Details
| ID | Uptycs |
|---|---|
| Provider | Uptycs |
| Category | Analytics & SIEM |
| From Version | 5.0.0 |
| Docker Image | demisto/auth-utils:1.0.0.10133006 |
| Supported Modules | Agentix XSIAM |
README
Overview
Uptycs combines the open source universal agent, osquery, with a scalable security analytics platform for fleet visibility, intrusion detection, vulnerability monitoring and compliance. Uptycs deploys osquery to your entire infrastructure, regardless of operating system mix or hosting environment, collects, and stores system state data. Uptycs will stream that data over secure TLS protocol, storing it in your unique instance, and continuously monitoring for suspicious activity. Integrated third party feeds of known malware, threats and over 170,000 indicators of compromise (IOCs) further enhance threat visibility. Finally, take action with real-time alerts, dashboards and reports packaged for multiple security protocols.
The Cortex XSOAR-Uptycs integration connects to the Uptycs backend via the Uptycs API. The integration allows the use of Uptycs data in existing workflows. Features include fetching and handling alerts, threat investigation, posting new threat sources, setting tags on assets, and the ability to run arbitrary SQL queries against your Uptycs database or in real-time against registered endpoints.
Uptycs Playbook
- Uptycs - Bad IP Incident and Uptycs - Outbound Connection to Threat IOC Incident
Get details about connections which have been opened to known bad IP addresses, including process and parent process information, IP addresses, ports, sockets, and the source of the threat intelligence.
Use Cases
- Incident investigation
- Fetch and handle alerts
- Monitor asset activity
- Audit and compliance
- Vulnerability management
- Mac EDR
Configure Uptycs on Cortex XSOAR
How to get an API Key and API Secret
In order to create an instance of the integration, you need to download a user API key and secret from your Uptycs account.
- Go to your Uptycs environment.
- Navigate to Configuration > Users.
- In the User API key section, click download.
The downloaded file will have all the information necessary to create the instance.
Parameters
- Navigate to Settings > Integrations > Servers & Services.
- Search for Uptycs.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- API key
- API secret
- API domain: the domain found in your API key file as well as the Top Level Domain for your Uptycs stack (example: if your Uptycs’ stack URL is “mystack.uptycs.io” then your API key file will say “mystack” in the domain field. You would then put “mystack.uptycs.io” in the API domain field when configuring your integration instance).
- API Customer ID
- Fetch incidents
- Incident type
- Trust any certificate (unsecure)
- Use system proxy
- First fetch since
- Click Test to validate the URLs, token, and connection.
Fetched Incidents Data
The Cortex XSOAR-Uptycs integration creates incients from Uptycs alerts using the Uptycs API
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
- uptycs-get-assets
- uptycs-run-query
- uptycs-get-alerts
- uptycs-get-alert-rules
- uptycs-get-event-rules
- uptycs-get-events
- uptycs-get-process-open-sockets
- uptycs-get-process-information
- uptycs-get-process-child-processes
- uptycs-get-processes
- uptycs-get-process-open-files
- uptycs-set-alert-status
- uptycs-set-asset-tag
- uptycs-get-user-information
- uptycs-get-threat-indicators
- uptycs-get-threat-sources
- uptycs-get-threat-vendors
- uptycs-get-parent-information
- uptycs-post-threat-source
- uptycs-get-users
- uptycs-get-asset-groups
- uptycs-get-user-asset-groups
- uptycs-get-threat-indicator
- uptycs-get-threat-source
- uptycs-get-process-events
- uptycs-get-process-event-information
- uptycs-get-socket-events
- uptycs-get-parent-event-information
- uptycs-get-socket-event-information
- uptycs-get-asset-tags
- uptycs-get-saved-queries
- uptycs-run-saved-query
- uptycs-post-saved-query
- uptycs-get-carves
- uptycs-get-carves-link
- uptycs-get-carves-download-file
- uptycs-get-asset-with-id
- uptycs-get-tag
- uptycs-get-tags
- uptycs-delete-tag
- uptycs-create-lookuptable
- uptycs-post-lookuptable-data
- uptycs-edit-lookuptable
- uptycs-get-lookuptable
- uptycs-get-lookuptables
- uptycs-delete-lookuptable
- uptycs-delete-assets-tag
1. uptycs-get-assets
return assets enrolled with Uptycs
Base Command
uptycs-get-assets
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_group_id | Only return assets which are a member of this asset group | Optional |
| host_name_is | Only return assets with this hostname. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| host_name_like | Only return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
| os | Only return assets with this type of operating system. | Optional |
| asset_id | Only return the asset with this unique asset id | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.Assets.id | string | Uptycs asset id |
| Uptycs.Assets.created_at | date | Time asset was enrolled with Uptycs |
| Uptycs.Assets.host_name | string | Hostname in Uptycs DB |
| Uptycs.Assets.os | string | os installed on asset (Windows, Linux, Mac OS X) |
| Uptycs.Assets.os_version | string | os version |
| Uptycs.Assets.last_activity_at | date | Last activity |
| Uptycs.Assets.deleted_at | date | Time asset was unenrolled from Uptycs |
| Uptycs.Assets.osquery_version | string | Current version of osquery installed on the asset |
Command Example
uptycs-get-assets os="Mac OS X/Apple OS X/macOS" limit=1
Context Example
{
"Uptycs.Assets": [
{
"status": "active",
"last_enrolled_at": "2019-07-19 14:47:27.485",
"os_version": "10.14.5",
"osquery_version": "3.2.6.51-Uptycs",
"created_at": "2018-09-25 16:38:16.440",
"longitude": -97.822,
"os_flavor": "darwin",
"host_name": "kyle-mbp-work",
"latitude": 37.751,
"last_activity_at": "2019-07-19 17:02:41.704",
"os": "Mac OS X",
"id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"location": "United States"
}
]
}
Human Readable Output
Uptycs Assets
| id | host_name | os | os_version | osquery_version | last_activity_at |
|---|---|---|---|---|---|
| 984d4a7a-9f3a-580a-a3ef-2841a561669b | kyle-mbp-work | Mac OS X | 10.14.5 | 3.2.6.51-Uptycs | 2019-07-19 17:02:41.704 |
2. uptycs-run-query
enter a SQL query to run against your Uptycs database. A list of tables can be found at osquery.io/schema, or by using the query “select * from information_schema.tables”
Base Command
uptycs-run-query
Input
| Argument Name | Description | Required |
|---|---|---|
| query | This is the query that will be run. Queries should be written for a SQLite database. For example, “SELECT * FROM processes” returns the entire table named “processes”. | Required |
| query_type | The query can be run globally (returns results for entire history stored in Uptycs DB) or real-time (returns results for queries run on endpoints at the time of query execution) | Required |
| asset_id | realtime queries only This argument should be used when one wants to run a realtime query on a particular asset. | Optional |
| host_name_is | realtime queries only Only return assets with this hostname | Optional |
| host_name_like | realtime queries only . Only return assets with this string in the hostname. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.QueryResults | unknown | Results of executed query |
Command Example
uptycs-run-query query="SELECT * FROM process_open_sockets LIMIT 10" query_type=global host_name_like="uptycs-osquery-"
Context Example
{
"Uptycs.QueryResults": [
{
"protocol": 6,
"family": 2,
"upt_counter": 20595,
"pid": 11,
"upt_asset_id": "a4991bf9-13e3-026b-7b46-af192746d556",
"upt_hostname": "uptycs-osquery-d4trq",
"local_port": 45864,
"upt_asset_tags": null,
"upt_hash": "1752f1a2-f773-5812-b611-577ee662b889",
"state": "ESTABLISHED",
"upt_asset_group_id": null,
"upt_time": "2019-04-18 02:37:09.000",
"local_address": "10.8.0.29",
"upt_added": false,
"upt_server_time": null,
"remote_address": "18.213.163.112",
"fd": 14,
"upt_asset_group_name": null,
"path": "",
"upt_day": 20190418,
"socket": 127377813,
"upt_epoch": 0,
"remote_port": 443,
"net_namespace": "4026532943"
},
{
"protocol": 6,
"family": 2,
"upt_counter": 20595,
"pid": 11,
"upt_asset_id": "a4991bf9-13e3-026b-7b46-af192746d556",
"upt_hostname": "uptycs-osquery-d4trq",
"local_port": 45864,
"upt_asset_tags": null,
"upt_hash": "70dce553-3bca-5701-834c-8f2b94afd8f3",
"state": "CLOSE_WAIT",
"upt_asset_group_id": null,
"upt_time": "2019-04-18 02:37:09.000",
"local_address": "10.8.0.29",
"upt_added": true,
"upt_server_time": null,
"remote_address": "18.213.163.112",
"fd": 14,
"upt_asset_group_name": null,
"path": "",
"upt_day": 20190418,
"socket": 127377813,
"upt_epoch": 0,
"remote_port": 443,
"net_namespace": "4026532943"
},
{
"protocol": 6,
"family": 2,
"upt_counter": 1267,
"pid": 11,
"upt_asset_id": "a4991bf9-13e3-026b-7b46-af192746d556",
"upt_hostname": "uptycs-osquery-d4trq",
"local_port": 34164,
"upt_asset_tags": null,
"upt_hash": "f8d24a1b-15d5-5c41-9994-2f70920fdc39",
"state": "CLOSE_WAIT",
"upt_asset_group_id": null,
"upt_time": "2019-04-18 20:52:05.000",
"local_address": "10.8.0.29",
"upt_added": false,
"upt_server_time": null,
"remote_address": "18.213.163.112",
"fd": 14,
"upt_asset_group_name": null,
"path": "",
"upt_day": 20190418,
"socket": 128588161,
"upt_epoch": 0,
"remote_port": 443,
"net_namespace": "4026532943"
},
{
"protocol": 6,
"family": 2,
"upt_counter": 1267,
"pid": 11,
"upt_asset_id": "a4991bf9-13e3-026b-7b46-af192746d556",
"upt_hostname": "uptycs-osquery-d4trq",
"local_port": 34754,
"upt_asset_tags": null,
"upt_hash": "0603bdcc-8e90-58d9-831e-8adb3ca35358",
"state": "ESTABLISHED",
"upt_asset_group_id": null,
"upt_time": "2019-04-18 20:52:05.000",
"local_address": "10.8.0.29",
"upt_added": true,
"upt_server_time": null,
"remote_address": "18.213.163.112",
"fd": 14,
"upt_asset_group_name": null,
"path": "",
"upt_day": 20190418,
"socket": 128594058,
"upt_epoch": 0,
"remote_port": 443,
"net_namespace": "4026532943"
},
{
"protocol": 6,
"family": 2,
"upt_counter": 1024,
"pid": 2545,
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"upt_hostname": "kyle-mbp-work",
"local_port": 61925,
"upt_asset_tags": null,
"upt_hash": "754d2272-caf2-5d56-8638-984d7392e7f2",
"state": "ESTABLISHED",
"upt_asset_group_id": null,
"upt_time": "2019-04-18 15:26:49.000",
"local_address": "192.168.1.161",
"upt_added": false,
"upt_server_time": null,
"remote_address": "18.213.163.112",
"fd": 186,
"upt_asset_group_name": null,
"path": "",
"upt_day": 20190418,
"socket": 0,
"upt_epoch": 0,
"remote_port": 443,
"net_namespace": null
},
{
"protocol": 6,
"family": 2,
"upt_counter": 1024,
"pid": 2545,
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"upt_hostname": "kyle-mbp-work",
"local_port": 61934,
"upt_asset_tags": null,
"upt_hash": "ce103524-0f5f-5aea-abad-b8529620b7bf",
"state": "ESTABLISHED",
"upt_asset_group_id": null,
"upt_time": "2019-04-18 15:26:49.000",
"local_address": "192.168.1.161",
"upt_added": false,
"upt_server_time": null,
"remote_address": "18.213.163.112",
"fd": 191,
"upt_asset_group_name": null,
"path": "",
"upt_day": 20190418,
"socket": 0,
"upt_epoch": 0,
"remote_port": 443,
"net_namespace": null
},
{
"protocol": 6,
"family": 2,
"upt_counter": 1024,
"pid": 854,
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"upt_hostname": "kyle-mbp-work",
"local_port": 61573,
"upt_asset_tags": null,
"upt_hash": "c2f00244-9fa4-5c47-a49b-9bd0390d169f",
"state": "ESTABLISHED",
"upt_asset_group_id": null,
"upt_time": "2019-04-18 15:26:49.000",
"local_address": "192.168.1.161",
"upt_added": false,
"upt_server_time": null,
"remote_address": "149.96.6.118",
"fd": 33,
"upt_asset_group_name": null,
"path": "",
"upt_day": 20190418,
"socket": 0,
"upt_epoch": 0,
"remote_port": 443,
"net_namespace": null
},
{
"protocol": 6,
"family": 2,
"upt_counter": 1024,
"pid": 2545,
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"upt_hostname": "kyle-mbp-work",
"local_port": 61919,
"upt_asset_tags": null,
"upt_hash": "0439a9f5-130d-5ff4-a8df-d72275e4b9e2",
"state": "ESTABLISHED",
"upt_asset_group_id": null,
"upt_time": "2019-04-18 15:26:49.000",
"local_address": "192.168.1.161",
"upt_added": false,
"upt_server_time": null,
"remote_address": "18.213.163.112",
"fd": 54,
"upt_asset_group_name": null,
"path": "",
"upt_day": 20190418,
"socket": 0,
"upt_epoch": 0,
"remote_port": 443,
"net_namespace": null
},
{
"protocol": 6,
"family": 2,
"upt_counter": 1024,
"pid": 854,
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"upt_hostname": "kyle-mbp-work",
"local_port": 61573,
"upt_asset_tags": null,
"upt_hash": "fe0218c2-b337-5198-ac9c-a1f8784a2c08",
"state": "ESTABLISHED",
"upt_asset_group_id": null,
"upt_time": "2019-04-18 15:26:49.000",
"local_address": "192.168.1.161",
"upt_added": false,
"upt_server_time": null,
"remote_address": "149.96.6.118",
"fd": 62,
"upt_asset_group_name": null,
"path": "",
"upt_day": 20190418,
"socket": 0,
"upt_epoch": 0,
"remote_port": 443,
"net_namespace": null
},
{
"protocol": 6,
"family": 2,
"upt_counter": 1024,
"pid": 854,
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"upt_hostname": "kyle-mbp-work",
"local_port": 61939,
"upt_asset_tags": null,
"upt_hash": "6194c89c-171c-55c8-9355-5b53a4a28a5a",
"state": "ESTABLISHED",
"upt_asset_group_id": null,
"upt_time": "2019-04-18 15:26:49.000",
"local_address": "192.168.1.161",
"upt_added": true,
"upt_server_time": null,
"remote_address": "149.96.6.118",
"fd": 7,
"upt_asset_group_name": null,
"path": "",
"upt_day": 20190418,
"socket": 0,
"upt_epoch": 0,
"remote_port": 443,
"net_namespace": null
}
]
}
Human Readable Output
Uptycs Query Result
| protocol | family | upt_counter | pid | upt_asset_id | upt_hostname | local_port | upt_asset_tags | upt_hash | upt_asset_group_id | state | upt_time | local_address | upt_added | upt_server_time | remote_address | fd | upt_asset_group_name | path | upt_day | socket | upt_epoch | remote_port | net_namespace |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6 | 2 | 20595 | 11 | a4991bf9-13e3-026b-7b46-af192746d556 | uptycs-osquery-d4trq | 45864 | 1752f1a2-f773-5812-b611-577ee662b889 | ESTABLISHED | 2019-04-18 02:37:09.000 | 10.8.0.29 | false | 18.213.163.112 | 14 | 20190418 | 127377813 | 0 | 443 | 4026532943 | |||||
| 6 | 2 | 20595 | 11 | a4991bf9-13e3-026b-7b46-af192746d556 | uptycs-osquery-d4trq | 45864 | 70dce553-3bca-5701-834c-8f2b94afd8f3 | CLOSE_WAIT | 2019-04-18 02:37:09.000 | 10.8.0.29 | true | 18.213.163.112 | 14 | 20190418 | 127377813 | 0 | 443 | 4026532943 | |||||
| 6 | 2 | 1267 | 11 | a4991bf9-13e3-026b-7b46-af192746d556 | uptycs-osquery-d4trq | 34164 | f8d24a1b-15d5-5c41-9994-2f70920fdc39 | CLOSE_WAIT | 2019-04-18 20:52:05.000 | 10.8.0.29 | false | 18.213.163.112 | 14 | 20190418 | 128588161 | 0 | 443 | 4026532943 | |||||
| 6 | 2 | 1267 | 11 | a4991bf9-13e3-026b-7b46-af192746d556 | uptycs-osquery-d4trq | 34754 | 0603bdcc-8e90-58d9-831e-8adb3ca35358 | ESTABLISHED | 2019-04-18 20:52:05.000 | 10.8.0.29 | true | 18.213.163.112 | 14 | 20190418 | 128594058 | 0 | 443 | 4026532943 | |||||
| 6 | 2 | 1024 | 2545 | 984d4a7a-9f3a-580a-a3ef-2841a561669b | kyle-mbp-work | 61925 | 754d2272-caf2-5d56-8638-984d7392e7f2 | ESTABLISHED | 2019-04-18 15:26:49.000 | 192.168.1.161 | false | 18.213.163.112 | 186 | 20190418 | 0 | 0 | 443 | ||||||
| 6 | 2 | 1024 | 2545 | 984d4a7a-9f3a-580a-a3ef-2841a561669b | kyle-mbp-work | 61934 | ce103524-0f5f-5aea-abad-b8529620b7bf | ESTABLISHED | 2019-04-18 15:26:49.000 | 192.168.1.161 | false | 18.213.163.112 | 191 | 20190418 | 0 | 0 | 443 | ||||||
| 6 | 2 | 1024 | 854 | 984d4a7a-9f3a-580a-a3ef-2841a561669b | kyle-mbp-work | 61573 | c2f00244-9fa4-5c47-a49b-9bd0390d169f | ESTABLISHED | 2019-04-18 15:26:49.000 | 192.168.1.161 | false | 149.96.6.118 | 33 | 20190418 | 0 | 0 | 443 | ||||||
| 6 | 2 | 1024 | 2545 | 984d4a7a-9f3a-580a-a3ef-2841a561669b | kyle-mbp-work | 61919 | 0439a9f5-130d-5ff4-a8df-d72275e4b9e2 | ESTABLISHED | 2019-04-18 15:26:49.000 | 192.168.1.161 | false | 18.213.163.112 | 54 | 20190418 | 0 | 0 | 443 | ||||||
| 6 | 2 | 1024 | 854 | 984d4a7a-9f3a-580a-a3ef-2841a561669b | kyle-mbp-work | 61573 | fe0218c2-b337-5198-ac9c-a1f8784a2c08 | ESTABLISHED | 2019-04-18 15:26:49.000 | 192.168.1.161 | false | 149.96.6.118 | 62 | 20190418 | 0 | 0 | 443 | ||||||
| 6 | 2 | 1024 | 854 | 984d4a7a-9f3a-580a-a3ef-2841a561669b | kyle-mbp-work | 61939 | 6194c89c-171c-55c8-9355-5b53a4a28a5a | ESTABLISHED | 2019-04-18 15:26:49.000 | 192.168.1.161 | true | 149.96.6.118 | 7 | 20190418 | 0 | 0 | 443 |
3. uptycs-get-alerts
return alerts from Uptycs DB
Base Command
uptycs-get-alerts
Input
| Argument Name | Description | Required |
|---|---|---|
| alert_id | Unique Uptycs alert id which will retrieve a specific alert. Use this argument without any other arguments. | Optional |
| asset_id | Only return assets with this asset id. Do not use arguments “asset_id”, “host_name_is” or “host_name_like” at the same time. | Optional |
| code | Alert code to specify which types of alerts you would like to retrieve | Optional |
| host_name_is | Only return assets with this hostname. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| host_name_like | Only return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
| start_window | Beginning of window to search for open connections. Format is “YYYY-MM-DD HH:MM:SS.000”, for example, March 15, 2019 at 1:52:36 am would be written as “2019-03-15 01:52:36.000”. | Optional |
| end_window | End of window to search for open connections. Format is “YYYY-MM-DD HH:MM:SS.000”, for example, March 15, 2019 at 1:52:36 am would be written as “2019-03-15 01:52:36.000”. | Optional |
| time_ago | Specifies how far back you want to look. Format examples: 2 hours, 4 minutes, 6 month, 1 day, etc. | Optional |
| value | Varies for different alerts. For example, a Bad IP alert would have the IP address as the value. A program crash alert would have the name of the program which crashed as the value. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.Alerts.description | string | Description of alert |
| Uptycs.Alerts.upt_asset_id | string | Uptycs asset ID |
| Uptycs.Alerts.code | string | Alert code in Uptycs DB |
| Uptycs.Alerts.severity | string | The severity of the alert |
| Uptycs.Alerts.alert_time | date | Time alert was created at |
| Uptycs.Alerts.value | string | Specific problem which caused an alert. It may be an IP address, a program that crashed, a file with a file hash known to be malware, etc. |
| Uptycs.Alerts.host_name | string | Hostname for the asset which fired the alert |
| Uptycs.Alerts.id | string | unique Uptycs id for a particular alert |
| Uptycs.Alerts.threat_indicator_id | string | unique Uptycs id that identifies the threat indicator which triggered this alert |
| Uptycs.Alerts.threat_source_name | string | name of the source of the threat indicator that triggered this alert |
| Uptycs.Alerts.pid | number | pid of the process which was responsible for firing the alert |
Command Example
uptycs-get-alerts limit=1 time_ago="30 days"
Context Example
{
"Uptycs.Alerts": [
{
"status": "open",
"code": "OSX_CRASHES",
"description": "Crash",
"threat_source_name": "No threat source for this alert",
"severity": "medium",
"created_at": "2019-07-02 11:41:25.915",
"pid": 437,
"updated_at": "2019-07-02 11:41:25.915",
"value": "Amazon Music Helper",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"threat_indicator_id": "No threat indicator for this alert",
"alert_time": "2019-07-02 11:41:22.000",
"host_name": "kyle-mbp-work",
"key": "identifier",
"assigned_to": null,
"metadata": "{\"type\":\"application\",\"pid\":437,\"path\":\"/Applications/Amazon Music.app/Contents/MacOS/Amazon Music Helper\",\"crash_path\":\"/Library/Logs/DiagnosticReports/Amazon Music Helper_2019-06-02-103630_Kyles-MacBook-Pro.crash\",\"parent\":1,\"responsible\":\"Amazon Music Helper [437]\",\"exception_type\":\"EXC_BAD_ACCESS (SIGSEGV)\",\"identifier\":\"Amazon Music Helper\"}",
"id": "0049641c-1645-4b98-830f-7f1ce783bfcc",
"grouping": "OS X Crashes"
}
]
}
Human Readable Output
Uptycs Alerts
| upt_asset_id | host_name | grouping | alert_time | description | value | severity | threat_indicator_id | threat_source_name |
|---|---|---|---|---|---|---|---|---|
| 984d4a7a-9f3a-580a-a3ef-2841a561669b | kyle-mbp-work | OS X Crashes | 2019-07-02 11:41:22.000 | Crash | Amazon Music Helper | medium | No threat indicator for this alert | No threat source for this alert |
4. uptycs-get-alert-rules
retrieve a list of alert rules
Base Command
uptycs-get-alert-rules
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
Context Output
There is no context output for this command.
Command Example
uptycs-get-alert-rules limit=1
Context Example
Human Readable Output
Uptycs Alert Rules
| name | description | grouping | enabled | updatedAt | code |
|---|---|---|---|---|---|
| Bad Domain Alert | Bad Domain Alert | Bad Domain | true | 2019-06-19T08:17:04.892Z | BAD_DOMAIN |
5. uptycs-get-event-rules
retrieve a list of event rules
Base Command
uptycs-get-event-rules
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
Context Output
There is no context output for this command.
Command Example
uptycs-get-event-rules limit=1
Context Example
Human Readable Output
Uptycs Event Rules
| name | description | grouping | enabled | updatedAt | code |
|---|---|---|---|---|---|
| Bad domain | Malicious domain resolved | default | true | 2019-06-19T08:17:05.115Z | BAD_DOMAIN |
6. uptycs-get-events
return events from Uptycs DB
Base Command
uptycs-get-events
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Only return assets with this asset id. Do not use arguments “asset_id”, “host_name_is” or “host_name_like” at the same time. | Optional |
| code | Event code to specify which types of events you would like to retrieve | Optional |
| host_name_is | Only return assets with this hostname. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| host_name_like | Only return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
| start_window | Beginning of window to search for open connections. Format is “YYYY-MM-DD HH:MM:SS.000”, for example, March 15, 2019 at 1:52:36 am would be written as “2019-03-15 01:52:36.000”. | Optional |
| end_window | End of window to search for open connections. Format is “YYYY-MM-DD HH:MM:SS.000”, for example, March 15, 2019 at 1:52:36 am would be written as “2019-03-15 01:52:36.000”. | Optional |
| time_ago | Specifies how far back you want to look. Format examples: 2 hours, 4 minutes, 6 month, 1 day, etc. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.Events.description | string | Description of event |
| Uptycs.Events.asset_id | string | Uptycs asset ID |
| Uptycs.Events.code | string | Event code in Uptycs DB |
| Uptycs.Events.created_at | date | Time event was created at |
| Uptycs.Events.id | string | Uptycs event id for this particular event |
| Uptycs.Events.host_name | string | Hostname for the assets this event occurred on |
| Uptycs.Events.grouping | string | Group that this event belongs to |
| Uptycs.Events.value | string | The value will be different for different types of events. It is that which triggered the event. For example, a Bad IP connection will have the IP address here, and a program crash will have the name of the program that crashed here. |
| Uptycs.Events.severity | string | The severity of the event |
Command Example
uptycs-get-events limit=10 time_ago="30 days"
Context Example
{
"Uptycs.Events": [
{
"code": "OSX_CRASHES",
"description": "Crash",
"event_time": "2019-07-07 13:03:11.000",
"severity": "medium",
"created_at": "2019-07-07 13:03:16.000",
"value": "mediaremoted",
"upt_asset_id": "a9bf504c-6bdc-5e56-8c8e-efeec2b1497d",
"host_name": "brandons-mini.fios-router.home",
"key": "identifier",
"metadata": "{\"type\":\"application\",\"pid\":11895,\"path\":\"/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted\",\"crash_path\":\"/Library/Logs/DiagnosticReports/mediaremoted_2019-06-09-101301_Brandons-Mac-mini.crash\",\"parent\":1,\"responsible\":\"mediaremoted [11895]\",\"exception_type\":\"EXC_BAD_ACCESS (SIGSEGV)\"}",
"id": "8c99676b-02b6-4806-a1d8-a8dff3c55d1e",
"grouping": "OS X Crashes"
},
{
"code": "OSX_CRASHES",
"description": "Crash",
"event_time": "2019-07-02 11:41:22.000",
"severity": "medium",
"created_at": "2019-07-02 11:41:25.000",
"value": "Amazon Music Helper",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"host_name": "kyle-mbp-work",
"key": "identifier",
"metadata": "{\"type\":\"application\",\"pid\":437,\"path\":\"/Applications/Amazon Music.app/Contents/MacOS/Amazon Music Helper\",\"crash_path\":\"/Library/Logs/DiagnosticReports/Amazon Music Helper_2019-06-02-103630_Kyles-MacBook-Pro.crash\",\"parent\":1,\"responsible\":\"Amazon Music Helper [437]\",\"exception_type\":\"EXC_BAD_ACCESS (SIGSEGV)\"}",
"id": "19237e6f-b5b4-4ec7-b0dc-6b6b011f1038",
"grouping": "OS X Crashes"
},
{
"code": "OSX_CRASHES",
"description": "Crash",
"event_time": "2019-06-27 09:26:25.000",
"severity": "medium",
"created_at": "2019-06-27 09:26:31.000",
"value": "Amazon Music Helper",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"host_name": "kyle-mbp-work",
"key": "identifier",
"metadata": "{\"type\":\"application\",\"pid\":437,\"path\":\"/Applications/Amazon Music.app/Contents/MacOS/Amazon Music Helper\",\"crash_path\":\"/Library/Logs/DiagnosticReports/Amazon Music Helper_2019-06-02-103630_Kyles-MacBook-Pro.crash\",\"parent\":1,\"responsible\":\"Amazon Music Helper [437]\",\"exception_type\":\"EXC_BAD_ACCESS (SIGSEGV)\"}",
"id": "7d9e815a-4739-4608-936f-f0cfa5968e3d",
"grouping": "OS X Crashes"
},
{
"code": "OSX_CRASHES",
"description": "Crash",
"event_time": "2019-06-27 09:26:25.000",
"severity": "medium",
"created_at": "2019-06-27 09:26:31.000",
"value": "osqueryd",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"host_name": "kyle-mbp-work",
"key": "identifier",
"metadata": "{\"type\":\"application\",\"pid\":11602,\"path\":\"/usr/local/bin/osqueryd\",\"crash_path\":\"/Library/Logs/DiagnosticReports/osqueryd_2019-05-27-195843_Kyles-MacBook-Pro.crash\",\"parent\":11596,\"responsible\":\"osqueryd [11602]\",\"exception_type\":\"EXC_BAD_ACCESS (SIGSEGV)\"}",
"id": "d066187e-18a7-4ff1-8e9a-7e87346391dc",
"grouping": "OS X Crashes"
},
{
"code": "OSX_CRASHES",
"description": "Crash",
"event_time": "2019-06-27 00:08:17.000",
"severity": "medium",
"created_at": "2019-06-27 00:08:22.000",
"value": "mediaremoted",
"upt_asset_id": "a9bf504c-6bdc-5e56-8c8e-efeec2b1497d",
"host_name": "brandons-mini.fios-router.home",
"key": "identifier",
"metadata": "{\"type\":\"application\",\"pid\":11895,\"path\":\"/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted\",\"crash_path\":\"/Library/Logs/DiagnosticReports/mediaremoted_2019-06-09-101301_Brandons-Mac-mini.crash\",\"parent\":1,\"responsible\":\"mediaremoted [11895]\",\"exception_type\":\"EXC_BAD_ACCESS (SIGSEGV)\"}",
"id": "c3838f00-2358-46ef-a558-4417cce2e59e",
"grouping": "OS X Crashes"
},
{
"code": "OSX_CRASHES",
"description": "Crash",
"event_time": "2019-06-25 15:19:08.000",
"severity": "medium",
"created_at": "2019-06-25 15:19:22.000",
"value": "Amazon Music Helper",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"host_name": "kyle-mbp-work",
"key": "identifier",
"metadata": "{\"type\":\"application\",\"pid\":437,\"path\":\"/Applications/Amazon Music.app/Contents/MacOS/Amazon Music Helper\",\"crash_path\":\"/Library/Logs/DiagnosticReports/Amazon Music Helper_2019-06-02-103630_Kyles-MacBook-Pro.crash\",\"parent\":1,\"responsible\":\"Amazon Music Helper [437]\",\"exception_type\":\"EXC_BAD_ACCESS (SIGSEGV)\"}",
"id": "7e1a3764-31ed-49cc-9cd0-23159d3d40c0",
"grouping": "OS X Crashes"
},
{
"code": "OSX_CRASHES",
"description": "Crash",
"event_time": "2019-06-25 15:19:08.000",
"severity": "medium",
"created_at": "2019-06-25 15:19:22.000",
"value": "osqueryd",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"host_name": "kyle-mbp-work",
"key": "identifier",
"metadata": "{\"type\":\"application\",\"pid\":11602,\"path\":\"/usr/local/bin/osqueryd\",\"crash_path\":\"/Library/Logs/DiagnosticReports/osqueryd_2019-05-27-195843_Kyles-MacBook-Pro.crash\",\"parent\":11596,\"responsible\":\"osqueryd [11602]\",\"exception_type\":\"EXC_BAD_ACCESS (SIGSEGV)\"}",
"id": "6ece8d0b-7498-46e5-b8f0-d14773c96aa2",
"grouping": "OS X Crashes"
},
{
"code": "OSX_CRASHES",
"description": "Crash",
"event_time": "2019-06-24 19:25:30.000",
"severity": "medium",
"created_at": "2019-06-24 19:25:35.000",
"value": "mediaremoted",
"upt_asset_id": "a9bf504c-6bdc-5e56-8c8e-efeec2b1497d",
"host_name": "brandons-mini.fios-router.home",
"key": "identifier",
"metadata": "{\"type\":\"application\",\"pid\":11895,\"path\":\"/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted\",\"crash_path\":\"/Library/Logs/DiagnosticReports/mediaremoted_2019-06-09-101301_Brandons-Mac-mini.crash\",\"parent\":1,\"responsible\":\"mediaremoted [11895]\",\"exception_type\":\"EXC_BAD_ACCESS (SIGSEGV)\"}",
"id": "8c14a1a5-0f86-4a50-a4ca-973a83003482",
"grouping": "OS X Crashes"
},
{
"code": "OSX_CRASHES",
"description": "Crash",
"event_time": "2019-06-23 22:23:49.000",
"severity": "medium",
"created_at": "2019-06-23 22:23:51.000",
"value": "Amazon Music Helper",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"host_name": "kyle-mbp-work",
"key": "identifier",
"metadata": "{\"type\":\"application\",\"pid\":437,\"path\":\"/Applications/Amazon Music.app/Contents/MacOS/Amazon Music Helper\",\"crash_path\":\"/Library/Logs/DiagnosticReports/Amazon Music Helper_2019-06-02-103630_Kyles-MacBook-Pro.crash\",\"parent\":1,\"responsible\":\"Amazon Music Helper [437]\",\"exception_type\":\"EXC_BAD_ACCESS (SIGSEGV)\"}",
"id": "26464fa2-6dc2-4e01-9b0f-f7d57b9d1b3d",
"grouping": "OS X Crashes"
},
{
"code": "OSX_CRASHES",
"description": "Crash",
"event_time": "2019-06-23 22:23:49.000",
"severity": "medium",
"created_at": "2019-06-23 22:23:51.000",
"value": "osqueryd",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"host_name": "kyle-mbp-work",
"key": "identifier",
"metadata": "{\"type\":\"application\",\"pid\":11602,\"path\":\"/usr/local/bin/osqueryd\",\"crash_path\":\"/Library/Logs/DiagnosticReports/osqueryd_2019-05-27-195843_Kyles-MacBook-Pro.crash\",\"parent\":11596,\"responsible\":\"osqueryd [11602]\",\"exception_type\":\"EXC_BAD_ACCESS (SIGSEGV)\"}",
"id": "3a0f7ef8-9c3e-4267-8fbc-cc148e0edc9b",
"grouping": "OS X Crashes"
}
]
}
Human Readable Output
Uptycs Events
| host_name | grouping | event_time | description | value | severity |
|---|---|---|---|---|---|
| brandons-mini.fios-router.home | OS X Crashes | 2019-07-07 13:03:11.000 | Crash | mediaremoted | medium |
| kyle-mbp-work | OS X Crashes | 2019-07-02 11:41:22.000 | Crash | Amazon Music Helper | medium |
| kyle-mbp-work | OS X Crashes | 2019-06-27 09:26:25.000 | Crash | Amazon Music Helper | medium |
| kyle-mbp-work | OS X Crashes | 2019-06-27 09:26:25.000 | Crash | osqueryd | medium |
| brandons-mini.fios-router.home | OS X Crashes | 2019-06-27 00:08:17.000 | Crash | mediaremoted | medium |
| kyle-mbp-work | OS X Crashes | 2019-06-25 15:19:08.000 | Crash | Amazon Music Helper | medium |
| kyle-mbp-work | OS X Crashes | 2019-06-25 15:19:08.000 | Crash | osqueryd | medium |
| brandons-mini.fios-router.home | OS X Crashes | 2019-06-24 19:25:30.000 | Crash | mediaremoted | medium |
| kyle-mbp-work | OS X Crashes | 2019-06-23 22:23:49.000 | Crash | Amazon Music Helper | medium |
| kyle-mbp-work | OS X Crashes | 2019-06-23 22:23:49.000 | Crash | osqueryd | medium |
7. uptycs-get-process-open-sockets
find processes which opened a socket
Base Command
uptycs-get-process-open-sockets
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Only return assets with this asset id. Do not use arguments “asset_id”, “host_name_is” or “host_name_like” at the same time. | Optional |
| host_name_is | Only return assets with this hostname. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| host_name_like | Only return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| ip | IP address which process opened a socket to. | Optional |
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
| start_window | Beginning of window to search for open sockets. Format is “YYYY-MM-DD HH:MM:SS.000”, for example, March 15, 2019 at 1:52:36 am would be written as “2019-03-15 01:52:36.000”. | Optional |
| end_window | End of window to search for open sockets. Format is “YYYY-MM-DD HH:MM:SS.000”, for example, March 15, 2019 at 1:52:36 am would be written as “2019-03-15 01:52:36.000”. | Optional |
| time | Exact time at which the socket was opened. | Optional |
| time_ago | Specifies how far back you want to look. Format examples: 2 hours, 4 minutes, 6 month, 1 day, etc. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.Sockets.pid | number | pid of process which opened a connection to a specified IP |
| Uptycs.Sockets.upt_hostname | string | hostname of the asset which ran the specified process |
| Uptycs.Sockets.upt_time | date | time at which the connection was opened |
| Uptycs.Sockets.path | string | file path to the process being run |
| Uptycs.Sockets.local_address | string | local IP for specified connection |
| Uptycs.Sockets.remote_address | string | remote IP for specified connection |
| Uptycs.Sockets.local_port | number | local port for specified connection |
| Uptycs.Sockets.remote_port | number | remote port for specified connection |
| Uptycs.Sockets.upt_asset_id | string | asset id for asset which ran the specified process |
| Uptycs.Sockets.socket | number | socket used to open the connection |
| Uptycs.Sockets.family | number | network protocol |
| Uptycs.Sockets.state | string | state of the connection |
| Uptycs.Sockets.protocol | number | transport protocol |
Command Example
uptycs-get-process-open-sockets limit=1
Context Example
{
"Uptycs.Sockets": [
{
"protocol": 6,
"socket": 0,
"family": 2,
"local_port": 54755,
"remote_port": 443,
"pid": 704,
"remote_address": "69.147.92.12",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"upt_time": "2019-07-19 17:03:31.000",
"state": "ESTABLISHED",
"upt_hostname": "kyle-mbp-work",
"path": null,
"local_address": "192.168.86.61"
}
]
}
Human Readable Output
process_open_sockets
| upt_hostname | pid | local_address | remote_address | upt_time | local_port | remote_port | socket |
|---|---|---|---|---|---|---|---|
| kyle-mbp-work | 704 | 192.168.86.61 | 69.147.92.12 | 2019-07-19 17:03:31.000 | 54755 | 443 | 0 |
8. uptycs-get-process-information
get information for a particular process
Base Command
uptycs-get-process-information
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Only return assets with this asset id. Do not use arguments “asset_id” and “host_name_is” at the same time. | Optional |
| host_name_is | Hostname for asset which spawned the specified process. | Optional |
| pid | pid for the process. | Required |
| time | Time that the specified process was spawned. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.Proc.pid | number | pid for the process |
| Uptycs.Proc.upt_hostname | string | hostname for asset which spawned the specified process |
| Uptycs.Proc.upt_asset_id | string | asset id for asset which spawned the specified process |
| Uptycs.Proc.parent | number | pid for the parent process |
| Uptycs.Proc.upt_add_time | date | time that the process was spawned |
| Uptycs.Proc.upt_remove_time | date | time that the process was removed |
| Uptycs.Proc.path | string | path to the process binary |
| Uptycs.Proc.name | string | name of the process |
| Uptycs.Proc.cmdline | string | complete argv of the process |
| Uptycs.Proc.pgroup | number | process group |
| Uptycs.Proc.cwd | string | process current working directory |
Command Example
uptycs-get-process-information asset_id="984d4a7a-9f3a-580a-a3ef-2841a561669b" pid=5119 time="2019-01-29 17:05:07.000"
Context Example
{
"Uptycs.Proc": [
{
"name": "VBoxHeadless",
"parent": 484,
"upt_add_time": "2019-01-29 16:14:27.000",
"pid": 5119,
"upt_remove_time": "2019-01-29 19:21:31.000 UTC",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"cmdline": "/Applications/VirtualBox.app/Contents/MacOS/VBoxHeadless --comment vagrant_default_1535385658307_92120 --startvm 11742093-a8fa-4189-a88c-afc4cb7c70a6 --vrde config",
"upt_hostname": "kyle-mbp-work",
"pgroup": 5119,
"path": "/Applications/VirtualBox.app/Contents/MacOS/VBoxHeadless",
"cwd": "/Applications",
"upt_day": 20190129
}
]
}
Human Readable Output
Process information
| upt_hostname | parent | pid | name | path | cmdline |
|---|---|---|---|---|---|
| kyle-mbp-work | 484 | 5119 | VBoxHeadless | /Applications/VirtualBox.app/Contents/MacOS/VBoxHeadless | /Applications/VirtualBox.app/Contents/MacOS/VBoxHeadless –comment vagrant_default_1535385658307_92120 –startvm 11742093-a8fa-4189-a88c-afc4cb7c70a6 –vrde config |
9. uptycs-get-process-child-processes
get all the child processes for a given parent process
Base Command
uptycs-get-process-child-processes
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Only return assets with this asset_id. Do not use arguments “asset_id” and “host_name_is” at the same time. | Optional |
| host_name_is | hostname for the asset which executed these processes. | Optional |
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
| parent | The pid for which all child processes will be found | Required |
| parent_start_time | time at which the parent process was spawned | Required |
| parent_end_time | time at which the parent process was killed, if it exists. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.Children.pid | number | pid of a child process |
| Uptycs.Children.upt_asset_id | string | asset id for asset which this process was run on |
| Uptycs.Children.upt_hostname | string | hostname for asset which spawned the specified process |
| Uptycs.Children.upt_add_time | date | time that the process was spawned |
| Uptycs.Children.upt_remove_time | date | time that the process was removed |
| Uptycs.Children.path | string | path to the process binary |
| Uptycs.Children.parent | number | parent pid |
| Uptycs.Children.name | string | name of the process |
| Uptycs.Children.cmdline | string | complete argv for the process |
| Uptycs.Children.pgroup | number | process group |
| Uptycs.Children.cwd | string | process current working directory |
Command Example
uptycs-get-process-child-processes asset_id="984d4a7a-9f3a-580a-a3ef-2841a561669b" parent=484 parent_start_time="2019-01-28 14:16:58.000" parent_end_time="2019-01-29 19:21:31.000"
Context Example
{
"Uptycs.Children": [
{
"name": "VBoxHeadless",
"parent": 484,
"upt_add_time": "2019-01-29 16:14:27.000",
"pid": 5119,
"upt_remove_time": "2019-01-29 19:21:31.000 UTC",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"cmdline": "/Applications/VirtualBox.app/Contents/MacOS/VBoxHeadless --comment vagrant_default_1535385658307_92120 --startvm 11742093-a8fa-4189-a88c-afc4cb7c70a6 --vrde config",
"upt_hostname": "kyle-mbp-work",
"pgroup": 5119,
"path": "/Applications/VirtualBox.app/Contents/MacOS/VBoxHeadless",
"cwd": "/Applications",
"upt_day": 20190129
},
{
"name": "VirtualBoxVM",
"parent": 484,
"upt_add_time": "2019-01-29 16:00:17.000",
"pid": 5008,
"upt_remove_time": "2019-01-29 16:13:55.000 UTC",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"cmdline": "/Applications/VirtualBox.app/Contents/Resources/VirtualBoxVM.app/Contents/MacOS/VirtualBoxVM --comment vagrant_default_1535385658307_92120 --startvm 11742093-a8fa-4189-a88c-afc4cb7c70a6 --no-startvm-errormsgbox",
"upt_hostname": "kyle-mbp-work",
"pgroup": 5008,
"path": "/Applications/VirtualBox.app/Contents/MacOS/VirtualBoxVM",
"cwd": "/Applications",
"upt_day": 20190129
},
{
"name": "VirtualBoxVM",
"parent": 484,
"upt_add_time": "2019-01-29 15:58:10.000",
"pid": 5002,
"upt_remove_time": "2019-01-29 16:00:17.000 UTC",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"cmdline": "/Applications/VirtualBox.app/Contents/Resources/VirtualBoxVM.app/Contents/MacOS/VirtualBoxVM --comment basevm_centos_7_orig --startvm 58264539-0e7a-418f-91be-365aa0f20854 --no-startvm-errormsgbox",
"upt_hostname": "kyle-mbp-work",
"pgroup": 5002,
"path": "/Applications/VirtualBox.app/Contents/MacOS/VirtualBoxVM",
"cwd": "/Applications",
"upt_day": 20190129
},
{
"name": "VirtualBoxVM",
"parent": 484,
"upt_add_time": "2019-01-29 15:55:32.000",
"pid": 4994,
"upt_remove_time": "2019-01-29 15:57:38.000 UTC",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"cmdline": "/Applications/VirtualBox.app/Contents/Resources/VirtualBoxVM.app/Contents/MacOS/VirtualBoxVM --comment vagrant_default_1535385658307_92120 --startvm 11742093-a8fa-4189-a88c-afc4cb7c70a6 --no-startvm-errormsgbox",
"upt_hostname": "kyle-mbp-work",
"pgroup": 4994,
"path": "/Applications/VirtualBox.app/Contents/MacOS/VirtualBoxVM",
"cwd": "/Applications",
"upt_day": 20190129
},
{
"name": "VirtualBoxVM",
"parent": 484,
"upt_add_time": "2019-01-28 17:00:39.000",
"pid": 3448,
"upt_remove_time": "2019-01-28 22:27:17.000 UTC",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"cmdline": "/Applications/VirtualBox.app/Contents/Resources/VirtualBoxVM.app/Contents/MacOS/VirtualBoxVM --comment ova-31822- --startvm d7414d11-5764-4583-aeb6-94e5527c851c --no-startvm-errormsgbox",
"upt_hostname": "kyle-mbp-work",
"pgroup": 3448,
"path": "/Applications/VirtualBox.app/Contents/MacOS/VirtualBoxVM",
"cwd": "/Applications",
"upt_day": 20190128
}
]
}
Human Readable Output
Child processes of a specified pid
| upt_hostname | pid | name | path | cmdline | upt_add_time |
|---|---|---|---|---|---|
| kyle-mbp-work | 5119 | VBoxHeadless | /Applications/VirtualBox.app/Contents/MacOS/VBoxHeadless | /Applications/VirtualBox.app/Contents/MacOS/VBoxHeadless –comment vagrant_default_1535385658307_92120 –startvm 11742093-a8fa-4189-a88c-afc4cb7c70a6 –vrde config | 2019-01-29 16:14:27.000 |
| kyle-mbp-work | 5008 | VirtualBoxVM | /Applications/VirtualBox.app/Contents/MacOS/VirtualBoxVM | /Applications/VirtualBox.app/Contents/Resources/VirtualBoxVM.app/Contents/MacOS/VirtualBoxVM –comment vagrant_default_1535385658307_92120 –startvm 11742093-a8fa-4189-a88c-afc4cb7c70a6 –no-startvm-errormsgbox | 2019-01-29 16:00:17.000 |
| kyle-mbp-work | 5002 | VirtualBoxVM | /Applications/VirtualBox.app/Contents/MacOS/VirtualBoxVM | /Applications/VirtualBox.app/Contents/Resources/VirtualBoxVM.app/Contents/MacOS/VirtualBoxVM –comment basevm_centos_7_orig –startvm 58264539-0e7a-418f-91be-365aa0f20854 –no-startvm-errormsgbox | 2019-01-29 15:58:10.000 |
| kyle-mbp-work | 4994 | VirtualBoxVM | /Applications/VirtualBox.app/Contents/MacOS/VirtualBoxVM | /Applications/VirtualBox.app/Contents/Resources/VirtualBoxVM.app/Contents/MacOS/VirtualBoxVM –comment vagrant_default_1535385658307_92120 –startvm 11742093-a8fa-4189-a88c-afc4cb7c70a6 –no-startvm-errormsgbox | 2019-01-29 15:55:32.000 |
| kyle-mbp-work | 3448 | VirtualBoxVM | /Applications/VirtualBox.app/Contents/MacOS/VirtualBoxVM | /Applications/VirtualBox.app/Contents/Resources/VirtualBoxVM.app/Contents/MacOS/VirtualBoxVM –comment ova-31822- –startvm d7414d11-5764-4583-aeb6-94e5527c851c –no-startvm-errormsgbox | 2019-01-28 17:00:39.000 |
10. uptycs-get-processes
find processes which are running or have run on a registered Uptycs asset
Base Command
uptycs-get-processes
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Only return assets with this asset id. Do not use arguments “asset_id”, “host_name_is” or “host_name_like” at the same time. | Optional |
| host_name_is | Only return assets with this hostname. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| host_name_like | Only return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
| start_window | Beginning of window to search for open connections. Format is “YYYY-MM-DD HH:MM:SS.000”, for example, March 15, 2019 at 1:52:36 am would be written as “2019-03-15 01:52:36.000”. | Optional |
| end_window | End of window to search for open connections. Format is “YYYY-MM-DD HH:MM:SS.000”, for example, March 15, 2019 at 1:52:36 am would be written as “2019-03-15 01:52:36.000”. | Optional |
| time | Exact time at which the process was spawned. | Optional |
| time_ago | Specifies how far back you want to look. Format examples: 2 hours, 4 minutes, 6 month, 1 day, etc. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.Process.pid | number | pid for a particular process |
| Uptycs.Process.parent | number | pid for the parent of a particular process |
| Uptycs.Process.upt_asset_id | string | uptycs asset id for the asset which is running (or ran) the process |
| Uptycs.Process.upt_hostname | string | host name for the asset which is running (or ran) the process |
| Uptycs.Process.upt_time | date | time at which the process was spawned |
| Uptycs.Process.name | string | name of the process |
| Uptycs.Process.path | string | path to the process binary |
| Uptycs.Process.cmdline | string | comeplete argv for the process |
| Uptycs.Process.pgroup | number | process group |
| Uptycs.Process.cwd | string | process current working directory |
Command Example
uptycs-get-processes limit=1
Context Example
{
"Uptycs.Process": [
{
"name": "SCHelper",
"parent": 1,
"upt_time": "2019-07-19 07:29:32.000",
"pid": 60051,
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"cmdline": "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/Helpers/SCHelper",
"upt_hostname": "kyle-mbp-work",
"pgroup": 60051,
"path": "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/Helpers/SCHelper",
"cwd": "/"
}
]
}
Human Readable Output
Processes
| upt_hostname | pid | name | path | upt_time | parent | cmdline |
|---|---|---|---|---|---|---|
| kyle-mbp-work | 60051 | SCHelper | /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/Helpers/SCHelper | 2019-07-19 07:29:32.000 | 1 | /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/Helpers/SCHelper |
11. uptycs-get-process-open-files
find processes which have opened files
Base Command
uptycs-get-process-open-files
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Only return assets with this asset id. Do not use arguments “asset_id”, “host_name_is” or “host_name_like” at the same time. | Optional |
| host_name_is | Only return assets with this hostname. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| host_name_like | Only return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
| start_window | Beginning of window to search for open connections. Format is “YYYY-MM-DD HH:MM:SS.000”, for example, March 15, 2019 at 1:52:36 am would be written as “2019-03-15 01:52:36.000”. | Optional |
| end_window | End of window to search for open connections. Format is “YYYY-MM-DD HH:MM:SS.000”, for example, March 15, 2019 at 1:52:36 am would be written as “2019-03-15 01:52:36.000”. | Optional |
| time | Exact time at which the process was spawned. | Optional |
| time_ago | Specifies how far back you want to look. Format examples: 2 hours, 4 minutes, 6 month, 1 day, etc. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.Files.pid | number | pid for the process which opened a file |
| Uptycs.Files.fd | number | process specific file descriptor number |
| Uptycs.Files.upt_asset_id | string | Uptycs asset id for the the asset on which the file was opened |
| Uptycs.Files.upt_hostname | string | Host name for the asset on which the file was opened |
| Uptycs.Files.upt_time | date | time at which the file was opened |
| Uptycs.Files.path | string | filesystem path of the file descriptor |
Command Example
uptycs-get-process-open-files limit=1
Context Example
{
"Uptycs.Files": [
{
"pid": 30143,
"upt_asset_id": "a4991bf9-13e3-026b-7b46-af192746d556",
"upt_hostname": "uptycs-osquery-mhntm",
"fd": 35,
"upt_time": "2019-07-19 17:00:38.000",
"path": "/var/osquery/osquery.db/001951.log"
}
]
}
Human Readable Output
Process which has opened a file
| upt_hostname | pid | path | fd | upt_time |
|---|---|---|---|---|
| uptycs-osquery-mhntm | 30143 | /var/osquery/osquery.db/001951.log | 35 | 2019-07-19 17:00:38.000 |
12. uptycs-set-alert-status
Set the status of an alert to new, assigned, resolved, or closed
Base Command
uptycs-set-alert-status
Input
| Argument Name | Description | Required |
|---|---|---|
| alert_id | Uptycs alert id used to identify a particular alert | Required |
| status | Status of the alert can be new, assigned, resolved, or closed | Required |
Context Output
There is no context output for this command.
Command Example
uptycs-set-alert-status alert_id="9cb18abd-2c9a-43a8-988a-0601e9140f6c" status=assigned
Context Example
{
"Uptycs.AlertStatus": {
"status": "assigned",
"code": "OUTBOUND_CONNECTION_TO_THREAT_IOC",
"updatedAt": "2019-07-19T17:07:27.447Z",
"updatedByEmail": "goo@test.com",
"updatedByAdmin": true,
"updatedBy": "B schmoll",
"id": "9cb18abd-2c9a-43a8-988a-0601e9140f6c",
"createdAt": "2019-02-22T21:13:21.238Z"
}
}
Human Readable Output
Uptycs Alert Status
| id | code | status | createdAt | updatedAt |
|---|---|---|---|---|
| 9cb18abd-2c9a-43a8-988a-0601e9140f6c | OUTBOUND_CONNECTION_TO_THREAT_IOC | assigned | 2019-02-22T21:13:21.238Z | 2019-07-19T17:07:27.447Z |
13. uptycs-set-asset-tag
Sets a tag on a particular asset
Base Command
uptycs-set-asset-tag
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Uptycs asset id for the asset that the tag should be set on | Required |
| tag_key | Tag key that will be set on the asset | Required |
| tag_value | Tag value that will be set on the asset | Optional |
Context Output
There is no context output for this command.
Command Example
uptycs-set-asset-tag asset_id="984d4a7a-9f3a-580a-a3ef-2841a561669b" tag_key="Uptycs" tag_value="work laptop"
Context Example
{
"Uptycs.AssetTags": {
"hostName": "kyle-mbp-work",
"tags": [
"Uptycs=work laptop",
"owner=Uptycs office",
"network=low",
"cpu=unknown",
"memory=unknown",
"disk=high"
]
}
}
Human Readable Output
Uptycs Asset Tag
| hostName | tags |
|---|---|
| kyle-mbp-work | Uptycs=work laptop, owner=Uptycs office, network=low, cpu=unknown, memory=unknown, disk=high |
14. uptycs-get-user-information
get info for an Uptycs user
Base Command
uptycs-get-user-information
Input
| Argument Name | Description | Required |
|---|---|---|
| user_id | Unique Uptycs id for the user | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.UserInfo.id | string | unique Uptycs id for the user |
| Uptycs.UserInfo.name | string | Uptycs user’s name |
| Uptycs.UserInfo.email | string | Uptycs user’s email address |
Command Example
uptycs-get-user-information user_id="33436e24-f30f-42d0-8438-d948be12b5af"
Context Example
{
"Uptycs.UserInfo": {
"userObjectGroups": [
{
"userId": "33436e24-f30f-42d0-8438-d948be12b5af",
"updatedBy": null,
"objectGroupId": "106eef5e-c3a6-44eb-bb3d-1a2087cded3d",
"customerId": "e8213ef3-ef92-460e-a542-46dccd700c16",
"object_group_id": "106eef5e-c3a6-44eb-bb3d-1a2087cded3d",
"createdBy": null,
"updatedAt": "2018-09-24T17:24:45.606Z",
"id": "e10d6fbb-366c-4b89-86b3-89a1cd4ee83c",
"createdAt": "2018-09-24T17:24:45.606Z"
}
],
"userRoles": {
"admin": {
"description": "Default admin role",
"updatedBy": null,
"custom": false,
"createdBy": null,
"updatedAt": "2019-06-19T08:15:49.286Z",
"id": "01b8ce5d-c93a-41a6-ba63-2e26c7d2cd79",
"hidden": false,
"permissions": [
"ALERT:READ",
"ALERT_RULE:READ",
"ASSET:READ",
"CUSTOMER:READ",
"DESTINATION:READ",
"EVENT:READ",
"EVENT_RULE:READ",
"EXCEPTION:READ",
"FIM:READ",
"FLAG:READ",
"OBJECT_GROUP:READ",
"PROFILE:READ",
"PROMETHEUS_TARGET:READ",
"QUERY:READ",
"QUERY_PACK:READ",
"REPORT:READ",
"REPORT_RUN:READ",
"SCHEMA:READ",
"SCHEDULED_GROUP:READ",
"SCHEDULED_QUERY:READ",
"SNAPSHOT:READ",
"TAG:READ",
"TAG_RULE:READ",
"TEMPLATE:READ",
"THREAT:READ",
"USER:READ",
"USER_ROLE:READ",
"CURRENT_USER:UPDATE",
"CUSTOMER:QUERY",
"ASSET:QUERY",
"OSQUERY:DOWNLOAD",
"OSQUERY:READ",
"FEATURE_SET:READ",
"DASHBOARD:READ",
"CURRENT_USER_PREFERENCE:READ",
"CURRENT_USER_PREFERENCE:CREATE",
"CURRENT_USER_PREFERENCE:UPDATE",
"CURRENT_USER_PREFERENCE:DELETE",
"CURRENT_USER_REPORT_SCHEDULE:CREATE",
"CURRENT_USER_REPORT_SCHEDULE:READ",
"CURRENT_USER_REPORT_SCHEDULE:UPDATE",
"CURRENT_USER_REPORT_SCHEDULE:DELETE",
"COMPLIANCE_FAILURE:READ",
"COMPLIANCE_FAILURE:UPDATE",
"CUSTOM_PROFILE:READ",
"QUERY_JOB:CREATE",
"QUERY_JOB:READ",
"QUERY_JOB:UPDATE",
"QUERY_JOB:DELETE",
"EVENT_EXCLUDE_PROFILE:READ",
"ATC_QUERY:READ",
"REGISTRY_PATH:READ",
"AUDIT_RULE:READ",
"EXTERNAL_DASHBOARD:READ",
"ALERT:CREATE",
"ALERT:UPDATE",
"ALERT:DELETE",
"ALERT_RULE:CREATE",
"ALERT_RULE:UPDATE",
"ALERT_RULE:DELETE",
"API_KEY:CREATE",
"API_KEY:READ",
"API_KEY:UPDATE",
"API_KEY:DELETE",
"ASSET:UPDATE",
"ASSET:DELETE",
"ASSET_GROUP_RULE:CREATE",
"ASSET_GROUP_RULE:READ",
"ASSET_GROUP_RULE:UPDATE",
"ASSET_GROUP_RULE:DELETE",
"CUSTOMER:UPDATE",
"DESTINATION:CREATE",
"DESTINATION:UPDATE",
"DESTINATION:DELETE",
"EVENT:CREATE",
"EVENT:UPDATE",
"EVENT:DELETE",
"EVENT_RULE:CREATE",
"EVENT_RULE:UPDATE",
"EVENT_RULE:DELETE",
"EXCEPTION:CREATE",
"EXCEPTION:UPDATE",
"EXCEPTION:DELETE",
"FIM:CREATE",
"FIM:UPDATE",
"FIM:DELETE",
"FLAG:CREATE",
"FLAG:UPDATE",
"FLAG:DELETE",
"OBJECT_GROUP:CREATE",
"OBJECT_GROUP:UPDATE",
"OBJECT_GROUP:DELETE",
"PROMETHEUS_TARGET:CREATE",
"PROMETHEUS_TARGET:UPDATE",
"PROMETHEUS_TARGET:DELETE",
"QUERY:CREATE",
"QUERY:UPDATE",
"QUERY:DELETE",
"QUERY_PACK:CREATE",
"QUERY_PACK:UPDATE",
"QUERY_PACK:DELETE",
"REPORT:CREATE",
"REPORT:UPDATE",
"REPORT:DELETE",
"REPORT_RUN:CREATE",
"REPORT_RUN:UPDATE",
"REPORT_RUN:DELETE",
"SCHEDULED_GROUP:UPDATE",
"SCHEDULED_GROUP:DELETE",
"SCHEDULED_QUERY:CREATE",
"SCHEDULED_QUERY:UPDATE",
"SCHEDULED_QUERY:DELETE",
"SNAPSHOT:CREATE",
"SNAPSHOT:UPDATE",
"SNAPSHOT:DELETE",
"TAG:CREATE",
"TAG:UPDATE",
"TAG:DELETE",
"TAG_RULE:CREATE",
"TAG_RULE:UPDATE",
"TAG_RULE:DELETE",
"TEMPLATE:CREATE",
"TEMPLATE:UPDATE",
"TEMPLATE:DELETE",
"THREAT:CREATE",
"THREAT:UPDATE",
"THREAT:DELETE",
"USER:CREATE",
"USER:UPDATE",
"USER:DELETE",
"USER_ROLE:CREATE",
"USER_ROLE:UPDATE",
"USER_ROLE:DELETE",
"CURRENT_USER:READ",
"CURRENT_USER:UPDATE",
"CUSTOMER_FEATURE_SET:UPDATE",
"USER_PREFERENCE:CREATE",
"USER_PREFERENCE:READ",
"USER_PREFERENCE:UPDATE",
"USER_PREFERENCE:DELETE",
"REPORT_SCHEDULE:CREATE",
"REPORT_SCHEDULE:READ",
"REPORT_SCHEDULE:UPDATE",
"REPORT_SCHEDULE:DELETE",
"AUDIT_LOGS:READ",
"CUSTOM_PROFILE:CREATE",
"CUSTOM_PROFILE:UPDATE",
"CUSTOM_PROFILE:DELETE",
"EVENT_EXCLUDE_PROFILE:CREATE",
"EVENT_EXCLUDE_PROFILE:UPDATE",
"EVENT_EXCLUDE_PROFILE:DELETE",
"ATC_QUERY:CREATE",
"ATC_QUERY:UPDATE",
"ATC_QUERY:DELETE",
"REGISTRY_PATH:CREATE",
"REGISTRY_PATH:UPDATE",
"REGISTRY_PATH:DELETE",
"AUDIT_RULE:UPDATE",
"AUDIT_RULE:DELETE",
"AUDIT_RULE:CREATE",
"EXTERNAL_DASHBOARD:CREATE",
"EXTERNAL_DASHBOARD:UPDATE",
"EXTERNAL_DASHBOARD:DELETE"
],
"customerId": "e8213ef3-ef92-460e-a542-46dccd700c16",
"createdAt": "2018-09-24T17:24:41.194Z",
"name": "admin"
}
},
"email": "goo@test.com",
"name": "B schmoll",
"id": "33436e24-f30f-42d0-8438-d948be12b5af"
}
}
Human Readable Output
Uptycs User Information
| name | id | |
|---|---|---|
| B schmoll | goo@test.com | 33436e24-f30f-42d0-8438-d948be12b5af |
15. uptycs-get-threat-indicators
get Uptycs threat indicators
Base Command
uptycs-get-threat-indicators
Input
| Argument Name | Description | Required |
|---|---|---|
| indicator | the specific indicator you wish to search for. This can be an IP address, a Bad Domain, etc. as well ass any indicators you have added. | Optional |
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
Context Output
There is no context output for this command.
Command Example
uptycs-get-threat-indicators limit=1
Context Example
{
"Uptycs.ThreatIndicators": [
{
"indicator": "54.165.17.209",
"description": "malware.com",
"threatId": "b3f44b34-f6a1-46bc-88f1-9755e3ac1a65",
"indicatorType": "IPv4",
"createdAt": "2019-07-19T16:44:17.511Z",
"id": "8e54f94c-469a-4737-9eef-4e650a93ab58",
"isActive": true
}
]
}
Human Readable Output
Uptycs Threat Indicators
| id | indicator | description | indicatorType | createdAt | isActive | threatId |
|---|---|---|---|---|---|---|
| 8e54f94c-469a-4737-9eef-4e650a93ab58 | 54.165.17.209 | malware.com | IPv4 | 2019-07-19T16:44:17.511Z | true | b3f44b34-f6a1-46bc-88f1-9755e3ac1a65 |
16. uptycs-get-threat-sources
get Uptycs threat sources
Base Command
uptycs-get-threat-sources
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
Context Output
There is no context output for this command.
Command Example
uptycs-get-threat-sources limit=1
Context Example
{
"Uptycs.ThreatSources": [
{
"name": "AlienVault Open Threat Exchange Malicious Domains and IPs",
"url": "4533da856e43f06ee00bb5f1adf170a0ce5cacaca5992ab1279733c2bdd0a88c",
"enabled": true,
"custom": false,
"lastDownload": "2019-05-13T01:00:05.934Z",
"createdAt": "2019-05-12T01:01:04.154Z",
"description": "A feed of malicious domains and IP addresses"
}
]
}
Human Readable Output
Uptycs Threat Sources
| name | description | url | enabled | custom | createdAt | lastDownload |
|---|---|---|---|---|---|---|
| AlienVault Open Threat Exchange Malicious Domains and IPs | A feed of malicious domains and IP addresses | 4533da856e43f06ee00bb5f1adf170a0ce5cacaca5992ab1279733c2bdd0a88c | true | false | 2019-05-12T01:01:04.154Z | 2019-05-13T01:00:05.934Z |
17. uptycs-get-threat-vendors
get Uptycs threat vendors
Base Command
uptycs-get-threat-vendors
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
Context Output
There is no context output for this command.
Command Example
uptycs-get-threat-vendors
Context Example
{
"Uptycs.ThreatVendors": [
{
"name": "Bschmoll Inc.-Threats",
"url": null,
"updatedAt": "2018-11-20T19:15:05.611Z",
"customerId": "e8213ef3-ef92-460e-a542-46dccd700c16",
"numThreats": null,
"numIocs": null,
"lastDownload": null,
"id": "42b9220c-7e29-4fd8-9cf7-9f811e851f8e",
"createdAt": "2018-11-20T19:15:05.611Z",
"description": null
}
]
}
Human Readable Output
Uptycs Threat Vendors
| description | url | updatedAt | customerId | numIocs | numThreats | lastDownload | id | createdAt | name |
|---|---|---|---|---|---|---|---|---|---|
| 2018-11-20T19:15:05.611Z | e8213ef3-ef92-460e-a542-46dccd700c16 | 42b9220c-7e29-4fd8-9cf7-9f811e851f8e | 2018-11-20T19:15:05.611Z | Bschmoll Inc.-Threats |
18. uptycs-get-parent-information
get the parent process information for a particular child process
Base Command
uptycs-get-parent-information
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Only return assets with this asset id. Do not use arguments “asset_id” and “host_name_is” at the same time. | Optional |
| child_add_time | Time that the specified process was spawned. | Required |
| host_name_is | Hostname for asset which spawned the specified process. | Optional |
| parent | pid for the parent process. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.Parent.pid | number | pid of the process (this is the same number as the input argument ‘parent’) |
| Uptycs.Parent.upt_hostname | string | hostname for asset which spawned the specified process |
| Uptycs.Parent.upt_asset_id | string | asset id for asset which spawned the specified process |
| Uptycs.Parent.parent | number | pid for the parent process (this is the parent of the input argument ‘parent’) |
| Uptycs.Parent.upt_add_time | date | time that the process was spawned |
| Uptycs.Parent.upt_remove_time | date | time that the process was removed |
| Uptycs.Parent.name | string | name of the process |
| Uptycs.Parent.path | string | path to the process binary |
| Uptycs.Parent.cmdline | string | complete argv for the process |
| Uptycs.Parent.pgroup | number | process group |
| Uptycs.Parent.cwd | string | process current working directory |
Command Example
uptycs-get-parent-information asset_id="984d4a7a-9f3a-580a-a3ef-2841a561669b" child_add_time="2019-01-29 16:14:27.000" parent=484
Context Example
{
"Uptycs.Parent": [
{
"name": "VBoxSVC",
"parent": 1,
"upt_add_time": "2019-01-28 14:16:58.000",
"pid": 484,
"upt_remove_time": "2019-01-29 19:21:31.000 UTC",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"cmdline": "/Applications/VirtualBox.app/Contents/MacOS/VBoxSVC --auto-shutdown",
"upt_hostname": "kyle-mbp-work",
"pgroup": 484,
"path": "/Applications/VirtualBox.app/Contents/MacOS/VBoxSVC",
"cwd": "/Applications",
"upt_day": 20190128
}
]
}
Human Readable Output
Parent process information
| upt_hostname | parent | pid | name | path | cmdline |
|---|---|---|---|---|---|
| kyle-mbp-work | 1 | 484 | VBoxSVC | /Applications/VirtualBox.app/Contents/MacOS/VBoxSVC | /Applications/VirtualBox.app/Contents/MacOS/VBoxSVC –auto-shutdown |
19. uptycs-post-threat-source
post a new threat source to your threat sources in Uptycs
Base Command
uptycs-post-threat-source
Input
| Argument Name | Description | Required |
|---|---|---|
| description | A short description for the threat source | Required |
| entry_id | entry_id for the file with threat information. This file should be uploaded to Cortex XSOAR in the Playground War Room using the paperclip icon next to the CLI. | Required |
| filename | The name of the file being uploaded | Required |
| name | The name for the threat source | Required |
Context Output
There is no context output for this command.
Command Example
uptycs-post-threat-source name="testThreatSources" description="testing Uptycs API" entry_id="4322@27d41dbb-9676-4408-88bf-51193334caf7" filename="threatSourcesTest.csv"
Context Example
Human Readable Output
Uptycs Posted Threat Source
20. uptycs-get-users
get a list of Uptycs users
Base Command
uptycs-get-users
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.Users.id | string | unique Uptycs id for the user |
| Uptycs.Users.name | string | Uptycs user’s name |
| Uptycs.Users.email | string | Uptycs user’s email address |
| Uptycs.Users.createdAt | date | datetime this user was added |
| Uptycs.Users.updatedAt | date | last time this user was updated |
| Uptycs.Users.admin | boolean | true if this user has admin privileges, false otherwise |
| Uptycs.Users.active | boolean | true if this user is currently active, false otherwise |
Command Example
uptycs-get-users limit=1
Context Example
{
"Uptycs.Users": [
{
"name": "B schmoll",
"admin": true,
"id": "33436e24-f30f-42d0-8438-d948be12b5af",
"updatedAt": "2018-09-25T16:10:28.140Z",
"active": true,
"email": "goo@test.com",
"createdAt": "2018-09-24T17:24:38.635Z"
}
]
}
Human Readable Output
Uptycs Users
| name | id | admin | active | createdAt | updatedAt | |
|---|---|---|---|---|---|---|
| B schmoll | goo@test.com | 33436e24-f30f-42d0-8438-d948be12b5af | true | true | 2018-09-24T17:24:38.635Z | 2018-09-25T16:10:28.140Z |
21. uptycs-get-asset-groups
get Uptycs asset groups
Base Command
uptycs-get-asset-groups
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.AssetGroups.id | string | unique Uptycs id for a particular object group |
| Uptycs.AssetGroups.custom | boolean | true if this is a custom asset group, false otherwise |
| Uptycs.AssetGroups.createdAt | date | datetime the group was created |
| Uptycs.AssetGroups.updatedAt | date | datetime the group was last updated |
Command Example
uptycs-get-asset-groups
Context Example
{
"Uptycs.AssetGroups": [
{
"name": "assets",
"description": "Default asset group",
"custom": false,
"updatedAt": "2018-09-24T17:24:45.604Z",
"id": "106eef5e-c3a6-44eb-bb3d-1a2087cded3d",
"createdAt": "2018-09-24T17:24:45.604Z",
"objectType": "ASSET"
},
{
"name": "enrolling",
"description": "Enrolling asset group",
"custom": false,
"updatedAt": "2018-09-24T17:24:45.601Z",
"id": "a73353c1-1b27-4eea-9a7c-d2f946cca030",
"createdAt": "2018-09-24T17:24:45.601Z",
"objectType": "ASSET"
}
]
}
Human Readable Output
Uptycs Users
| id | name | description | objectType | custom | createdAt | updatedAt |
|---|---|---|---|---|---|---|
| 106eef5e-c3a6-44eb-bb3d-1a2087cded3d | assets | Default asset group | ASSET | false | 2018-09-24T17:24:45.604Z | 2018-09-24T17:24:45.604Z |
| a73353c1-1b27-4eea-9a7c-d2f946cca030 | enrolling | Enrolling asset group | ASSET | false | 2018-09-24T17:24:45.601Z | 2018-09-24T17:24:45.601Z |
22. uptycs-get-user-asset-groups
get a list of users in a particular asset group
Base Command
uptycs-get-user-asset-groups
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_group_id | return a list of users with access to this asset group | Required |
Context Output
There is no context output for this command.
Command Example
uptycs-get-user-asset-groups asset_group_id="106eef5e-c3a6-44eb-bb3d-1a2087cded3d"
Context Example
{
"Uptycs.UserGroups": {
"B schmoll": {
"email": "goo@test.com",
"id": "33436e24-f30f-42d0-8438-d948be12b5af"
},
"Mike Boldi": {
"email": "woo@test.com",
"id": "e43b0119-8d23-4ea2-9fd9-3a9ff14fc195"
},
"Milan Shah": {
"email": "foo@test.com",
"id": "89d26aa4-f0a8-48d9-a174-ce5285d9dd60"
}
}
}
Human Readable Output
Uptycs User Asset Groups
| B schmoll | Mike Boldi | Milan Shah |
|---|---|---|
| email: goo@test.com id: 33436e24-f30f-42d0-8438-d948be12b5af |
email: woo@test.com id: e43b0119-8d23-4ea2-9fd9-3a9ff14fc195 |
email: foo@test.com id: 89d26aa4-f0a8-48d9-a174-ce5285d9dd60 |
23. uptycs-get-threat-indicator
retrieve information about a specific threat indicator using a unique threat indicator id
Base Command
uptycs-get-threat-indicator
Input
| Argument Name | Description | Required |
|---|---|---|
| indicator_id | unique Uptycs id which identifies a specific threat indicator | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.ThreatIndicator.threat_source_id | string | unique Uptycs id which identifies the source of this specific threat indicator |
| Uptycs.ThreatIndicator.threat_vendor_id | string | unique Uptycs id which identifies the vendor of this specific threat source |
| Uptycs.ThreatIndicator.indicatorType | string | type of threat indicator (IPv4, domain,…) |
| Uptycs.ThreatIndicator.indicator | string | threat indicator |
| Uptycs.ThreatIndicator.createdAt | date | datetime the threat indicator was created |
| Uptycs.ThreatIndicator.threadId | string | unique id for the group of threat indicators this thread indicator belongs to |
| Uptycs.ThreatIndicator.id | string | unique id for this particular threat indicator |
Command Example
uptycs-get-threat-indicator indicator_id="0ab619bb-cfe0-4db0-8a31-0a71fcc2a362"
Context Example
{
"Uptycs.ThreatIndicator": {
"indicator": "92.242.140.21",
"description": "nishant.uptycs.io",
"threatId": "60e2e9eb-f756-4a4d-a85d-55aa8167d59d",
"threat_source_name": "test-bad-ips",
"threat_vendor_id": "42b9220c-7e29-4fd8-9cf7-9f811e851f8e",
"indicatorType": "IPv4",
"createdAt": "2019-01-10T21:25:49.280Z",
"updatedAt": "2019-01-10T21:25:49.280Z",
"threat_source_id": "c67d0821-f2f2-44ee-b3a8-a0bae5b04e55",
"id": "0ab619bb-cfe0-4db0-8a31-0a71fcc2a362",
"isActive": true
}
}
Human Readable Output
Uptycs Threat Indicator
| id | indicator | description | indicatorType | createdAt | isActive | threatId |
|---|---|---|---|---|---|---|
| 0ab619bb-cfe0-4db0-8a31-0a71fcc2a362 | 92.242.140.21 | nishant.uptycs.io | IPv4 | 2019-01-10T21:25:49.280Z | true | 60e2e9eb-f756-4a4d-a85d-55aa8167d59d |
24. uptycs-get-threat-source
retrieve information about a specific threat source
Base Command
uptycs-get-threat-source
Input
| Argument Name | Description | Required |
|---|---|---|
| threat_source_id | unique Uptycs id for the threat source you wish to retrive | Required |
Context Output
There is no context output for this command.
Command Example
uptycs-get-threat-source threat_source_id="20ee2177-4fdc-4070-a046-945048373dd1"
Context Example
{
"Uptycs.ThreatSources": {
"name": "Debian Linux vulnerabilities",
"url": "https://vulners.com/api/v3/archive/collection/?type=debian",
"enabled": true,
"custom": false,
"lastDownload": null,
"createdAt": "2018-09-14T18:43:54.832Z",
"description": "Debian Linux vulnerabilities"
}
}
Human Readable Output
Uptycs Threat Sources
| name | description | url | enabled | custom | createdAt | lastDownload |
|---|---|---|---|---|---|---|
| Debian Linux vulnerabilities | Debian Linux vulnerabilities | https://vulners.com/api/v3/archive/collection/?type=debian |
true | false | 2018-09-14T18:43:54.832Z |
25. uptycs-get-process-events
find process events which are running or have run on a registered Uptycs asset
Base Command
uptycs-get-process-events
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Only return assets with this asset id. Do not use arguments “asset_id”, “host_name_is” or “host_name_like” at the same time. | Optional |
| host_name_is | Only return assets with this hostname. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| host_name_like | Only return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
| start_window | Beginning of window to search for open connections. Format is “YYYY-MM-DD HH:MM:SS.000”, for example, March 15, 2019 at 1:52:36 am would be written as “2019-03-15 01:52:36.000”. | Optional |
| end_window | End of window to search for open connections. Format is “YYYY-MM-DD HH:MM:SS.000”, for example, March 15, 2019 at 1:52:36 am would be written as “2019-03-15 01:52:36.000”. | Optional |
| time | Exact time at which the process was spawned. | Optional |
| time_ago | Specifies how far back you want to look. Format examples: 2 hours, 4 minutes, 6 month, 1 day, etc. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.ProcessEvents.pid | number | pid for a particular process |
| Uptycs.ProcessEvents.parent | number | pid for the parent of a particular process |
| Uptycs.ProcessEvents.upt_asset_id | string | uptycs asset id for the asset which is running (or ran) the process |
| Uptycs.ProcessEvents.upt_hostname | string | host name for the asset which is running (or ran) the process |
| Uptycs.ProcessEvents.upt_time | date | time at which the process was spawned |
| Uptycs.ProcessEvents.path | string | path to the process binary |
| Uptycs.ProcessEvents.cmdline | string | comeplete argv for the process |
| Uptycs.ProcessEvents.cwd | string | process current working directory |
Command Example
uptycs-get-process-events limit=1
Context Example
{
"Uptycs.ProcessEvents": [
{
"parent": 60065,
"pid": 60067,
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"cmdline": "/usr/sbin/spctl --status ",
"upt_hostname": "kyle-mbp-work",
"upt_time": "2019-07-19 09:29:47.000",
"path": "/usr/sbin/spctl",
"cwd": null
}
]
}
Human Readable Output
Process events
| upt_hostname | pid | path | upt_time | parent | cmdline |
|---|---|---|---|---|---|
| kyle-mbp-work | 60067 | /usr/sbin/spctl | 2019-07-19 09:29:47.000 | 60065 | /usr/sbin/spctl –status |
26. uptycs-get-process-event-information
get information for a particular process event
Base Command
uptycs-get-process-event-information
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Only return assets with this asset id. Do not use arguments “asset_id” and “host_name_is” at the same time. | Optional |
| host_name_is | Hostname for asset which spawned the specified process. | Optional |
| pid | pid for the process. | Required |
| time | Time that the specified process was spawned. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.ProcEvent.pid | number | pid for the process |
| Uptycs.ProcEvent.upt_hostname | string | hostname for asset which spawned the specified process |
| Uptycs.ProcEvent.upt_asset_id | string | asset id for asset which spawned the specified process |
| Uptycs.ProcEvent.parent | number | pid for the parent process |
| Uptycs.ProcEvent.upt_time | date | time that the process was spawned |
| Uptycs.ProcEvent.path | string | path to the process binary |
| Uptycs.ProcEvent.cmdline | string | comeplete argv for the process |
| Uptycs.ProcEvent.cwd | string | process current working directory |
Command Example
uptycs-get-process-event-information asset_id="984d4a7a-9f3a-580a-a3ef-2841a561669b" pid=3318 time="2019-02-28 18:43:04.000"
Context Example
{
"Uptycs.ProcEvent": [
{
"parent": 1,
"pid": 3318,
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"cmdline": "xpcproxy com.apple.WebKit.WebContent.024FB342-0ECE-4E09-82E1-B9C9CF5F9CDF 3266 ",
"upt_hostname": "kyle-mbp-work",
"upt_time": "2019-02-28 18:43:04.000",
"path": "/dev/console",
"cwd": null
}
]
}
Human Readable Output
Process event information
| upt_hostname | parent | pid | path | cmdline |
|---|---|---|---|---|
| kyle-mbp-work | 1 | 3318 | /dev/console | xpcproxy com.apple.WebKit.WebContent.024FB342-0ECE-4E09-82E1-B9C9CF5F9CDF 3266 |
27. uptycs-get-socket-events
find processes which opened a socket
Base Command
uptycs-get-socket-events
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Only return assets with this asset id. Do not use arguments “asset_id”, “host_name_is” or “host_name_like” at the same time. | Optional |
| host_name_is | Only return assets with this hostname. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| host_name_like | Only return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use arguments “host_name_is” and “host_name_like” at the same time. | Optional |
| ip | IP address which process opened a socket to. | Optional |
| limit | Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). | Optional |
| start_window | Beginning of window to search for open sockets. Format is “YYYY-MM-DD HH:MM:SS.000”, for example, March 15, 2019 at 1:52:36 am would be written as “2019-03-15 01:52:36.000”. | Optional |
| end_window | End of window to search for open sockets. Format is “YYYY-MM-DD HH:MM:SS.000”, for example, March 15, 2019 at 1:52:36 am would be written as “2019-03-15 01:52:36.000”. | Optional |
| time | Exact time at which the socket was opened. | Optional |
| time_ago | Specifies how far back you want to look. Format examples: 2 hours, 4 minutes, 6 month, 1 day, etc. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.SocketEvents.pid | number | pid of process which opened a connection to a specified IP |
| Uptycs.SocketEvents.upt_hostname | string | hostname of the asset which ran the specified process |
| Uptycs.SocketEvents.upt_time | date | time at which the connection was opened |
| Uptycs.SocketEvents.path | string | file path to the process being run |
| Uptycs.SocketEvents.local_address | string | local IP for specified connection |
| Uptycs.SocketEvents.remote_address | string | remote IP for specified connection |
| Uptycs.SocketEvents.local_port | number | local port for specified connection |
| Uptycs.SocketEvents.remote_port | number | remote port for specified connection |
| Uptycs.SocketEvents.upt_asset_id | string | asset id for asset which ran the specified process |
| Uptycs.SocketEvents.socket | number | socket used to open the connection |
| Uptycs.SocketEvents.family | number | network protocol |
| Uptycs.SocketEvents.action | string | type of socket event (accept, connect, or bind) |
| Uptycs.SocketEvents.protocol | number | transfer protocol |
Command Example
uptycs-get-socket-events limit=1 remote_address="98.239.146.208"
Context Example
{
"Uptycs.SocketEvents": [
{
"protocol": null,
"socket": null,
"family": 2,
"local_port": 47873,
"remote_port": null,
"pid": 89,
"remote_address": "17.142.171.8",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"upt_time": "2019-07-19 09:29:52.000",
"upt_hostname": "kyle-mbp-work",
"path": null,
"action": "connect",
"local_address": "0.0.0.0"
}
]
}
Human Readable Output
Socket events
| upt_hostname | pid | local_address | remote_address | upt_time | local_port | action |
|---|---|---|---|---|---|---|
| kyle-mbp-work | 89 | 0.0.0.0 | 17.142.171.8 | 2019-07-19 09:29:52.000 | 47873 | connect |
28. uptycs-get-parent-event-information
find information for parent process events which are running or have run on a registered Uptycs assert
Base Command
uptycs-get-parent-event-information
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Only return assets with this asset id. Do not use arguments “asset_id” and “host_name_is” at the same time. | Optional |
| child_add_time | Time that the specified process was spawned. | Required |
| host_name_is | Hostname for asset which spawned the specified process. | Optional |
| parent | pid for the parent process. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.ParentEvent.pid | number | pid of the process (this is the same number as the input argument ‘parent’) |
| Uptycs.ParentEvent.upt_hostname | string | hostname for asset which spawned the specified process |
| Uptycs.ParentEvent.upt_asset_id | string | asset id for asset which spawned the specified process |
| Uptycs.ParentEvent.parent | number | pid for the parent process (this is the parent of the input argument ‘parent’) |
| Uptycs.ParentEvent.upt_time | date | time that the process was spawned |
| Uptycs.ParentEvent.path | string | path to the parent process binary |
| Uptycs.ParentEvent.cmdline | string | complete argv for the parent process |
| Uptycs.ParentEvent.cwd | string | parent process current working cirectory |
Command Example
uptycs-get-parent-event-information child_add_time="2019-05-07 12:24:34.000" parent=9347 host_name_is="kyle-mbp-work"
Context Example
{
"Uptycs.ParentEvent": [
{
"parent": 75,
"pid": 9347,
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"cmdline": "/sbin/mount -t hfs -o -u=99,-g=99,-m=755,nodev,noowners,nosuid,owners,nobrowse,-t=4m /dev/disk2s2 /Volumes/Time Machine Backups ",
"upt_hostname": "kyle-mbp-work",
"upt_time": "2019-05-07 12:24:34.000",
"path": "/sbin/mount",
"cwd": null
}
]
}
Human Readable Output
Parent process event information
| upt_hostname | parent | pid | path | cmdline |
|---|---|---|---|---|
| kyle-mbp-work | 75 | 9347 | /sbin/mount | /sbin/mount -t hfs -o -u=99,-g=99,-m=755,nodev,noowners,nosuid,owners,nobrowse,-t=4m /dev/disk2s2 /Volumes/Time Machine Backups |
29. uptycs-get-socket-event-information
get information for a particular socket event
Base Command
uptycs-get-socket-event-information
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Only return assets with this asset id. Do not use arguments “asset_id” and “host_name_is” at the same time. | Optional |
| host_name_is | Hostname for asset which spawned the specified process. | Optional |
| ip | IP address which process opened a socket to. | Required |
| time | Time that the specified connection was opened. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.SocketEvents.pid | number | pid of process which opened a connection to a specified IP |
| Uptycs.SocketEvents.upt_hostname | string | hostname of the asset which ran the specified process |
| Uptycs.SocketEvents.upt_time | date | time at which the connection was opened |
| Uptycs.SocketEvents.path | string | file path to the process being run |
| Uptycs.SocketEvents.local_address | string | local IP for specified connection |
| Uptycs.SocketEvents.remote_address | string | remote IP for specified connection |
| Uptycs.SocketEvents.local_port | number | local port for specified connection |
| Uptycs.SocketEvents.remote_port | number | remote port for specified connection |
| Uptycs.SocketEvents.upt_asset_id | string | asset id for asset which ran the specified process |
| Uptycs.SocketEvents.action | string | type of socket event (accept, connect, or bind) |
| Uptycs.SocketEvents.family | number | network protocol |
| Uptycs.SocketEvents.socket | number | socket used to open the connection |
| Uptycs.SocketEvents.protocol | number | transfer protocol |
Command Example
uptycs-get-socket-event-information ip="18.213.163.112" time="2019-03-18 14:34:31.000"
Context Example
{
"Uptycs.SocketEvent": [
{
"protocol": null,
"socket": "",
"family": 2,
"local_port": 47873,
"remote_port": null,
"pid": 16570,
"remote_address": "18.213.163.112",
"upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"upt_time": "2019-03-18 14:34:31.000",
"upt_hostname": "kyle-mbp-work",
"path": null,
"action": "connect",
"local_address": "0.0.0.0"
}
]
}
Human Readable Output
Socket event information
| upt_hostname | pid | local_address | remote_address | upt_time | local_port | action |
|---|---|---|---|---|---|---|
| kyle-mbp-work | 16570 | 0.0.0.0 | 18.213.163.112 | 2019-03-18 14:34:31.000 | 47873 | connect |
30. uptycs-get-asset-tags
Retrieve a list of tags for a particular asset
Base Command
uptycs-get-asset-tags
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Uptycs asset id for the asset you are looking for. | Required |
Context Output
There is no context output for this command.
Command Example
uptycs-get-asset-tags asset_id="984d4a7a-9f3a-580a-a3ef-2841a561669b"
Context Example
{
"Uptycs.AssetTags": [
"Uptycs=work laptop",
"owner=Uptycs office",
"network=low",
"cpu=unknown",
"memory=unknown",
"disk=high"
]
}
Human Readable Output
Uptycs Asset Tags for asset id: 984d4a7a-9f3a-580a-a3ef-2841a561669b
| Tags |
|---|
| Uptycs=work laptop |
| owner=Uptycs office |
| network=low |
| cpu=unknown |
| memory=unknown |
| disk=high |
31. uptycs-get-saved-queries
Retrieve a saved query or list of all saved queries
Base Command
uptycs-get-saved-queries
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | limit the number of entries returned | Optional |
| query_id | Only return the query with this unique id | Optional |
| name | Only return the query with this name | Optional |
Context Output
There is no context output for this command.
Command Example
uptycs-get-saved-queries name="test_saved_query"
Context Example
{
"Uptycs.SavedQueries": [
{
"seedId": "fec83a16-7c2a-4c9e-8621-7f030a14dfa4",
"updatedAt": "2019-05-10T19:07:46.480Z",
"query": "select * from upt_assets limit 1",
"viewConfig": null,
"id": "16de057d-6f69-46b0-80d0-46cb9348c8fe",
"createdAt": "2019-05-10T19:07:46.480Z",
"deleted_at": null,
"resultView": "TABLE",
"custom": true,
"shared": true,
"customerId": "e8213ef3-ef92-460e-a542-46dccd700c16",
"type": "default",
"assetView": "LIST",
"description": "this is a test query",
"deletedAt": null,
"createdBy": "33436e24-f30f-42d0-8438-d948be12b5af",
"updatedBy": "33436e24-f30f-42d0-8438-d948be12b5af",
"name": "test_saved_query",
"executionType": "global",
"parameters": null,
"deletedBy": null,
"grouping": "\"\""
}
]
}
Human Readable Output
Uptycs Saved Queries
| name | description | query | executionType | grouping | id |
|---|---|---|---|---|---|
| test_saved_query | this is a test query | select * from upt_assets limit 1 | global | ”” | 16de057d-6f69-46b0-80d0-46cb9348c8fe |
32. uptycs-run-saved-query
Run a saved query
Base Command
uptycs-run-saved-query
Input
| Argument Name | Description | Required |
|---|---|---|
| name | The name of the query you want to run | Optional |
| query_id | The unique id for the query you want to run | Optional |
| asset_id | realtime queries only This argument should be used when one wants to run a realtime query on a particular asset. | Optional |
| host_name_is | realtime queries only Only return assets with this hostname | Optional |
| host_name_like | realtime queries only . Only return assets with this string in the hostname. | Optional |
| variable_arguments | If your saved query has variable arguments, write them here in a json format where the key is the name of the variable argument and value is the value you want to use for this particular query. | Optional |
Context Output
There is no context output for this command.
Command Example
uptycs-run-saved-query name="test_saved_query"
Context Example
{
"Uptycs.RunQuery": [
{
"city_id": "6ee1f7ef-ad7d-46b1-9f74-384299c90830",
"updated_at": "2018-09-25 16:14:28.898",
"hardware_vendor": "Dell Inc.",
"disabled": false,
"os_key": "windows_10.0",
"deleted_at": null,
"id": "4c4c4544-0044-3910-8033-c8c04f5a4832",
"os_version": "10.0.14393",
"osquery_version": "3.2.6.15-Uptycs",
"gateway": "50.79.168.117",
"hardware_model": "PowerEdge T30",
"cpu_brand": "Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz",
"live": false,
"location": "United States",
"latitude": 37.751,
"host_name": "caol",
"status": "active",
"last_enrolled_at": "2018-09-25 16:14:28.863",
"description": null,
"object_group_id": "106eef5e-c3a6-44eb-bb3d-1a2087cded3d",
"last_activity_at": "2018-09-26 17:03:16.187",
"os": "Microsoft Windows Server 2016 Datacenter",
"created_at": "2018-09-25 16:14:28.881",
"longitude": -97.822,
"memory_mb": 16250,
"logical_cores": 4,
"os_flavor": "windows",
"cores": 4,
"hardware_serial": "HD93ZH2"
}
]
}
Human Readable Output
Uptycs Query Results
| city_id | updated_at | hardware_vendor | disabled | last_enrolled_at | deleted_at | gateway | cpu_brand | osquery_version | id | hardware_model | os_version | live | location | latitude | host_name | status | os_key | description | object_group_id | last_activity_at | hardware_serial | created_at | longitude | memory_mb | logical_cores | os_flavor | cores | os |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6ee1f7ef-ad7d-46b1-9f74-384299c90830 | 2018-09-25 16:14:28.898 | Dell Inc. | false | 2018-09-25 16:14:28.863 | 50.79.168.117 | Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz | 3.2.6.15-Uptycs | 4c4c4544-0044-3910-8033-c8c04f5a4832 | PowerEdge T30 | 10.0.14393 | false | United States | 37.751 | caol | active | windows_10.0 | 106eef5e-c3a6-44eb-bb3d-1a2087cded3d | 2018-09-26 17:03:16.187 | HD93ZH2 | 2018-09-25 16:14:28.881 | -97.822 | 16250 | 4 | windows | 4 | Microsoft Windows Server 2016 Datacenter |
33. uptycs-post-saved-query
Save a query to the Uptycs DB
Base Command
uptycs-post-saved-query
Input
| Argument Name | Description | Required |
|---|---|---|
| description | A short description for the query | Optional |
| execution_type | The type of query (global or realtime). | Required |
| name | The name for the query. This should be unique to this query. | Required |
| query | The query which will be saved | Required |
| type | Type of issue the query addresses. | Optional |
| grouping | Add the query to a group of queries. | Optional |
Context Output
There is no context output for this command.
Command Example
uptycs-post-saved-query name="process_query" query="select * from processes where name=:name limit 1" execution_type=global description="This is a test query with a variable argument for the column 'name’"
Context Example
{
"Uptycs.PostedQuery": {
"links": [
{
"href": "/api/customers/e8213ef3-ef92-460e-a542-46dccd700c16/queries/cc40b97a-46ab-4392-9f58-c4659e8ef4c1",
"rel": "self"
},
{
"href": "/api/customers/e8213ef3-ef92-460e-a542-46dccd700c16/queries",
"rel": "parent"
}
],
"updatedAt": "2019-07-19T17:52:18.476Z",
"query": "select * from processes where name=:name limit 1",
"viewConfig": null,
"id": "cc40b97a-46ab-4392-9f58-c4659e8ef4c1",
"createdAt": "2019-07-19T17:52:18.476Z",
"seedId": "9a6dfb16-695a-43c2-ac15-201cbd8040f8",
"resultView": "TABLE",
"custom": true,
"shared": true,
"customerId": "e8213ef3-ef92-460e-a542-46dccd700c16",
"type": "default",
"assetView": "LIST",
"description": "This is a test query with a variable argument for the column 'name\u2019",
"deletedAt": null,
"createdBy": "33436e24-f30f-42d0-8438-d948be12b5af",
"updatedBy": "33436e24-f30f-42d0-8438-d948be12b5af",
"name": "process_query",
"executionType": "global",
"parameters": null,
"deletedBy": null,
"grouping": "\"\""
}
}
Human Readable Output
Uptycs Posted Query
| name | type | description | query | executionType | grouping | custom |
|---|---|---|---|---|---|---|
| process_query | default | This is a test query with a variable argument for the column ‘name’ | select * from processes where name=:name limit 1 | global | ”” | true |
34. uptycs-get-carves
Get the list of carves file from a specific path.
Base Command
uptycs-get-carves
Input
| Argument Name | Description | Required |
|---|---|---|
| path | Retrieve carves from a specific path | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.Carves.id | string | Uptycs id of the carved file |
| Uptycs.Carves.assetId | string | Uptycs id of the asset |
| Uptycs.Carves.path | string | File path to the carved file |
| Uptycs.Carves.createdAt | date | Time at which the file was carved |
| Uptycs.Carves.updatedAt | date | Time at which the carve was updated |
| Uptycs.Carves.status | string | Status of carve in Uptycs database |
| Uptycs.Carves.assetHostName | string | Hostname in the Uptycs database |
| Uptycs.Carves.offset | number | Carved file size offset |
| Uptycs.Carves.length | number | Carved file size length |
| Uptycs.Carves.deletedUserName | number | Deleted user name |
| Uptycs.Carves.deleted_at | number | Time at which the carve was deleted |
Command Example
uptycs-get-carves path="/etc/"
Context Example
{
"Uptycs.Carves": [
{
"id": "e037cb0b-e9b0-4061-8966-5d3404cef9f6",
"assetId": "2fb29ec9-5c16-4021-af7c-65528fead280",
"path": "/etc/hosts",
"createdAt": "2023-05-19T06:58:12.304Z",
"updatedAt": "2023-05-19T06:58:13.576Z",
"status": "FINISHED",
"assetHostName": "uptycs-testhost",
"offset": 0,
"length": 197,
"deletedUserName": null,
"deletedAt": null
}
]
}
Human Readable Output
Uptycs Carves
| id | assetId | path | createdAt | updatedAt | status | assetHostName | offset | length | deletedUserName | deletedAt |
|---|---|---|---|---|---|---|---|---|---|---|
| e037cb0b-e9b0-4061-8966-5d3404cef9f6 | 2fb29ec9-5c16-4021-af7c-65528fead280 | /etc/hosts | 2023-05-19T06:58:12.304Z | 2023-05-19T06:58:13.576Z | FINISHED | uptycs-testhost | 0 | 197 |
35. uptycs-get-carves-link
Get the url of a carved file using uuid
Base Command
uptycs-get-carves-link
Input
| Argument Name | Description | Required |
|---|---|---|
| carve_id | uuid of a specific carved file. Get the id from the list of carves with the command uptycs-get-carves. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.CarvesLink.url | string | url of the carved file |
Command Example
uptycs-get-carves-link carve_id="e037cb0b-e9b0-4061-8966-5d3404cef9f6"
Context Example
{
"Uptycs.CarvesLink.url": "https://uptycs-carves-xxxxx.s3.us-xxxx-2.amazonaws.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/xxxx...."
}
Human Readable Output
Uptycs Carves
| url |
|---|
| https://uptycs-carves-xxxxx.s3.us-xxxx-2.amazonaws.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/xxxx…. |
36. uptycs-get-carves-download-file
Download a carved file using uuid
Base Command
uptycs-get-carves-download-file
Input
| Argument Name | Description | Required |
|---|---|---|
| carve_id | uuid of a specific carved file to download. Get the id from the list of carves with the command uptycs-get-carves. | Required |
Context Output
There is no context output for this command.
Command Example
uptycs-get-carves-download-file carve_id="e037cb0b-e9b0-4061-8966-5d3404cef9f6"
Context Example
There is no context output for this command.
Human Readable Output
Uptycs Carves file download
Uploaded file: e037cb0b-e9b0-4061-8966-5d3404cef9f6.tar
37. uptycs-get-asset-with-id
Get an Uptycs asset details.
Base Command
uptycs-get-asset-with-id
Input
| Argument Name | Description | Required |
|---|---|---|
| asset_id | Uptycs asset id. Get the id from the list of assets with the command uptycs-get-assets. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.Asset.hostName | string | Hostname in Uptycs DB |
| Uptycs.Asset.location | string | Host location |
| Uptycs.Asset.gateway | string | Gateway ip |
| Uptycs.Asset.cpuBrand | string | Cpu brand |
| Uptycs.Asset.hardwareModel | string | Hardware model |
| Uptycs.Asset.hardwareVendor | string | Hardware vendor |
| Uptycs.Asset.cores | number | Number of cores |
| Uptycs.Asset.logicalCores | number | Number of logical cores |
| Uptycs.Asset.memoryMb | number | Memory in mb |
| Uptycs.Asset.os | string | os installed on asset (Windows, Linux, Mac OS X) |
| Uptycs.Asset.osVersion | string | os version |
| Uptycs.Asset.osFlavor | string | os flavor |
| Uptycs.Asset.osKey | string | os key |
| Uptycs.Asset.osqueryVersion | string | Uptycs osquery version |
| Uptycs.Asset.status | string | status of host |
| Uptycs.Asset.arch | string | Host cpu architecture |
| Uptycs.Asset.agentVersion | string | Uptycs agent version |
| Uptycs.Asset.quarantinedStatus | string | Uptycs agent quarantine status |
| Uptycs.Asset.osDisplay | string | os version detailed info |
| Uptycs.Asset.tags | string | Uptycs asset tags |
| Uptycs.Asset.disabled | boolean | Asset disabled status |
| Uptycs.Asset.objectGroupId | string | Uptycs object group id |
| Uptycs.Asset.lastEnrolledAt | date | Last enrolled at time |
| Uptycs.Asset.live | boolean | Asset live status |
Command Example
uptycs-get-asset-with-id asset_id="984d4a7a-9f3a-580a-a3ef-2841a561669b"
Context Example
{
"Uptycs.Asset": [
{
"status": "active",
"live": true,
"disabled": false,
"quarantinedStatus": false,
"tags": "assets,macos,darwin",
"lastEnrolledAt": "2019-07-19 14:47:27.485",
"osVersion": "10.14.5",
"osqueryVersion": "3.x.x.x-Uptycs",
"agentVersion": "5.x.x.x-Uptycs",
"created_at": "2018-09-25 16:38:16.440",
"osFlavor": "darwin",
"hostName": "kyle-mbp-work",
"gateway": "x.y.z.a",
"os": "Mac OS X",
"osKey": "darwin_10.14.5",
"objectGroupId": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"cpuBrand": "Intel(R) Xeon(R) CPU E5-2686 v4 @ 2.30GHz",
"hardwareModel": "HVM domU",
"hardwareVendor": "Xen",
"cores": 2,
"logicalCores": 2,
"memoryMb": 8192,
"arch": "x86_64",
"osDisplay": "macOS 10.14.5",
"location": "United States"
}
]
}
Human Readable Output
Uptycs Assets
| status | live | disabled | quarantinedStatus | tags | lastEnrolledAt | osVersion | osqueryVersion | agentVersion | createdAt | osFlavor | hostName | gateway | os | osKey | objectGroupId | cpuBrand | hardwareModel | hardwareSerial | hardwareVendor | cores | logicalCores | memoryMb | arch | osDisplay | location |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| active | true | false | false | assets,macos,darwin | 2019-07-19 14:47:27.485 | 10.14.5 | 3.x.x.x-Uptycs | 5.x.x.x-Uptycs | 2018-09-25 16:38:16.440 | darwin | kyle-mbp-work | x.y.z.a | Mac OS X | darwin_10.14.5 | 984d4a7a-9f3a-580a-a3ef-2841a561669b | Intel(R) Xeon(R) CPU E5-2686 v4 @ 2.30GHz | HVM domU | ec272101-e5c1-58b2-f847-c439abdadcf4 | Xen | 2 | 2 | 8192 | x86_64 | macOS 10.14.5 | United States |
38. uptycs-get-tag
Return Uptycs asset tag details
Base Command
uptycs-get-tag
Input
| Argument Name | Description | Required |
|---|---|---|
| tag_id | Uptycs tag id. Get the id from the list of tags with the command uptycs-get-tags. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.tag.tag | string | Tag name in Uptycs DB |
| Uptycs.tag.resourceType | string | Tag resource type |
| Uptycs.tag.seedId | string | Uptycs seed id |
| Uptycs.tag.key | string | Tag key |
| Uptycs.tag.value | string | Tag value |
| Uptycs.tag.flagProfileId | string | Uptycs flag profile id |
| Uptycs.tag.customProfileId | string | Uptycs custom profile id |
| Uptycs.tag.complianceProfileId | string | Uptycs compliance profile id |
| Uptycs.tag.processBlockRuleId | string | Uptycs process block rule id |
| Uptycs.tag.dnsBlockRuleId | string | Uptycs dns block rule id |
| Uptycs.tag.windowsDefenderPreferenceId | string | Windows Defender Preference Id |
| Uptycs.tag.createdBy | string | Id of creator |
| Uptycs.tag.updatedBy | string | Id of last modifier |
| Uptycs.tag.createdAt | date | Created at time |
| Uptycs.tag.updatedAt | date | Updated at time |
| Uptycs.tag.status | string | Status of tag |
| Uptycs.tag.source | string | Source of tag |
| Uptycs.tag.system | boolean | Status of system |
| Uptycs.tag.custom | boolean | Status of custom |
| Uptycs.tag.tagRuleId | string | Uptycs tag rule id |
Command Example
uptycs-get-tag tag_id="984d4a7a-9f3a-580a-a3ef-2841a561669b"
Context Example
{
"Uptycs.tag": [
{
"tag": "asset-group=Asset test 1",
"resourceType": "asset",
"seedId": "14e579e4-3661-4bd6-ace3-082cf6fc4ec5",
"key": "asset-group",
"value": "Asset test 1",
"flagProfileId": "5d894e7c-5606-4380-8711-123ee2a7d96c",
"customProfileId": null,
"complianceProfileId": null,
"processBlockRuleId": "ec272101-e5c1-58b2-f847-c439abdadcf4",
"dnsBlockRuleId": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"windowsDefenderPreferenceId": null,
"createdBy": "testuser",
"updatedBy": "testuser",
"createdAt": "2019-07-19 14:47:27.485",
"updatedAt": "2019-07-19 14:47:27.485",
"status": "active",
"source": "direct",
"system": false,
"custom": false,
"tagRuleId": null
}
]
}
Human Readable Output
Uptycs tag
| tag | resourceType | seedId | key | value | flagProfileId | customProfileId | complianceProfileId | processBlockRuleId | dnsBlockRuleId | windowsDefenderPreferenceId | createdBy | updatedBy | createdAt | updatedAt | status | source | system | custom | tagRuleId |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| asset-group=Asset test 1 | asset | 14e579e4-3661-4bd6-ace3-082cf6fc4ec5 | asset-group | Asset test 1 | 5d894e7c-5606-4380-8711-123ee2a7d96c | ec272101-e5c1-58b2-f847-c439abdadcf4 | 984d4a7a-9f3a-580a-a3ef-2841a561669b | testuser | testuser | 2019-07-19 14:47:27.485 | 2019-07-19 14:47:27.485 | active | direct | false | false |
39. uptycs-get-tags
Return a list of Uptycs asset tags with details.
Base Command
uptycs-get-tags
Input
| Argument Name | Description | Required |
|---|---|---|
| key | Uptycs tag key | Optional |
| value | Uptycs tag value | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.tags.id | string | Tag id in Uptycs DB |
| Uptycs.tags.tag | string | Tag name in Uptycs DB |
| Uptycs.tags.resourceType | string | Tag resource type |
| Uptycs.tags.seedId | string | Uptycs seed id |
| Uptycs.tags.key | string | Uptycs tag key |
| Uptycs.tags.value | string | Uptycs tag value |
| Uptycs.tags.flagProfileId | string | Uptycs flag profile id |
| Uptycs.tags.customProfileId | string | Uptycs custom profile id |
| Uptycs.tags.complianceProfileId | string | Uptycs compliance profile id |
| Uptycs.tags.processBlockRuleId | string | Uptycs process block rule id |
| Uptycs.tags.dnsBlockRuleId | string | Uptycs dns block rule id |
| Uptycs.tags.windowsDefenderPreferenceId | string | Windows Defender Preference Id |
| Uptycs.tags.createdBy | string | Id of tag creator |
| Uptycs.tags.updatedBy | string | Id of last modifier |
| Uptycs.tags.createdAt | date | Created at time |
| Uptycs.tags.updatedAt | date | Updated at time |
| Uptycs.tags.status | string | status of tag |
| Uptycs.tags.source | string | source of tag |
| Uptycs.tags.system | boolean | system status |
| Uptycs.tags.custom | boolean | custom status |
| Uptycs.tags.tagRuleId | string | Uptycs tag rule id |
Command Example
uptycs-get-tags key="asset-group"
Context Example
{
"Uptycs.tags": [
{
"tag": "asset-group=Asset test 1",
"resourceType": "asset",
"seedId": "14e579e4-3661-4bd6-ace3-082cf6fc4ec5",
"key": "asset-group",
"value": "Asset test 1",
"flagProfileId": "5d894e7c-5606-4380-8711-123ee2a7d96c",
"customProfileId": null,
"complianceProfileId": null,
"processBlockRuleId": "ec272101-e5c1-58b2-f847-c439abdadcf4",
"dnsBlockRuleId": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"windowsDefenderPreferenceId": null,
"createdBy": "testuser",
"updatedBy": "testuser",
"createdAt": "2019-07-19 14:47:27.485",
"updatedAt": "2019-07-19 14:47:27.485",
"status": "active",
"source": "direct",
"system": false,
"custom": false,
"tagRuleId": null
}
]
}
Human Readable Output
Uptycs tags
| tag | resourceType | seedId | key | value | flagProfileId | customProfileId | complianceProfileId | processBlockRuleId | dnsBlockRuleId | windowsDefenderPreferenceId | createdBy | updatedBy | createdAt | updatedAt | status | source | system | custom | tagRuleId |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| asset-group=Asset test 1 | asset | 14e579e4-3661-4bd6-ace3-082cf6fc4ec5 | asset-group | Asset test 1 | 5d894e7c-5606-4380-8711-123ee2a7d96c | ec272101-e5c1-58b2-f847-c439abdadcf4 | 984d4a7a-9f3a-580a-a3ef-2841a561669b | testuser | testuser | 2019-07-19 14:47:27.485 | 2019-07-19 14:47:27.485 | active | direct | false | false |
40. uptycs-delete-tag
Delete an Uptycs asset tag
Base Command
uptycs-delete-tag
Input
| Argument Name | Description | Required |
|---|---|---|
| tag_id | Delete the tag matching this id. Get the id from the list of tags with the command uptycs-get-tags. | Required |
Context Output
There is no context output for this command.
Command Example
uptycs-delete-tag tag_id="14e579e4-3661-4bd6-ace3-082cf6fc4ec5"
Context Example
Human Readable Output
Uptycs deleted tag
Uptycs Deleted tag
41. uptycs-create-lookuptable
Create a new Uptycs lookup table.
Base Command
uptycs-create-lookuptable
Input
| Argument Name | Description | Required |
|---|---|---|
| name | Name of a lookup table | Required |
| id_field | Id field for the table. An identifier (ID) from the JSON/CSV file you want to upload. Select an ID based on the context of lookup data. For example, a domain lookup ID can be domain, or a port lookup ID can be port. This ID must be the same as defined in the JSON file to be uploaded, otherwise Uptycs does not capture the JSON data. This field is case sensitive and cannot be edited after a lookup table is saved. | Required |
| description | Description of a lookup table. | Optional |
| filename | The name of the file being uploaded. This file should be uploaded to Cortex XSOAR in the Playground War Room using the paperclip icon next to the CLI. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.lookuptable.id | string | Id of lookup table in Uptycs DB |
| Uptycs.lookuptable.name | string | Name of the created lookup table |
Command Example
uptycs-create-lookuptable name="test_table" id_field="remote_address" description="look up table with remote address"
Context Example
{
"Uptycs.lookuptable": [
{
"id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"name": "test_table"
}
]
}
Human Readable Output
Uptycs create lookup table
| id | name |
|---|---|
| 984d4a7a-9f3a-580a-a3ef-2841a561669b | test_table |
42. uptycs-post-lookuptable-data
Update csv data for a look up table.
Base Command
uptycs-post-lookuptable-data
Input
| Argument Name | Description | Required |
|---|---|---|
| table_id | Look up table id. Get the id from the list of tables with the command uptycs-get-lookuptables. | Required |
| filename | The name of the file being uploaded. This file should be uploaded to Cortex XSOAR in the Playground War Room using the paperclip icon next to the CLI. | Required |
Context Output
There is no context output for this command.
Command Example
uptycs-post-lookuptable-data table_id="984d4a7a-9f3a-580a-a3ef-2841a561669b" filename="lookuptable.csv"
Context Example
Human Readable Output
Uptycs Posted lookup table data
43. uptycs-edit-lookuptable
Edit an Uptycs lookup table
Base Command
uptycs-edit-lookuptable
Input
| Argument Name | Description | Required |
|---|---|---|
| table_id | Look up table id. Get the id from the list of tables with the command uptycs-get-lookuptables. | Required |
| name | Name of a lookup table. | Optional |
| description | A lookup table description. | Optional |
| active | Enable or disable the table with a boolean flag of true or false. | Optional |
Context Output
There is no context output for this command.
Command Example
uptycs-edit-lookuptable table_id="984d4a7a-9f3a-580a-a3ef-2841a561669b" name="test_table_new" description="look up table with remote address"
Context Example
{
"Uptycs.lookuptable": [
{
"active": true,
"createdAt": "2023-04-21T08:27:20.888Z",
"createdBy": "f976bda8-d5dc-468f-8283-20d5368352e2",
"customerId": "b1c3b08c-eedd-4b94-8ba0-9ca322401016",
"dataLookupTable": null,
"description": "look up table with remote address",
"fetchRowsquery": "SELECT id_field_value,data FROM upt_lookup_rows WHERE lookup_table_id = '984d4a7a-9f3a-580a-a3ef-2841a561669b'",
"forRuleEngine": true,
"id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"idField": "remote_address",
"name": "test_table_new",
"rowCount": 24,
"seedId": null,
"updatedAt": "2023-04-25T04:11:04.664Z",
"updatedBy": "f976bda8-d5dc-468f-8283-20d5368352e2"
}
]
}
Human Readable Output
Uptycs edit lookup table
| active | createdAt | createdBy | customerId | dataLookupTable | description | fetchRowsquery | forRuleEngine | id | idField | name | rowCount | seedId | updatedAt | updatedBy |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TRUE | 2023-04-21T08:27:20.888Z | f976bda8-d5dc-468f-8283-20d5368352e2 | b1c3b08c-eedd-4b94-8ba0-9ca322401016 | null | null | SELECT id_field_value,data FROM upt_lookup_rows WHERE lookup_table_id = ‘3fdb051b-b38b-4792-9daa-0a88ba4fae53’ | TRUE | 3fdb051b-b38b-4792-9daa-0a88ba4fae53 | remote_address | Test 1 | 24 | null | 2023-04-25T04:11:04.664Z | f976bda8-d5dc-468f-8283-20d5368352e2 |
44. uptycs-get-lookuptable
Get an Uptycs lookup table details
Base Command
uptycs-get-lookuptable
Input
| Argument Name | Description | Required |
|---|---|---|
| table_id | Id of table in Uptycs DB. Get the id from the list of tables with the command uptycs-get-lookuptables. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.lookuptable.seedId | string | Uptycs seed id |
| Uptycs.lookuptable.name | string | Look up table name |
| Uptycs.lookuptable.description | string | Description of the table |
| Uptycs.lookuptable.active | boolean | Active status of the table |
| Uptycs.lookuptable.idField | string | Uptycs id field |
| Uptycs.lookuptable.rowCount | number | Row count of table |
| Uptycs.lookuptable.forRuleEngine | boolean | Status of flag forRuleEngine |
| Uptycs.lookuptable.createdBy | string | Id of creator |
| Uptycs.lookuptable.updatedBy | string | Id of last modifier |
| Uptycs.lookuptable.createdAt | date | Created at time |
| Uptycs.lookuptable.updatedAt | date | Updated at time |
| Uptycs.lookuptable.dataLookupTable | string | Data look up table name |
| Uptycs.lookuptable.fetchRowsquery | string | Query used to fetch rows |
Command Example
uptycs-get-lookuptable table_id="984d4a7a-9f3a-580a-a3ef-2841a561669b"
Context Example
{
"Uptycs.lookuptable": [
{
"active": true,
"createdAt": "2023-04-21T08:27:20.888Z",
"createdBy": "f976bda8-d5dc-468f-8283-20d5368352e2",
"customerId": "b1c3b08c-eedd-4b94-8ba0-9ca322401016",
"dataLookupTable": null,
"description": "look up table with remote address",
"fetchRowsquery": "SELECT id_field_value,data FROM upt_lookup_rows WHERE lookup_table_id = '984d4a7a-9f3a-580a-a3ef-2841a561669b'",
"forRuleEngine": true,
"id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"idField": "remote_address",
"name": "test_table_new",
"rowCount": 24,
"seedId": null,
"updatedAt": "2023-04-25T04:11:04.664Z",
"updatedBy": "f976bda8-d5dc-468f-8283-20d5368352e2"
}
]
}
Human Readable Output
Uptycs look up tables
| active | createdAt | createdBy | customerId | dataLookupTable | description | fetchRowsquery | forRuleEngine | id | idField | name | rowCount | seedId | updatedAt | updatedBy |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TRUE | 2023-04-21T08:27:20.888Z | f976bda8-d5dc-468f-8283-20d5368352e2 | b1c3b08c-eedd-4b94-8ba0-9ca322401016 | null | null | SELECT id_field_value,data FROM upt_lookup_rows WHERE lookup_table_id = ‘3fdb051b-b38b-4792-9daa-0a88ba4fae53’ | TRUE | 3fdb051b-b38b-4792-9daa-0a88ba4fae53 | remote_address | Test 1 | 24 | null | 2023-04-25T04:11:04.664Z | f976bda8-d5dc-468f-8283-20d5368352e2 |
45. uptycs-get-lookuptables
Get List of Uptycs lookup table details
Base Command
uptycs-get-lookuptables
Input
There are no arguments for this command.
Context Output
| Path | Type | Description |
|---|---|---|
| Uptycs.lookuptable.id | string | Uptycs id of look up table |
| Uptycs.lookuptable.seedId | string | Uptycs seed id |
| Uptycs.lookuptable.name | string | Look up table name |
| Uptycs.lookuptable.description | string | Description of the table |
| Uptycs.lookuptable.active | boolean | Active status of the table |
| Uptycs.lookuptable.idField | string | Uptycs id field |
| Uptycs.lookuptable.rowCount | number | Row count of table |
| Uptycs.lookuptable.forRuleEngine | boolean | Status of flag forRuleEngine |
| Uptycs.lookuptable.createdBy | string | Id of creator |
| Uptycs.lookuptable.updatedBy | string | Id of last modifier |
| Uptycs.lookuptable.createdAt | date | Created at time |
| Uptycs.lookuptable.updatedAt | date | Updated at time |
| Uptycs.lookuptable.dataLookupTable | string | Data look up table name |
| Uptycs.lookuptable.fetchRowsquery | string | Query used to fetch rows |
Command Example
uptycs-get-lookuptables
Context Example
{
"Uptycs.lookuptables": [
{
"active": true,
"createdAt": "2023-04-21T08:27:20.888Z",
"createdBy": "f976bda8-d5dc-468f-8283-20d5368352e2",
"customerId": "b1c3b08c-eedd-4b94-8ba0-9ca322401016",
"dataLookupTable": null,
"description": "look up table with remote address",
"fetchRowsquery": "SELECT id_field_value,data FROM upt_lookup_rows WHERE lookup_table_id = '984d4a7a-9f3a-580a-a3ef-2841a561669b'",
"forRuleEngine": true,
"id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
"idField": "remote_address",
"name": "test_table_new",
"rowCount": 24,
"seedId": null,
"updatedAt": "2023-04-25T04:11:04.664Z",
"updatedBy": "f976bda8-d5dc-468f-8283-20d5368352e2"
}
]
}
Human Readable Output
Uptycs look up tables
| active | createdAt | createdBy | customerId | dataLookupTable | description | fetchRowsquery | forRuleEngine | id | idField | name | rowCount | seedId | updatedAt | updatedBy |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TRUE | 2023-04-21T08:27:20.888Z | f976bda8-d5dc-468f-8283-20d5368352e2 | b1c3b08c-eedd-4b94-8ba0-9ca322401016 | null | null | SELECT id_field_value,data FROM upt_lookup_rows WHERE lookup_table_id = ‘3fdb051b-b38b-4792-9daa-0a88ba4fae53’ | TRUE | 3fdb051b-b38b-4792-9daa-0a88ba4fae53 | remote_address | Test 1 | 24 | null | 2023-04-25T04:11:04.664Z | f976bda8-d5dc-468f-8283-20d5368352e2 |
46. uptycs-delete-lookuptable
Delete an Uptycs lookup table
Base Command
uptycs-delete-lookuptable
Input
| Argument Name | Description | Required |
|---|---|---|
| table_id | Table id in Uptycs DB. Get the id from the list of tables with the command uptycs-get-lookuptables. | Required |
Context Output
There is no context output for this command.
Command Example
uptycs-delete-lookuptable table_id="984d4a7a-9f3a-580a-a3ef-2841a561669b"
Context Example
Human Readable Output
Uptycs deleted lookuptable
Uptycs Deleted lookuptable
47. uptycs-delete-assets-tag
Disassociate an asset with a tag
Base Command
uptycs-delete-assets-tag
Input
| Argument Name | Description | Required |
|---|---|---|
| tag_id | Disassociate the tag matching this id with the given asset_id. Get the id from the list of tags with the command uptycs-get-tags. | Required |
| asset_id | Disassociate the asset matching this asset id with the given tag_id. Get the id from the list of asset with the command uptycs-get-assets. | Required |
Context Output
There is no context output for this command.
Command Example
uptycs-delete-asset-tag tag_id="14e579e4-3661-4bd6-ace3-082cf6fc4ec5" asset_id="984d4a7a-9f3a-580a-a3ef-2841a561669b"
Context Example
Human Readable Output
Uptycs delete assets tag
Uptycs disassociated assets tags
Additional Information
In order to create an instance of the integration, a user API key and secret must be downloaded from the users Uptycs account. After signing in, navigate to Configuration->Users. At the bottom left of the screen you will see a window labeled “User API key”. Click download. The downloaded file will have all the information necessary to create the instance.
Known Limitations
While the Cortex XSOAR-Uptycs integration provides multiple commands with which to access the Uptycs backend, not all features are supported. In particular, configuration changes are best made using the Uptycs UI. Many of the commands have a limit set to reduce the number of rows returned from a query or api call. The limit can be raised, or turned off, however, this may cause the queries take longer to return and potentially return large numbers of rows. When writing queries, it can sometimes be easier to test using the Uptycs UI rather than the integration.
Configuration parameters
key— API key (required)secret— API secret (required)domain— API domain (e.g. teststack.uptycs.io) (required)customer_id— API Customer ID (required)isFetch— Fetch incidentsincidentType— Incident typeincidentFetchInterval— Incidents Fetch Intervalinsecure— Trust any certificate (not secure)proxy— Use system proxy settingsfetch_time— First fetch since (<number> <time unit>, e.g., 12 hours, 7 days)
Commands (47)
-
uptycs-create-lookuptableCreate a new Uptycs lookup table.
-
uptycs-delete-assets-tagDisassociate an asset with a tag.
-
uptycs-delete-lookuptableDelete an Uptycs lookup table.
-
uptycs-delete-tagDelete an Uptycs asset tag.
-
uptycs-edit-lookuptableEdit an Uptycs lookup table.
-
uptycs-get-alert-rulesReturns a list of alert rules.
-
uptycs-get-alertsReturns alerts from the Uptycs database. Do not use the "asset_id", "host_name_is" argument and "host_name_like" argument in the same command.
-
uptycs-get-asset-groupsget Uptycs asset groups.
-
uptycs-get-asset-tagsRetrieve a list of tags for a particular asset.
-
uptycs-get-asset-with-idGet an Uptycs asset details.
-
uptycs-get-assetsReturns assets enrolled with Uptycs. Do not use the "host_name_is" argument and "host_name_like" in the same command.
-
uptycs-get-carvesGet the list of carves file from a specific path.
-
uptycs-get-carves-download-fileDownload a carved file using uuid.
-
uptycs-get-carves-linkGet the url of a carved file using uuid.
-
uptycs-get-event-rulesReturns a list of event rules.
-
uptycs-get-eventsReturns events from the Uptycs database.
-
uptycs-get-lookuptableGet an Uptycs lookup table details.
-
uptycs-get-lookuptablesget list of uptycs look up tables.
-
uptycs-get-parent-event-informationfind information for parent process events which are running or have run on a registered Uptycs assert.
-
uptycs-get-parent-informationget the parent process information for a particular child process.
-
uptycs-get-process-child-processesget all the child processes for a given parent process.
-
uptycs-get-process-event-informationget information for a particular process event.
-
uptycs-get-process-eventsfind process events which are running or have run on a registered Uptycs asset.
-
uptycs-get-process-informationget information for a particular process.
-
uptycs-get-process-open-filesfind processes which have opened files.
-
uptycs-get-process-open-socketsFinds processes that opened a socket.
-
uptycs-get-processesfind processes which are running or have run on a registered Uptycs asset.
-
uptycs-get-saved-queriesRetrieve a saved query or list of all saved queries.
-
uptycs-get-socket-event-informationget information for a particular socket event.
-
uptycs-get-socket-eventsfind processes which opened a socket.
-
uptycs-get-tagReturn Uptycs asset tag details.
-
uptycs-get-tagsReturn a list of Uptycs asset tags with details.
-
uptycs-get-threat-indicatorretrieve information about a specific threat indicator using a unique threat indicator id.
-
uptycs-get-threat-indicatorsget Uptycs threat indicators.
-
uptycs-get-threat-sourceretrieve information about a specific threat source.
-
uptycs-get-threat-sourcesget Uptycs threat sources.
-
uptycs-get-threat-vendorsget Uptycs threat vendors.
-
uptycs-get-user-asset-groupsget a list of users in a particular asset group.
-
uptycs-get-user-informationget info for an Uptycs user.
-
uptycs-get-usersget a list of Uptycs users.
-
uptycs-post-lookuptable-dataUpdate csv data for a look up table.
-
uptycs-post-saved-querySave a query to the Uptycs DB.
-
uptycs-post-threat-sourcepost a new threat source to your threat sources in Uptycs.
-
uptycs-run-queryRuns the specified SQL query against your Uptycs database. A list of tables can be found at osquery.io/schema, or by using the query "select * from information_schema.tables".
-
uptycs-run-saved-queryRun a saved query.
-
uptycs-set-alert-statusSet the status of an alert to new, assigned, resolved, or closed.
-
uptycs-set-asset-tagSets a tag on a particular asset.
fromversion: 5.0.0 sectionorder: - Connect - Collect category: Analytics & SIEM provider: Uptycs commonfields: id: Uptycs version: -1 configuration: - display: API key name: key required: true type: 4 section: Connect - display: API secret name: secret required: true type: 4 section: Connect - display: API domain (e.g. teststack.uptycs.io) name: domain required: true type: 0 section: Connect - display: API Customer ID name: customer_id required: true type: 4 section: Connect - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - display: Incident type name: incidentType type: 13 required: false section: Collect - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - defaultvalue: 1 day display: First fetch since (<number> <time unit>, e.g., 12 hours, 7 days) name: fetch_time type: 0 required: false section: Collect description: Fetches data from the Uptycs database. display: Uptycs name: Uptycs script: commands: - arguments: - description: Returns assets that are a member of this asset group. name: asset_group_id - description: Returns assets with this hostname. Do not use the "host_name_is" argument and "host_name_like" in the same command. name: host_name_is - description: Returns assets with this string in the hostname. Use this argument to find a selection of assets with similar hostnames. Do not use the "host_name_is" argument and "host_name_like" in the same command. name: host_name_like - defaultValue: '10' description: The maximum number of entries to return. Use -1 to return all entries, which might cause performance issues or a time out). name: limit - auto: PREDEFINED description: Returns assets with this type of operating system. Can be "Ubuntu/Debian", "CentOS/RedHat/Fedora/Amazon Linux", "Mac OS X/Apple OS X/macOS", or "Windows". name: os predefined: - Ubuntu/Debian - CentOS/RedHat/Fedora/Amazon Linux - CoreOS Container Linux - Mac OS X/Apple OS X/macOS - Windows - description: Returns the asset with this unique asset ID. name: asset_id description: Returns assets enrolled with Uptycs. Do not use the "host_name_is" argument and "host_name_like" in the same command. name: uptycs-get-assets outputs: - contextPath: Uptycs.Assets.id description: Uptycs asset ID. type: string - contextPath: Uptycs.Assets.created_at description: Date/time that the asset was enrolled with Uptycs. type: date - contextPath: Uptycs.Assets.host_name description: Hostname in the Uptycs database. type: string - contextPath: Uptycs.Assets.os description: OS installed on the asset (Windows, Linux, Mac OS X). type: string - contextPath: Uptycs.Assets.os_version description: OS version. type: string - contextPath: Uptycs.Assets.last_activity_at description: Date/time of the last activity on the asset. type: date - contextPath: Uptycs.Assets.deleted_at description: Date/time that the asset was unenrolled from Uptycs. type: date - contextPath: Uptycs.Assets.osquery_version description: Current version of osquery installed on the asset. type: string - arguments: - description: 'The SQL query against your Uptycs database. Queries should be written for a SQLite database. For example, "SELECT * FROM processes" returns the entire table named "processes". ' name: query required: true - auto: PREDEFINED description: The type of query to run. Can be "global" or "realtime". "Global" returns results for entire history stored in the Uptycs database. "Realtime" returns results for queries run on endpoints at the time that the query is executed. name: query_type predefined: - global - realtime required: true - description: ' Use this argument to run a realtime query on a particular asset. This argument will not work for global queries.' name: asset_id - description: ' Use this argument to run a realtime query and return assets with this hostname. This argument will not work for global queries.' name: host_name_is - description: ' Use this argument to run a realtime query and return assets with this string in the hostname. This argument will not work for global queries.' name: host_name_like description: Runs the specified SQL query against your Uptycs database. A list of tables can be found at osquery.io/schema, or by using the query "select * from information_schema.tables". name: uptycs-run-query outputs: - contextPath: Uptycs.QueryResults description: Results of the executed query. type: unknown - arguments: - description: Unique Uptycs alert ID, which will retrieve a specific alert. Do not pass other arguments with this argument. name: alert_id - description: Return assets with this asset ID. Do not use the "asset_id", "host_name_is" argument and "host_name_like" argument in the same command. name: asset_id - auto: PREDEFINED description: Return alerts by alert code. name: code predefined: - BAD_DOMAIN - CRITICAL_FILE - INBOUND_NETWORK_CONNECTIONS - KERNULE_MODULE_MOD - MANUAL_PACKAGE_INSTALL - OPEN_SOCKET_BAD_IP - OSX_ATTACK - OSX_CRASHES - OUTBOUND_CONNECTION_TO_THREAT_IOC - PRIVILEGED_ACCOUNT_ACTIVITY - PRIVILEGED_REMOTE_LOGIN - PRIVILEGE_ESCALATION - PROCESSES_WITHOUT_ONDISK_FILE - PROCESSES_STARTED_TMP - REMOTE_LOGIN - SERVICE_RUNNING_AS_ROOT - SERVICE_RUNNING_A_SHELL - SOFTWARE_CHANGE - SUSPICIOUS_FILE_PERMISSIONS_CHANGE - SUSPICIOUS_FILE_TRANSFERS - SUSPICIOUS_TOOLS_IN_USE - SYSTEM_FILE_CHANGES - USER_ADDED_TO_ASSET - description: Return assets with this hostname. Do not use the "asset_id", "host_name_is" argument or "host_name_like" argument in the same command. name: host_name_is - description: Return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use the "asset_id" argument, "host_name_is" argument, or "host_name_like" argument in the same command. name: host_name_like - defaultValue: '10' description: Maximum number of entries to return. Use -1 to return all entries, which might cause performance issues or a time out). name: limit - description: The date/time from which to start the search for open connections. Format is "YYYY-MM-DD HH:MM:SS.000", for example, March 15, 2019 at 1:52:36 am would be written as "2019-03-15 01:52:36.000". name: start_window - description: The date/time from which to end the search for open connections. Format is "YYYY-MM-DD HH:MM:SS.000", for example, March 15, 2019 at 1:52:36 am would be written as "2019-03-15 01:52:36.000". name: end_window - defaultValue: 10 days description: 'The date/time range of how far back to search, for example: 2 hours, 4 minutes, 6 month, 1 day, and so on. Default is 10 days.' name: time_ago - description: The value for the alert type. Values vary according to the alert type. For example, the value for a Bad IP alert would have the IP address as the value. A program crash alert would have the name be the program that crashed. name: value - description: The key for the alert type. Values vary according to the alert type. This tells you what type of alert identifier is stored in the 'value' column. name: key description: Returns alerts from the Uptycs database. Do not use the "asset_id", "host_name_is" argument and "host_name_like" argument in the same command. name: uptycs-get-alerts outputs: - contextPath: Uptycs.Alerts.description description: Description of the alert. type: string - contextPath: Uptycs.Alerts.upt_asset_id description: Uptycs asset ID. type: string - contextPath: Uptycs.Alerts.code description: Alert code in the Uptycs database. type: string - contextPath: Uptycs.Alerts.severity description: The severity of the alert. type: string - contextPath: Uptycs.Alerts.alert_time description: Time that the alert was created. type: date - contextPath: Uptycs.Alerts.value description: Specific problem which caused an alert, for example an IP address, a program that crashed, a file with a know malware file hash, and so on. type: string - contextPath: Uptycs.Alerts.host_name description: Hostname for the asset tha fired the alert. type: string - contextPath: Uptycs.Alerts.id description: Unique Uptycs ID for an alert. type: string - contextPath: Uptycs.Alerts.threat_indicator_id description: Unique Uptycs ID that identifies the threat indicator that triggered this alert. type: string - contextPath: Uptycs.Alerts.threat_source_name description: Name of the source of the threat indicator that triggered this alert. type: string - contextPath: Uptycs.Alerts.pid description: PID of the process that was responsible for firing the alert. type: number - contextPath: Uptycs.Alerts.key description: Type of indicator that is stored in the 'value' column. type: string - arguments: - defaultValue: '10' description: Maximum number of entries to return. Default is 10. Use -1 to return all entries, which might cause performance issues or a time out). name: limit description: Returns a list of alert rules. name: uptycs-get-alert-rules - arguments: - defaultValue: '10' description: Maximum number of entries to return. Default is 10. Use -1 to return all entries, which might cause performance issues or a time out). name: limit description: Returns a list of event rules. name: uptycs-get-event-rules - arguments: - description: Return assets with this asset ID. Do not use the "asset_id" argument, "host_name_is" argument, or "host_name_like" argument in the same command. name: asset_id - auto: PREDEFINED description: Event code to specify which types of events to return. name: code predefined: - BAD_DOMAIN - CRITICAL_FILE - EXCESSIVE_LOGINS - INBOUND_NETWORK_CONNECTIONS - KERNULE_MODULE_MOD - LOCATION - MANUAL_FILE_EDITS - MANUAL_PACKAGE_INSTALL - OPEN_SOCKET_BAD_IP - OSX_ATTACK - OSX_CRASHES - OUTBOUND_NETWORK_CONNECTIONS - PRIVILEGED_ACCOUNT_ACTIVITY - PRIVILEGED_REMOTE_LOGIN - PRIVILEGE_ESCALATION - PROCESSES_WITHOUT_ONDISK_FILE - PROCESSES_STARTED_TMP - REMOTE_LOGIN - SERVICE_RUNNING_AS_ROOT - SERVICE_RUNNING_A_SHELL - SOFTWARE_CHANGE - SUSPICIOUS_FILE_PERMISSIONS_CHANGE - SUSPICIOUS_FILE_TRANSFERS - SUSPICIOUS_TOOLS_IN_USE - SYSTEM_FILE_CHANGES - USER_ADDED_TO_ASSET - description: Return assets with this hostname. Do not use the "asset_id" argument, "host_name_is" argument, or "host_name_like" argument in the same command. name: host_name_is - description: Return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use the "asset_id" argument, "host_name_is" argument, or "host_name_like" argument in the same command. name: host_name_like - defaultValue: '10' description: Maximum number of entries to return. Default is 10. Use -1 to return all entries, which might cause performance issues or a time out. name: limit - description: The date/time from which to start the search for open connections. Format is "YYYY-MM-DD HH:MM:SS.000", for example, March 15, 2019 at 1:52:36 am would be written as "2019-03-15 01:52:36.000". name: start_window - description: The date/time from which to end the search for open connections. Format is "YYYY-MM-DD HH:MM:SS.000", for example, March 15, 2019 at 1:52:36 am would be written as "2019-03-15 01:52:36.000". name: end_window - defaultValue: 1 days description: 'Specifies how far back you want to look. Format examples: 2 hours, 4 minutes, 6 month, 1 day, etc.' name: time_ago - description: The type of alert indicator that is stored in the 'value' column. Varies according to event type. name: key - description: The value for the alert type. Values vary according to the alert type. For example, the value for a Bad IP alert would have the IP address as the value. A program crash alert would have the name be the program that crashed.Varies for different events. name: value description: Returns events from the Uptycs database. name: uptycs-get-events outputs: - contextPath: Uptycs.Events.description description: Description of the event. type: string - contextPath: Uptycs.Events.upt_asset_id description: Uptycs asset ID. type: string - contextPath: Uptycs.Events.code description: Event code in the Uptycs database. type: string - contextPath: Uptycs.Events.created_at description: Date/time that the event was created. type: date - contextPath: Uptycs.Events.id description: Uptycs event ID for the event. type: string - contextPath: Uptycs.Events.host_name description: Hostname for the assets on which this event occurred. type: string - contextPath: Uptycs.Events.grouping description: Group to which this event belongs. type: string - contextPath: Uptycs.Events.value description: The value will be different for different types of events. It is that which triggered the event. For example, a Bad IP connection will have the IP address here, and a program crash will have the name of the program that crashed here. type: string - contextPath: Uptycs.Events.severity description: The severity of the event. type: string - contextPath: Uptycs.Events.key description: Type of indicator that is stored in the 'value' column. type: string - arguments: - description: Return assets with this asset ID. Do not use the "asset_id" argument, "host_name_is" argument, or "host_name_like" argument in the same command. name: asset_id - description: Return assets with this hostname. Do not use the "asset_id" argument, "host_name_is" argument, or "host_name_like" argument in the same command. name: host_name_is - description: Return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use the "asset_id" argument, "host_name_is" argument, or "host_name_like" argument in the same command. name: host_name_like - description: IP address to which the process opened a socket. name: ip - defaultValue: '10' description: Maximum number of entries to return. Default is 10. Use -1 to return all entries, which might cause performance issues or a time out. name: limit - description: The date/time from which to start the search for open connections. Format is "YYYY-MM-DD HH:MM:SS.000", for example, March 15, 2019 at 1:52:36 am would be written as "2019-03-15 01:52:36.000". name: start_window - description: The date/time from which to end the search for open connections. Format is "YYYY-MM-DD HH:MM:SS.000", for example, March 15, 2019 at 1:52:36 am would be written as "2019-03-15 01:52:36.000". name: end_window - description: Exact time at which the socket was opened. name: time - description: 'Specifies how far back to search. Format examples: 2 hours, 4 minutes, 6 month, 1 day, etc.' name: time_ago description: Finds processes that opened a socket. name: uptycs-get-process-open-sockets outputs: - contextPath: Uptycs.Sockets.pid description: PID of the process that opened a connection to a specified IP address. type: number - contextPath: Uptycs.Sockets.upt_hostname description: Hostname of the asset that ran the specified process. type: string - contextPath: Uptycs.Sockets.upt_time description: Date/time when the connection was opened. type: date - contextPath: Uptycs.Sockets.path description: File path to the process being run. type: string - contextPath: Uptycs.Sockets.local_address description: Local IP address for the specified connection. type: string - contextPath: Uptycs.Sockets.remote_address description: Remote IP address for the specified connection. type: string - contextPath: Uptycs.Sockets.local_port description: Local port for the specified connection. type: number - contextPath: Uptycs.Sockets.remote_port description: Remote port for the specified connection. type: number - contextPath: Uptycs.Sockets.upt_asset_id description: Asset ID for the asset that ran the specified process. type: string - contextPath: Uptycs.Sockets.socket description: Socket used to open the connection. type: number - contextPath: Uptycs.Sockets.family description: Network protocol. type: number - contextPath: Uptycs.Sockets.state description: State of the connection. type: string - contextPath: Uptycs.Sockets.protocol description: Transport protocol. type: number - arguments: - description: Only return assets with this asset id. Do not use arguments "asset_id" and "host_name_is" at the same time. name: asset_id - description: Hostname for asset which spawned the specified process. name: host_name_is - description: pid for the process. name: pid required: true - description: Time that the specified process was spawned. name: time required: true description: get information for a particular process. name: uptycs-get-process-information outputs: - contextPath: Uptycs.Proc.pid description: pid for the process. type: number - contextPath: Uptycs.Proc.upt_hostname description: hostname for asset which spawned the specified process. type: string - contextPath: Uptycs.Proc.upt_asset_id description: asset id for asset which spawned the specified process. type: string - contextPath: Uptycs.Proc.parent description: pid for the parent process. type: number - contextPath: Uptycs.Proc.upt_add_time description: time that the process was spawned. type: date - contextPath: Uptycs.Proc.upt_remove_time description: time that the process was removed. type: date - contextPath: Uptycs.Proc.path description: path to the process binary. type: string - contextPath: Uptycs.Proc.name description: name of the process. type: string - contextPath: Uptycs.Proc.cmdline description: complete argv of the process. type: string - contextPath: Uptycs.Proc.pgroup description: process group. type: number - contextPath: Uptycs.Proc.cwd description: process current working directory. type: string - arguments: - description: Only return assets with this asset_id. Do not use arguments "asset_id" and "host_name_is" at the same time. name: asset_id - description: hostname for the asset which executed these processes. name: host_name_is - defaultValue: '10' description: Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). name: limit - description: The pid for which all child processes will be found. name: parent required: true - description: time at which the parent process was spawned. name: parent_start_time required: true - description: time at which the parent process was killed, if it exists. name: parent_end_time description: get all the child processes for a given parent process. name: uptycs-get-process-child-processes outputs: - contextPath: Uptycs.Children.pid description: pid of a child process. type: number - contextPath: Uptycs.Children.upt_asset_id description: asset id for asset which this process was run on. type: string - contextPath: Uptycs.Children.upt_hostname description: hostname for asset which spawned the specified process. type: string - contextPath: Uptycs.Children.upt_add_time description: time that the process was spawned. type: date - contextPath: Uptycs.Children.upt_remove_time description: time that the process was removed. type: date - contextPath: Uptycs.Children.path description: path to the process binary. type: string - contextPath: Uptycs.Children.parent description: parent pid. type: number - contextPath: Uptycs.Children.name description: name of the process. type: string - contextPath: Uptycs.Children.cmdline description: complete argv for the process. type: string - contextPath: Uptycs.Children.pgroup description: process group. type: number - contextPath: Uptycs.Children.cwd description: process current working directory. type: string - arguments: - description: Only return assets with this asset id. Do not use arguments "asset_id", "host_name_is" or "host_name_like" at the same time. name: asset_id - description: Only return assets with this hostname. Do not use arguments "host_name_is" and "host_name_like" at the same time. name: host_name_is - description: Only return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use arguments "host_name_is" and "host_name_like" at the same time. name: host_name_like - defaultValue: '10' description: Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). name: limit - description: Beginning of window to search for open connections. Format is "YYYY-MM-DD HH:MM:SS.000", for example, March 15, 2019 at 1:52:36 am would be written as "2019-03-15 01:52:36.000". name: start_window - description: End of window to search for open connections. Format is "YYYY-MM-DD HH:MM:SS.000", for example, March 15, 2019 at 1:52:36 am would be written as "2019-03-15 01:52:36.000". name: end_window - description: Exact time at which the process was spawned. name: time - description: 'Specifies how far back you want to look. Format examples: 2 hours, 4 minutes, 6 month, 1 day, etc.' name: time_ago description: find processes which are running or have run on a registered Uptycs asset. name: uptycs-get-processes outputs: - contextPath: Uptycs.Process.pid description: pid for a particular process. type: number - contextPath: Uptycs.Process.parent description: pid for the parent of a particular process. type: number - contextPath: Uptycs.Process.upt_asset_id description: uptycs asset id for the asset which is running (or ran) the process. type: string - contextPath: Uptycs.Process.upt_hostname description: host name for the asset which is running (or ran) the process. type: string - contextPath: Uptycs.Process.upt_time description: time at which the process was spawned. type: date - contextPath: Uptycs.Process.name description: name of the process. type: string - contextPath: Uptycs.Process.path description: path to the process binary. type: string - contextPath: Uptycs.Process.cmdline description: comeplete argv for the process. type: string - contextPath: Uptycs.Process.pgroup description: process group. type: number - contextPath: Uptycs.Process.cwd description: process current working directory. type: string - arguments: - description: Only return assets with this asset id. Do not use arguments "asset_id", "host_name_is" or "host_name_like" at the same time. name: asset_id - description: Only return assets with this hostname. Do not use arguments "host_name_is" and "host_name_like" at the same time. name: host_name_is - description: Only return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use arguments "host_name_is" and "host_name_like" at the same time. name: host_name_like - defaultValue: '10' description: Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). name: limit - description: Beginning of window to search for open connections. Format is "YYYY-MM-DD HH:MM:SS.000", for example, March 15, 2019 at 1:52:36 am would be written as "2019-03-15 01:52:36.000". name: start_window - description: End of window to search for open connections. Format is "YYYY-MM-DD HH:MM:SS.000", for example, March 15, 2019 at 1:52:36 am would be written as "2019-03-15 01:52:36.000". name: end_window - description: Exact time at which the process was spawned. name: time - description: 'Specifies how far back you want to look. Format examples: 2 hours, 4 minutes, 6 month, 1 day, etc.' name: time_ago description: find processes which have opened files. name: uptycs-get-process-open-files outputs: - contextPath: Uptycs.Files.pid description: pid for the process which opened a file. type: number - contextPath: Uptycs.Files.fd description: process specific file descriptor number. type: number - contextPath: Uptycs.Files.upt_asset_id description: Uptycs asset id for the the asset on which the file was opened. type: string - contextPath: Uptycs.Files.upt_hostname description: Host name for the asset on which the file was opened. type: string - contextPath: Uptycs.Files.upt_time description: time at which the file was opened. type: date - contextPath: Uptycs.Files.path description: filesystem path of the file descriptor. type: string - arguments: - description: Uptycs alert id used to identify a particular alert. name: alert_id required: true - auto: PREDEFINED description: Status of the alert can be new, assigned, resolved, or closed. name: status predefined: - open - assigned - closed - resolved required: true description: Set the status of an alert to new, assigned, resolved, or closed. name: uptycs-set-alert-status - arguments: - description: Uptycs asset id for the asset that the tag should be set on. name: asset_id required: true - description: Tag key that will be set on the asset. name: tag_key required: true - description: Tag value that will be set on the asset. name: tag_value description: Sets a tag on a particular asset. name: uptycs-set-asset-tag - arguments: - description: Unique Uptycs id for the user. name: user_id required: true description: get info for an Uptycs user. name: uptycs-get-user-information outputs: - contextPath: Uptycs.UserInfo.id description: unique Uptycs id for the user. type: string - contextPath: Uptycs.UserInfo.name description: Uptycs user's name. type: string - contextPath: Uptycs.UserInfo.email description: Uptycs user's email address. type: string - arguments: - description: the specific indicator you wish to search for. This can be an IP address, a Bad Domain, etc. as well ass any indicators you have added. name: indicator - defaultValue: '10' description: Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). name: limit description: get Uptycs threat indicators. name: uptycs-get-threat-indicators - arguments: - defaultValue: '10' description: Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). name: limit description: get Uptycs threat sources. name: uptycs-get-threat-sources - arguments: - defaultValue: '10' description: Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). name: limit description: get Uptycs threat vendors. name: uptycs-get-threat-vendors - arguments: - description: Only return assets with this asset id. Do not use arguments "asset_id" and "host_name_is" at the same time. name: asset_id - description: Time that the specified process was spawned. name: child_add_time required: true - description: Hostname for asset which spawned the specified process. name: host_name_is - description: pid for the parent process. name: parent required: true description: get the parent process information for a particular child process. name: uptycs-get-parent-information outputs: - contextPath: Uptycs.Parent.pid description: pid of the process (this is the same number as the input argument 'parent'). type: number - contextPath: Uptycs.Parent.upt_hostname description: hostname for asset which spawned the specified process. type: string - contextPath: Uptycs.Parent.upt_asset_id description: asset id for asset which spawned the specified process. type: string - contextPath: Uptycs.Parent.parent description: pid for the parent process (this is the parent of the input argument 'parent'). type: number - contextPath: Uptycs.Parent.upt_add_time description: time that the process was spawned. type: date - contextPath: Uptycs.Parent.upt_remove_time description: time that the process was removed. type: date - contextPath: Uptycs.Parent.name description: name of the process. type: string - contextPath: Uptycs.Parent.path description: path to the process binary. type: string - contextPath: Uptycs.Parent.cmdline description: complete argv for the process. type: string - contextPath: Uptycs.Parent.pgroup description: process group. type: number - contextPath: Uptycs.Parent.cwd description: process current working directory. type: string - arguments: - defaultValue: Custom threat source pushed from Demisto description: A short description for the threat source. name: description required: true - description: entry_id for the file with threat information. This file should be uploaded to demisto in the Playground War Room using the paperclip icon next to the CLI. name: entry_id required: true - description: The name for the threat source. name: name required: true description: post a new threat source to your threat sources in Uptycs. name: uptycs-post-threat-source - arguments: - defaultValue: '10' description: Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). name: limit description: get a list of Uptycs users. name: uptycs-get-users outputs: - contextPath: Uptycs.Users.id description: unique Uptycs id for the user. type: string - contextPath: Uptycs.Users.name description: Uptycs user's name. type: string - contextPath: Uptycs.Users.email description: Uptycs user's email address. type: string - contextPath: Uptycs.Users.createdAt description: datetime this user was added. type: date - contextPath: Uptycs.Users.updatedAt description: last time this user was updated. type: date - contextPath: Uptycs.Users.admin description: true if this user has admin privileges, false otherwise. type: boolean - contextPath: Uptycs.Users.active description: true if this user is currently active, false otherwise. type: boolean - arguments: - defaultValue: '10' description: Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). name: limit description: get Uptycs asset groups. name: uptycs-get-asset-groups outputs: - contextPath: Uptycs.AssetGroups.id description: unique Uptycs id for a particular object group. type: string - contextPath: Uptycs.AssetGroups.custom description: true if this is a custom asset group, false otherwise. type: boolean - contextPath: Uptycs.AssetGroups.createdAt description: datetime the group was created. type: date - contextPath: Uptycs.AssetGroups.updatedAt description: datetime the group was last updated. type: date - arguments: - description: return a list of users with access to this asset group. name: asset_group_id required: true description: get a list of users in a particular asset group. name: uptycs-get-user-asset-groups - arguments: - description: unique Uptycs id which identifies a specific threat indicator. name: indicator_id required: true description: retrieve information about a specific threat indicator using a unique threat indicator id. name: uptycs-get-threat-indicator outputs: - contextPath: Uptycs.ThreatIndicator.threat_source_id description: unique Uptycs id which identifies the source of this specific threat indicator. type: string - contextPath: Uptycs.ThreatIndicator.threat_vendor_id description: unique Uptycs id which identifies the vendor of this specific threat source. type: string - contextPath: Uptycs.ThreatIndicator.indicatorType description: type of threat indicator (IPv4, domain,...) type: string - contextPath: Uptycs.ThreatIndicator.indicator description: threat indicator. type: string - contextPath: Uptycs.ThreatIndicator.createdAt description: datetime the threat indicator was created. type: date - contextPath: Uptycs.ThreatIndicator.threadId description: unique id for the group of threat indicators this thread indicator belongs to. type: string - contextPath: Uptycs.ThreatIndicator.id description: unique id for this particular threat indicator. type: string - arguments: - description: unique Uptycs id for the threat source you wish to retrive. name: threat_source_id required: true description: retrieve information about a specific threat source. name: uptycs-get-threat-source - arguments: - description: Only return assets with this asset id. Do not use arguments "asset_id", "host_name_is" or "host_name_like" at the same time. name: asset_id - description: Only return assets with this hostname. Do not use arguments "host_name_is" and "host_name_like" at the same time. name: host_name_is - description: Only return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use arguments "host_name_is" and "host_name_like" at the same time. name: host_name_like - defaultValue: '10' description: Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). name: limit - description: Beginning of window to search for open connections. Format is "YYYY-MM-DD HH:MM:SS.000", for example, March 15, 2019 at 1:52:36 am would be written as "2019-03-15 01:52:36.000". name: start_window - description: End of window to search for open connections. Format is "YYYY-MM-DD HH:MM:SS.000", for example, March 15, 2019 at 1:52:36 am would be written as "2019-03-15 01:52:36.000". name: end_window - description: Exact time at which the process was spawned. name: time - description: 'Specifies how far back you want to look. Format examples: 2 hours, 4 minutes, 6 month, 1 day, etc.' name: time_ago description: find process events which are running or have run on a registered Uptycs asset. name: uptycs-get-process-events outputs: - contextPath: Uptycs.ProcessEvents.pid description: pid for a particular process. type: number - contextPath: Uptycs.ProcessEvents.parent description: pid for the parent of a particular process. type: number - contextPath: Uptycs.ProcessEvents.upt_asset_id description: uptycs asset id for the asset which is running (or ran) the process. type: string - contextPath: Uptycs.ProcessEvents.upt_hostname description: host name for the asset which is running (or ran) the process. type: string - contextPath: Uptycs.ProcessEvents.upt_time description: time at which the process was spawned. type: date - contextPath: Uptycs.ProcessEvents.path description: path to the process binary. type: string - contextPath: Uptycs.ProcessEvents.cmdline description: comeplete argv for the process. type: string - contextPath: Uptycs.ProcessEvents.cwd description: process current working directory. type: string - contextPath: Uptycs.ProcessEvents.ancestor_list description: list of ancestor processes (parent, grandparent, etc.) type: string - arguments: - description: Only return assets with this asset id. Do not use arguments "asset_id" and "host_name_is" at the same time. name: asset_id - description: Hostname for asset which spawned the specified process. name: host_name_is - description: pid for the process. name: pid required: true - description: Time that the specified process was spawned. name: time required: true description: get information for a particular process event. name: uptycs-get-process-event-information outputs: - contextPath: Uptycs.ProcEvent.pid description: pid for the process. type: number - contextPath: Uptycs.ProcEvent.upt_hostname description: hostname for asset which spawned the specified process. type: string - contextPath: Uptycs.ProcEvent.upt_asset_id description: asset id for asset which spawned the specified process. type: string - contextPath: Uptycs.ProcEvent.parent description: pid for the parent process. type: number - contextPath: Uptycs.ProcEvent.upt_time description: time that the process was spawned. type: date - contextPath: Uptycs.ProcEvent.path description: path to the process binary. type: string - contextPath: Uptycs.ProcEvent.cmdline description: comeplete argv for the process. type: string - contextPath: Uptycs.ProcEvent.cwd description: process current working directory. type: string - contextPath: Uptycs.ProcEvent.ancestor_list description: list of ancestor processes (parent, grandparent, etc.) type: string - arguments: - description: Only return assets with this asset id. Do not use arguments "asset_id", "host_name_is" or "host_name_like" at the same time. name: asset_id - description: Only return assets with this hostname. Do not use arguments "host_name_is" and "host_name_like" at the same time. name: host_name_is - description: Only return assets with this string in the hostname. Use this to find a selection of assets with similar hostnames. Do not use arguments "host_name_is" and "host_name_like" at the same time. name: host_name_like - description: IP address which process opened a socket to. name: ip - defaultValue: '10' description: Limit the number of entries returned. Use -1 to return all entries (may run slow or cause a time out). name: limit - description: Beginning of window to search for open sockets. Format is "YYYY-MM-DD HH:MM:SS.000", for example, March 15, 2019 at 1:52:36 am would be written as "2019-03-15 01:52:36.000". name: start_window - description: ' End of window to search for open sockets. Format is "YYYY-MM-DD HH:MM:SS.000", for example, March 15, 2019 at 1:52:36 am would be written as "2019-03-15 01:52:36.000".' name: end_window - description: Exact time at which the socket was opened. name: time - description: 'Specifies how far back you want to look. Format examples: 2 hours, 4 minutes, 6 month, 1 day, etc.' name: time_ago description: find processes which opened a socket. name: uptycs-get-socket-events outputs: - contextPath: Uptycs.SocketEvents.pid description: pid of process which opened a connection to a specified IP. type: number - contextPath: Uptycs.SocketEvents.upt_hostname description: hostname of the asset which ran the specified process. type: string - contextPath: Uptycs.SocketEvents.upt_time description: time at which the connection was opened. type: date - contextPath: Uptycs.SocketEvents.path description: file path to the process being run. type: string - contextPath: Uptycs.SocketEvents.local_address description: local IP for specified connection. type: string - contextPath: Uptycs.SocketEvents.remote_address description: remote IP for specified connection. type: string - contextPath: Uptycs.SocketEvents.local_port description: local port for specified connection. type: number - contextPath: Uptycs.SocketEvents.remote_port description: remote port for specified connection. type: number - contextPath: Uptycs.SocketEvents.upt_asset_id description: asset id for asset which ran the specified process. type: string - contextPath: Uptycs.SocketEvents.socket description: socket used to open the connection. type: number - contextPath: Uptycs.SocketEvents.family description: network protocol. type: number - contextPath: Uptycs.SocketEvents.action description: type of socket event (accept, connect, or bind). type: string - contextPath: Uptycs.SocketEvents.protocol description: transfer protocol. type: number - arguments: - description: Only return assets with this asset id. Do not use arguments "asset_id" and "host_name_is" at the same time. name: asset_id - description: Time that the specified process was spawned. name: child_add_time required: true - description: Hostname for asset which spawned the specified process. name: host_name_is - description: pid for the parent process. name: parent required: true - description: List of ancestor processes for specified child process. name: child_ancestor_list description: find information for parent process events which are running or have run on a registered Uptycs assert. name: uptycs-get-parent-event-information outputs: - contextPath: Uptycs.ParentEvent.pid description: pid of the process (this is the same number as the input argument 'parent'). type: number - contextPath: Uptycs.ParentEvent.upt_hostname description: hostname for asset which spawned the specified process. type: string - contextPath: Uptycs.ParentEvent.upt_asset_id description: asset id for asset which spawned the specified process. type: string - contextPath: Uptycs.ParentEvent.parent description: pid for the parent process (this is the parent of the input argument 'parent'). type: number - contextPath: Uptycs.ParentEvent.upt_time description: time that the process was spawned. type: date - contextPath: Uptycs.ParentEvent.path description: path to the parent process binary. type: string - contextPath: Uptycs.ParentEvent.cmdline description: complete argv for the parent process. type: string - contextPath: Uptycs.ParentEvent.cwd description: parent process current working cirectory. type: string - arguments: - description: Only return assets with this asset id. Do not use arguments "asset_id" and "host_name_is" at the same time. name: asset_id - description: Hostname for asset which spawned the specified process. name: host_name_is - description: IP address which process opened a socket to. name: ip required: true - description: Time that the specified connection was opened. name: time required: true description: get information for a particular socket event. name: uptycs-get-socket-event-information outputs: - contextPath: Uptycs.SocketEvents.pid description: pid of process which opened a connection to a specified IP. type: number - contextPath: Uptycs.SocketEvents.upt_hostname description: hostname of the asset which ran the specified process. type: string - contextPath: Uptycs.SocketEvents.upt_time description: time at which the connection was opened. type: date - contextPath: Uptycs.SocketEvents.path description: file path to the process being run. type: string - contextPath: Uptycs.SocketEvents.local_address description: local IP for specified connection. type: string - contextPath: Uptycs.SocketEvents.remote_address description: remote IP for specified connection. type: string - contextPath: Uptycs.SocketEvents.local_port description: local port for specified connection. type: number - contextPath: Uptycs.SocketEvents.remote_port description: remote port for specified connection. type: number - contextPath: Uptycs.SocketEvents.upt_asset_id description: asset id for asset which ran the specified process. type: string - contextPath: Uptycs.SocketEvents.action description: type of socket event (accept, connect, or bind). type: string - contextPath: Uptycs.SocketEvents.family description: network protocol. type: number - contextPath: Uptycs.SocketEvents.socket description: socket used to open the connection. type: number - contextPath: Uptycs.SocketEvents.protocol description: transfer protocol. type: number - arguments: - description: Uptycs asset id for the asset you are looking for. name: asset_id required: true description: Retrieve a list of tags for a particular asset. name: uptycs-get-asset-tags - arguments: - description: Only return the query with this unique id. name: query_id - description: Only return the query with this name. name: name description: Retrieve a saved query or list of all saved queries. name: uptycs-get-saved-queries outputs: - contextPath: Uptycs.SavedQueries.id description: unique uptycs query id. type: string - contextPath: Uptycs.SavedQueries.name description: name of query. type: string - arguments: - description: The name of the query you want to run. name: name - description: The unique id for the query you want to run. name: query_id - description: '*realtime queries only* This argument should be used when one wants to run a realtime query on a particular asset.' name: asset_id - description: '*realtime queries only* Only return assets with this hostname.' name: host_name_is - description: '*realtime queries only* . Only return assets with this string in the hostname.' name: host_name_like - description: If your saved query has variable arguments, write them here in a json format where the key is the name of the variable argument and value is the value you want to use for this particular query. name: variable_arguments description: Run a saved query. name: uptycs-run-saved-query outputs: - contextPath: Uptycs.RunQuery description: Results of executed query. type: Unknown - arguments: - defaultValue: '""' description: A short description for the query. name: description - auto: PREDEFINED description: The type of query (global or realtime). name: execution_type predefined: - global - realtime required: true - description: The name for the query. This should be unique to this query. name: name required: true - description: The query which will be saved. name: query required: true - auto: PREDEFINED defaultValue: default description: Type of issue the query addresses. name: type predefined: - default - compliance - hardware - incident - system - vulnerability - defaultValue: '""' description: Add the query to a group of queries. name: grouping description: Save a query to the Uptycs DB. name: uptycs-post-saved-query outputs: - contextPath: Uptycs.PostedQuery.name description: name of query. type: string - arguments: - description: Retrieve carves from a specific path. name: path description: Get the list of carves file from a specific path. name: uptycs-get-carves outputs: - contextPath: Uptycs.Carves.id description: Uptycs id of the carved file. type: string - contextPath: Uptycs.Carves.assetId description: Uptycs id of the asset. type: string - contextPath: Uptycs.Carves.path description: File path to the carved file. type: string - contextPath: Uptycs.Carves.createdAt description: Time at which the file was carved. type: date - contextPath: Uptycs.Carves.updatedAt description: Time at which the carve was updated. type: date - contextPath: Uptycs.Carves.status description: Status of carve in Uptycs database. type: string - contextPath: Uptycs.Carves.assetHostName description: Hostname in the Uptycs database. type: string - contextPath: Uptycs.Carves.offset description: Carved file size offset. type: number - contextPath: Uptycs.Carves.length description: Carved file size length. type: number - contextPath: Uptycs.Carves.deletedUserName description: Deleted user name. type: string - contextPath: Uptycs.Carves.deleted_at description: Time at which the carve was deleted. type: date - arguments: - description: uuid of a specific carved file. Get the id from the list of carves with the command uptycs-get-carves. name: carve_id required: true description: Get the url of a carved file using uuid. name: uptycs-get-carves-link outputs: - contextPath: Uptycs.CarvesLink.url description: Url of the carved file. type: string - arguments: - description: uuid of a specific carved file to download. Get the id from the list of carves with the command uptycs-get-carves. name: carve_id required: true description: Download a carved file using uuid. name: uptycs-get-carves-download-file - name: uptycs-get-asset-with-id description: Get an Uptycs asset details. arguments: - name: asset_id required: true description: Uptycs asset id. Get the id from the list of assets with the command uptycs-get-assets. outputs: - contextPath: Uptycs.Asset.hostName description: Hostname in Uptycs DB. type: string - contextPath: Uptycs.Asset.location description: Host location. type: string - contextPath: Uptycs.Asset.gateway description: Gateway ip. type: string - contextPath: Uptycs.Asset.cpuBrand description: Cpu brand. type: string - contextPath: Uptycs.Asset.hardwareModel description: Hardware model. type: string - contextPath: Uptycs.Asset.hardwareVendor description: Hardware vendor. type: string - contextPath: Uptycs.Asset.cores description: Number of cores. type: number - contextPath: Uptycs.Asset.logicalCores description: Number of logical cores. type: number - contextPath: Uptycs.Asset.memoryMb description: Memory in Mb. type: number - contextPath: Uptycs.Asset.os description: os installed on asset (Windows, Linux, Mac OS X). type: string - contextPath: Uptycs.Asset.osVersion description: os version. type: string - contextPath: Uptycs.Asset.osFlavor description: os flavor. type: string - contextPath: Uptycs.Asset.osKey description: os key. type: string - contextPath: Uptycs.Asset.osqueryVersion description: Uptycs osquery version. type: string - contextPath: Uptycs.Asset.status description: status of host. type: string - contextPath: Uptycs.Asset.arch description: Host cpu architecture. type: string - contextPath: Uptycs.Asset.agentVersion description: Uptycs agent version. type: string - contextPath: Uptycs.Asset.quarantinedStatus description: Uptycs agent quarantine status. type: string - contextPath: Uptycs.Asset.osDisplay description: os version detailed info. type: string - contextPath: Uptycs.Asset.tags description: Uptycs asset tags. type: string - contextPath: Uptycs.Asset.disabled description: Asset disabled status. type: boolean - contextPath: Uptycs.Asset.objectGroupId description: Uptycs object group id. type: string - contextPath: Uptycs.Asset.lastEnrolledAt description: Last enrolled at time. type: date - contextPath: Uptycs.Asset.live description: Asset live status. type: boolean - name: uptycs-get-tag description: Return Uptycs asset tag details. arguments: - name: tag_id required: true description: Uptycs tag id. Get the id from the list of tags with the command uptycs-get-tags. outputs: - contextPath: Uptycs.tag.tag description: Tag name in Uptycs DB. type: string - contextPath: Uptycs.tag.resourceType description: Tag resource type. type: string - contextPath: Uptycs.tag.seedId description: Uptycs seed id. type: string - contextPath: Uptycs.tag.key description: Tag key. type: string - contextPath: Uptycs.tag.value description: Tag value. type: string - contextPath: Uptycs.tag.flagProfileId description: Uptycs flag profile id. type: string - contextPath: Uptycs.tag.customProfileId description: Uptycs custom profile id. type: string - contextPath: Uptycs.tag.complianceProfileId description: Uptycs compliance profile id. type: string - contextPath: Uptycs.tag.processBlockRuleId description: Uptycs process block rule id. type: string - contextPath: Uptycs.tag.dnsBlockRuleId description: Uptycs dns block rule id. type: string - contextPath: Uptycs.tag.windowsDefenderPreferenceId description: Windows Defender Preference Id. type: string - contextPath: Uptycs.tag.createdBy description: Id of creator. type: string - contextPath: Uptycs.tag.updatedBy description: Id of last modifier. type: string - contextPath: Uptycs.tag.createdAt description: Created at time. type: date - contextPath: Uptycs.tag.updatedAt description: Updated at time. type: date - contextPath: Uptycs.tag.status description: Status of tag. type: string - contextPath: Uptycs.tag.source description: Source of tag. type: string - contextPath: Uptycs.tag.system description: Status of system. type: boolean - contextPath: Uptycs.tag.custom description: Status of custom. type: boolean - contextPath: Uptycs.tag.tagRuleId description: Uptycs tag rule id. type: string - name: uptycs-get-tags description: Return a list of Uptycs asset tags with details. arguments: - name: key description: Uptycs tag key. - name: value description: Uptycs tag value. outputs: - contextPath: Uptycs.tags.id description: Tag id in Uptycs DB. type: string - contextPath: Uptycs.tags.tag description: Tag name in Uptycs DB. type: string - contextPath: Uptycs.tags.resourceType description: Tag resource type. type: string - contextPath: Uptycs.tags.seedId description: Uptycs seed id. type: string - contextPath: Uptycs.tags.key description: Uptycs tag key. type: string - contextPath: Uptycs.tags.value description: Uptycs tag value. type: string - contextPath: Uptycs.tags.flagProfileId description: Uptycs flag profile id. type: string - contextPath: Uptycs.tags.customProfileId description: Uptycs custom profile id. type: string - contextPath: Uptycs.tags.complianceProfileId description: Uptycs compliance profile id. type: string - contextPath: Uptycs.tags.processBlockRuleId description: Uptycs process block rule id. type: string - contextPath: Uptycs.tags.dnsBlockRuleId description: Uptycs dns block rule id. type: string - contextPath: Uptycs.tags.windowsDefenderPreferenceId description: Windows Defender Preference Id. type: string - contextPath: Uptycs.tags.createdBy description: Id of tag creator. type: string - contextPath: Uptycs.tags.updatedBy description: Id of last modifier. type: string - contextPath: Uptycs.tags.createdAt description: Created at time. type: date - contextPath: Uptycs.tags.updatedAt description: Updated at time. type: date - contextPath: Uptycs.tags.status description: status of tag. type: string - contextPath: Uptycs.tags.source description: source of tag. type: string - contextPath: Uptycs.tags.system description: system status. type: boolean - contextPath: Uptycs.tags.custom description: custom status. type: boolean - contextPath: Uptycs.tags.tagRuleId description: Uptycs tag rule id. type: string - name: uptycs-delete-tag description: Delete an Uptycs asset tag. arguments: - name: tag_id required: true description: Delete the tag matching this id. Get the id from the list of tags with the command uptycs-get-tags. - name: uptycs-get-lookuptables description: get list of uptycs look up tables. arguments: [] outputs: - contextPath: Uptycs.lookuptables.id description: Uptycs id of look up table. type: string - contextPath: Uptycs.lookuptables.seedId description: Uptycs seed id. type: string - contextPath: Uptycs.lookuptables.name description: Look up table name. type: string - contextPath: Uptycs.lookuptables.description description: Description of the table. type: string - contextPath: Uptycs.lookuptables.active description: Active status of the table. type: boolean - contextPath: Uptycs.lookuptables.idField description: Uptycs id field. type: string - contextPath: Uptycs.lookuptables.rowCount description: Row count of table. type: number - contextPath: Uptycs.lookuptables.forRuleEngine description: Status of flag forRuleEngine. type: boolean - contextPath: Uptycs.lookuptables.createdBy description: Id of creator. type: string - contextPath: Uptycs.lookuptables.updatedBy description: Id of last modifier. type: string - contextPath: Uptycs.lookuptables.createdAt description: Created at time. type: date - contextPath: Uptycs.lookuptables.updatedAt description: Updated at time. type: date - contextPath: Uptycs.lookuptables.dataLookupTable description: Data look up table name. type: string - contextPath: Uptycs.lookuptables.fetchRowsquery description: Query used to fetch rows. type: string - name: uptycs-get-lookuptable description: Get an Uptycs lookup table details. arguments: - name: table_id required: true description: Id of table in Uptycs DB. Get the id from the list of tables with the command uptycs-get-lookuptables. outputs: - contextPath: Uptycs.lookuptable.seedId description: Uptycs seed id. type: string - contextPath: Uptycs.lookuptable.name description: Look up table name. type: string - contextPath: Uptycs.lookuptable.description description: Description of the table. type: string - contextPath: Uptycs.lookuptable.active description: Active status of the table. type: boolean - contextPath: Uptycs.lookuptable.idField description: Uptycs id field. type: string - contextPath: Uptycs.lookuptable.rowCount description: Row count of table. type: number - contextPath: Uptycs.lookuptable.forRuleEngine description: Status of flag forRuleEngine. type: boolean - contextPath: Uptycs.lookuptable.createdBy description: Id of creator. type: string - contextPath: Uptycs.lookuptable.updatedBy description: Id of last modifier. type: string - contextPath: Uptycs.lookuptable.createdAt description: Created at time. type: date - contextPath: Uptycs.lookuptable.updatedAt description: Updated at time. type: date - contextPath: Uptycs.lookuptable.dataLookupTable description: Data look up table name. type: string - contextPath: Uptycs.lookuptable.fetchRowsquery description: Query used to fetch rows. type: string - name: uptycs-create-lookuptable description: Create a new Uptycs lookup table. arguments: - name: name required: true description: Name of a lookup table. - name: id_field required: true description: Id field for the table. An identifier (ID) from the JSON/CSV file you want to upload. Select an ID based on the context of lookup data. For example, a domain lookup ID can be domain, or a port lookup ID can be port. This ID must be the same as defined in the JSON file to be uploaded, otherwise Uptycs does not capture the JSON data. This field is case sensitive and cannot be edited after a lookup table is saved. - name: description description: Description of a lookup table. - name: filename required: true description: The name of the file being uploaded. This file should be uploaded to Cortex XSOAR in the Playground War Room using the paperclip icon next to the CLI. outputs: - contextPath: Uptycs.lookuptable.id description: Id of lookup table in Uptycs DB. type: string - contextPath: Uptycs.lookuptable.name description: Name of the created lookup table. type: string - name: uptycs-edit-lookuptable description: Edit an Uptycs lookup table. arguments: - name: table_id required: true description: Look up table id. Get the id from the list of tables with the command uptycs-get-lookuptables. - name: name description: Name of a lookup table. - name: description description: A lookup table description. - name: active auto: PREDEFINED defaultValue: true description: Enable or disable the table with a boolean flag of true or false. predefined: - 'true' - 'false' outputs: - contextPath: Uptycs.lookuptable description: response. type: string - name: uptycs-delete-lookuptable description: Delete an Uptycs lookup table. arguments: - name: table_id required: true description: Table id in Uptycs DB. Get the id from the list of tables with the command uptycs-get-lookuptables. - name: uptycs-delete-assets-tag description: Disassociate an asset with a tag. arguments: - name: asset_id required: true description: Disassociate the asset matching this asset id with the given tag_id. Get the id from the list of asset with the command uptycs-get-assets. - name: tag_id required: true description: Disassociate the tag matching this id with the given asset_id. Get the id from the list of tags with the command uptycs-get-tags. - name: uptycs-post-lookuptable-data description: Update csv data for a look up table. arguments: - name: table_id required: true description: Look up table id. Get the id from the list of tables with the command uptycs-get-lookuptables. - name: filename required: true description: The name of the file being uploaded. This file should be uploaded to Cortex XSOAR in the Playground War Room using the paperclip icon next to the CLI. dockerimage: demisto/auth-utils:1.0.0.10133006 isfetch: true runonce: true script: '-' type: python subtype: python3 tests: - No tests (auto formatted)