Uptycs

Fetches data from the Uptycs database.

Category

Analytics & SIEM

Pack

Uptycs

Configuration parameters

• key — API key (required)
• secret — API secret (required)
• domain — API domain (e.g. teststack.uptycs.io) (required)
• customer_id — API Customer ID (required)
• isFetch — Fetch incidents
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• fetch_time — First fetch since (<number> <time unit>, e.g., 12 hours, 7 days)

Commands (47)

• uptycs-create-lookuptable — Create a new Uptycs lookup table.
• uptycs-delete-assets-tag — Disassociate an asset with a tag.
• uptycs-delete-lookuptable — Delete an Uptycs lookup table.
• uptycs-delete-tag — Delete an Uptycs asset tag.
• uptycs-edit-lookuptable — Edit an Uptycs lookup table.
• uptycs-get-alert-rules — Returns a list of alert rules.
• uptycs-get-alerts — Returns alerts from the Uptycs database. Do not use the "asset_id", "host_name_is" argument and "host_name_like" argument in the same command.
• uptycs-get-asset-groups — get Uptycs asset groups.
• uptycs-get-asset-tags — Retrieve a list of tags for a particular asset.
• uptycs-get-asset-with-id — Get an Uptycs asset details.
• uptycs-get-assets — Returns assets enrolled with Uptycs. Do not use the "host_name_is" argument and "host_name_like" in the same command.
• uptycs-get-carves — Get the list of carves file from a specific path.
• uptycs-get-carves-download-file — Download a carved file using uuid.
• uptycs-get-carves-link — Get the url of a carved file using uuid.
• uptycs-get-event-rules — Returns a list of event rules.
• uptycs-get-events — Returns events from the Uptycs database.
• uptycs-get-lookuptable — Get an Uptycs lookup table details.
• uptycs-get-lookuptables — get list of uptycs look up tables.
• uptycs-get-parent-event-information — find information for parent process events which are running or have run on a registered Uptycs assert.
• uptycs-get-parent-information — get the parent process information for a particular child process.
• uptycs-get-process-child-processes — get all the child processes for a given parent process.
• uptycs-get-process-event-information — get information for a particular process event.
• uptycs-get-process-events — find process events which are running or have run on a registered Uptycs asset.
• uptycs-get-process-information — get information for a particular process.
• uptycs-get-process-open-files — find processes which have opened files.
• uptycs-get-process-open-sockets — Finds processes that opened a socket.
• uptycs-get-processes — find processes which are running or have run on a registered Uptycs asset.
• uptycs-get-saved-queries — Retrieve a saved query or list of all saved queries.
• uptycs-get-socket-event-information — get information for a particular socket event.
• uptycs-get-socket-events — find processes which opened a socket.
• uptycs-get-tag — Return Uptycs asset tag details.
• uptycs-get-tags — Return a list of Uptycs asset tags with details.
• uptycs-get-threat-indicator — retrieve information about a specific threat indicator using a unique threat indicator id.
• uptycs-get-threat-indicators — get Uptycs threat indicators.
• uptycs-get-threat-source — retrieve information about a specific threat source.
• uptycs-get-threat-sources — get Uptycs threat sources.
• uptycs-get-threat-vendors — get Uptycs threat vendors.
• uptycs-get-user-asset-groups — get a list of users in a particular asset group.
• uptycs-get-user-information — get info for an Uptycs user.
• uptycs-get-users — get a list of Uptycs users.
• uptycs-post-lookuptable-data — Update csv data for a look up table.
• uptycs-post-saved-query — Save a query to the Uptycs DB.
• uptycs-post-threat-source — post a new threat source to your threat sources in Uptycs.
• uptycs-run-query — Runs the specified SQL query against your Uptycs database. A list of tables can be found at osquery.io/schema, or by using the query "select * from information_schema.tables".
• uptycs-run-saved-query — Run a saved query.
• uptycs-set-alert-status — Set the status of an alert to new, assigned, resolved, or closed.
• uptycs-set-asset-tag — Sets a tag on a particular asset.