CimTrak

The CimTrak integration helps you detect unexpected system/device/config modifications and automatically respond/react to threats.

Category

Forensics & Malware Analysis

Pack

CimTrak-SystemIntegrityAssurance

Configuration parameters

• url — App Server URL (required)
• isFetch — Fetch incidents
• incidentType — Incident type
• apikey — API Key (required)
• insecure — Trust any certificate (not secure)
• Repository URL — Repository URL (required)
• Repository Port — Repository Port (required)
• incidentFetchInterval — Incidents Fetch Interval
• proxy — Use system proxy settings
• first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
• max_fetch — Maximum number of incidents to fetch every time

Commands (37)

• add-hash-allow-list — Add Hash to allow list.
• add-hash-deny-list — Add Hash to deny list.
• add-ticket — Creates a ticket.
• add-ticket-comment — Adds a comment to a ticket or task.
• check-file-against-trusted-file-registry-by-hash — Description Issues a request to check a list of files (specified by hashes) against the trusted file registry.
• compliance-scan-children — Launch compliance scan for all children of object.
• compliance-scan-with-summary — Launch compliance scan for object and return results.
• delete-hash-allow-list — Add Hash to allow list.
• delete-hash-deny-list — Add Hash to deny list.
• demote-authoritative-baseline-files — This function removes a file (or list of files) from being the authoritative baseline.
• deploy — Deploys a specific version of an object group. All existing files will be overwritten with the specified set.
• deploy-by-date — Deploy By Date.
• file-analysis-by-hash — Submits a file's hash for analysis and returns the results.
• file-analysis-by-objectdetail-id — Submits a file's objectDetailId for analysis and returns the results.
• force-sync — Sends a request to the server to synchronize an object group.
• get-agent-info — Returns an array of agent information given an object ID.
• get-agent-object-by-alternate-id — Get agent object from alternate id.
• get-agent-object-by-ip — Get agent object from ip address.
• get-agent-object-by-name — Get agent object from agent name.
• get-agent-object-id-by-alternate-system-id — Get agent object id from alternate system id.
• get-compliance-archive-details — Returns compliance scans details.
• get-compliance-archive-summary — Returns compliance scans summary.
• get-current-compliance-items — This function returns the benchmarks and/or compliance mappings for the compliance policy specified by the object ID.
• get-events — Returns Events from the event log.
• get-object — Retrieves information for an object.
• get-object-group — This function returns an entire data structure describing an object group.
• get-objects — Retrieves a list of objects.
• get-sub-generations — Returns the subGenerations for an object group (specified by object ID.
• get-ticket-tasks — This function gets ticket task information from a CimTrak Master Repository. This function returns an array of ticket task objects.
• get-tickets — This function gets ticket information from a CimTrak Master Repository. This function returns an array of ticket objects.
• lock — Locks an object group.
• promote-authoritative-baseline-files — This function sets a file (or list of files) as the authoritative baseline.
• run-report-by-name — This function runs the report specified by the report name. The report name can be obtained from the getReportHeaders API. The report's parameters can be obtained from the getReportArguments API.
• unlock — Unlocks an object group.
• update-task-disposition — Updates the tasks specified in taskIdArray to the disposition specified in the disposition parameter.
• update-ticket — Update Ticket.
• view-file — This function returns the contents of the requested file encoded in base64.