Get audit events.

  • symantec-edr-deny-list-policy-get

    Get deny list policies.

  • symantec-edr-domain-file-association-list

    List of domain and file association.

  • symantec-edr-domain-instance-list

    Get domain instances.

  • symantec-edr-endpoint-cancel-command

    Cancel a command that is already in progress. Cancel the command execution on all the endpoints where it is still in progress. \nOnly one command can be cancelled at a time.

  • symantec-edr-endpoint-delete-file

    Deletes a file, i.e., deletes all instances of the file, based on the file hash that you have specified from the endpoint using the device ID.

  • symantec-edr-endpoint-domain-association-list

    List of endpoint and domain association.

  • symantec-edr-endpoint-file-association-list

    List of domain and file association.

  • symantec-edr-endpoint-instance-list

    Get endpoint instances.

  • symantec-edr-endpoint-isolate

    Isolates or quarantines endpoints by cutting connections that the endpoint(s) has to internal networks and external networks, based on the endpoint device IDs.

  • symantec-edr-endpoint-rejoin

    Rejoins endpoints by re-establishing connections that the endpoint(s) has to internal networks and external networks, based on the endpoint IDs.

  • symantec-edr-endpoint-status

    Get the command status.

  • symantec-edr-event-list

    Get events or system alerts from EDR on-premise.

  • symantec-edr-file-instance-list

    Get File Instances.

  • symantec-edr-incident-comment-get

    Get incident comments based on incident UUID.

  • symantec-edr-incident-event-list

    Get events for incidents.

  • symantec-edr-incident-list

    Get incidents from Symantec EDR on-premise API.

  • symantec-edr-incident-update

    Incidents patch command to close an incident, update the resolution of a closed incident, or add comments to the incident.

  • symantec-edr-system-activity-list

    Get system activities or logs.