FireEye Helix Archive Search

Create an archive search in FireEye Helix, and fetch the results as events.

Pack

FireEyeHelix

Tasks

7

Inputs

• Query — Query to execute. This is the search clause in an MQL.
• Start — Start time of the event in date format yyyy-mm-dd or yyyy-mm.
• Offset — Offset of the result.
• Groupby — Returns the unique values for the specified field and groups them together based on the specified frequency. For example, groupby="srcipv4 5 100" will group the top 5 srcipv4 that have at least 100 occurences. Multiple values can be provided using a comma separated list.
• Sort_by — Sorts results by this field. Default is descending order; to change this add the following to the command: argument sort_order="asc"
• Sort_order — Controls the order of the results sorted by the sort_by argument, ascending or descending.
• Limit — Number of events for which to search.
• Timeout — Amount of time for which to poll before declaring a timeout and resuming the playbook (in minutes).
• Interval — Frequency with which the polling command runs (minutes).
• End — End time of the event, in date format yyyy-mm-dd or yyyy-mm.

Outputs

• FireEyeHelixSearch.Result.ID — Event ID.
• FireEyeHelixSearch.Result.Type — Event type.
• FireEyeHelixSearch.Result.Result — Event result.
• FireEyeHelixSearch.Result.MatchedAt — Time at which the the event was matched.
• FireEyeHelixSearch.Result.Confidence — Confidence of the event. Can be either low, medium or high.
• FireEyeHelixSearch.Result.Status — Status of the event.
• FireEyeHelixSearch.Result.EventTime — Time at which the event took place.
• FireEyeHelixSearch.Result.DetectedRuleID — ID of the detected rule.
• FireEyeHelixSearch.Result.PID — Process ID.
• FireEyeHelixSearch.Result.Process — Process details.
• FireEyeHelixSearch.Result.ProcessPath — Process path.
• FireEyeHelixSearch.Result.FileName — Name of the file affected by the event.
• FireEyeHelixSearch.Result.FilePath — Path of the file affected by the event.
• FireEyeHelixSearch.Result.DeviceName — Device name.
• FireEyeHelixSearch.Result.Size — Size of the file that created the event in bytes.
• FireEyeHelixSearch.Result.Virus — Virus that was detected in the event.
• FireEyeHelixSearch.Result.MalwareType — Malware type of the virus that was detected.
• FireEyeHelixSearch.Result.CreatedTime — Time at which the event was created.
• FireEyeHelixSearch.Result.Class — Event class.
• FireEyeHelixSearch.Result.MD5 — MD5 hash of the affected file.
• FireEyeHelixSearch.Result.SHA1 — SHA1 hash of the affected file.
• FireEyeHelixSearch.Result.Protocol — Protocol used in the event.
• FireEyeHelixSearch.Result.SourceIPv4 — IPv4 address of the event source.
• FireEyeHelixSearch.Result.SourceIPv6 — IPv6 address of the event source.
• FireEyeHelixSearch.Result.SourcePort — Port of the event source address.
• FireEyeHelixSearch.Result.SourceLongitude — Longitude of the event source address.
• FireEyeHelixSearch.Result.SourceLatitude — Latitude of the event source address.
• FireEyeHelixSearch.Result.DestinationIPv4 — IPv4 address of the event destination.
• FireEyeHelixSearch.Result.DestinationIPv6 — IPv6 address of the event destination.
• FireEyeHelixSearch.Result.DestinationPort — Port of the event destination address.
• FireEyeHelixSearch.Result.ReportTime — Time at which the event was reported.
• FireEyeHelixSearch.Result.FalsePositive — Boolean flag - is the event a false positive.
• FireEyeHelixSearch.Result.Domain — Domain of the recepient.
• FireEyeHelixSearch.Result.From — Source email address.
• FireEyeHelixSearch.Result.SourceDomain — Domain of the host that created the event.
• FireEyeHelixSearch.Result.SourceISP — ISP of the source of the event.
• FireEyeHelixSearch.Result.DestinationISP — ISP of the destination of the event.
• FireEyeHelixSearch.Result.To — Destination email address.
• FireEyeHelixSearch.Result.Attachment — Email attachment.
• FireEyeHelixSearch.MQL — MQL query that created the result.
• FireEyeHelixSearch.GroupBy — Group by values.
• FireEyeHelixSearch.GroupBy.DocCount — Number of matches for the group.
• FireEyeHelixSearch.Result.RcpTo — \'Recipient of\' email address.
• FireEyeHelixSearch.Result.InReplyTo — \'Reply to\' email address.

Commands used

• fireeye-helix-archive-search
• fireeye-helix-archive-search-get-results