Uptycs - Outbound Connection to Threat IOC Incident

Get information about connections from IOC incidents.

Pack

Uptycs

Tasks

18

Inputs

• alert_id — Unique Uptycs ID for a particular alert
• alert_time — Time the alert was fired

Outputs

• Uptycs.ProcEvent.pid — pid for the process
• Uptycs.ProcEvent.upt_time — time that the process was spawned
• Uptycs.ParentEvent.pid — pid of the process (this is the same number as the input argument 'parent')
• Uptycs.ParentEvent.upt_time — time that the process was spawned
• Uptycs.Children.pid — pid of a child process
• Uptycs.Children.upt_add_time — time that the process was spawned
• Uptycs.Children.upt_remove_time — time that the process was removed

Commands used

• uptycs-get-alerts
• uptycs-get-parent-event-information
• uptycs-get-parent-information
• uptycs-get-process-child-processes
• uptycs-get-process-event-information
• uptycs-get-socket-events