Uptycs

Fetches data from the Uptycs database.

Analytics & SIEM · Uptycs

Configuration parameters

  • key — API key (required)
  • secret — API secret (required)
  • domain — API domain (e.g. teststack.uptycs.io) (required)
  • customer_id — API Customer ID (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • fetch_time — First fetch since (<number> <time unit>, e.g., 12 hours, 7 days)

Commands (47)

  • uptycs-create-lookuptable

    Create a new Uptycs lookup table.

  • uptycs-delete-assets-tag

    Disassociate an asset with a tag.

  • uptycs-delete-lookuptable

    Delete an Uptycs lookup table.

  • uptycs-delete-tag

    Delete an Uptycs asset tag.

  • uptycs-edit-lookuptable

    Edit an Uptycs lookup table.

  • uptycs-get-alert-rules

    Returns a list of alert rules.

  • uptycs-get-alerts

    Returns alerts from the Uptycs database. Do not use the "asset_id", "host_name_is" argument and "host_name_like" argument in the same command.

  • uptycs-get-asset-groups

    get Uptycs asset groups.

  • uptycs-get-asset-tags

    Retrieve a list of tags for a particular asset.

  • uptycs-get-asset-with-id

    Get an Uptycs asset details.

  • uptycs-get-assets

    Returns assets enrolled with Uptycs. Do not use the "host_name_is" argument and "host_name_like" in the same command.

  • uptycs-get-carves

    Get the list of carves file from a specific path.

  • uptycs-get-carves-download-file

    Download a carved file using uuid.

  • uptycs-get-carves-link

    Get the url of a carved file using uuid.

  • uptycs-get-event-rules

    Returns a list of event rules.

  • uptycs-get-events

    Returns events from the Uptycs database.

  • uptycs-get-lookuptable

    Get an Uptycs lookup table details.

  • uptycs-get-lookuptables

    get list of uptycs look up tables.

  • uptycs-get-parent-event-information

    find information for parent process events which are running or have run on a registered Uptycs assert.

  • uptycs-get-parent-information

    get the parent process information for a particular child process.

  • uptycs-get-process-child-processes

    get all the child processes for a given parent process.

  • uptycs-get-process-event-information

    get information for a particular process event.

  • uptycs-get-process-events

    find process events which are running or have run on a registered Uptycs asset.

  • uptycs-get-process-information

    get information for a particular process.

  • uptycs-get-process-open-files

    find processes which have opened files.

  • uptycs-get-process-open-sockets

    Finds processes that opened a socket.

  • uptycs-get-processes

    find processes which are running or have run on a registered Uptycs asset.

  • uptycs-get-saved-queries

    Retrieve a saved query or list of all saved queries.

  • uptycs-get-socket-event-information

    get information for a particular socket event.

  • uptycs-get-socket-events

    find processes which opened a socket.

  • uptycs-get-tag

    Return Uptycs asset tag details.

  • uptycs-get-tags

    Return a list of Uptycs asset tags with details.

  • uptycs-get-threat-indicator

    retrieve information about a specific threat indicator using a unique threat indicator id.

  • uptycs-get-threat-indicators

    get Uptycs threat indicators.

  • uptycs-get-threat-source

    retrieve information about a specific threat source.

  • uptycs-get-threat-sources

    get Uptycs threat sources.

  • uptycs-get-threat-vendors

    get Uptycs threat vendors.

  • uptycs-get-user-asset-groups

    get a list of users in a particular asset group.

  • uptycs-get-user-information

    get info for an Uptycs user.

  • uptycs-get-users

    get a list of Uptycs users.

  • uptycs-post-lookuptable-data

    Update csv data for a look up table.

  • uptycs-post-saved-query

    Save a query to the Uptycs DB.

  • uptycs-post-threat-source

    post a new threat source to your threat sources in Uptycs.

  • uptycs-run-query

    Runs the specified SQL query against your Uptycs database. A list of tables can be found at osquery.io/schema, or by using the query "select * from information_schema.tables".

  • uptycs-run-saved-query

    Run a saved query.

  • uptycs-set-alert-status

    Set the status of an alert to new, assigned, resolved, or closed.

  • uptycs-set-asset-tag

    Sets a tag on a particular asset.