category: Endpoint
provider: LevelBlue
commonfields:
  id: Cybereason
  version: -1
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: server
  required: true
  type: 0
  section: Connect
- display: Credentials
  name: credentials
  type: 9
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: fetch_time
  type: 0
  required: false
  section: Collect
- defaultvalue: MALOP UPDATE TIME
  display: Fetch by "MALOP UPDATE TIME" (Fetching by Malop creation time is no longer supported)
  name: fetch_by
  type: 0
  required: false
  section: Collect
- defaultvalue: "false"
  display: Check this box to Enable Polling for Cybereason EPP Malops.
  name: enable_epp_poll
  type: 8
  required: false
  section: Collect
description: Endpoint detection and response to manage and query malops, connections and processes.
display: Cybereason
name: Cybereason
script:
  commands:
  - arguments:
    - description: The hostname of the machine.
      name: machineName
      required: true
    - name: page
      description: The page number of machine records to retrieve (used for pagination) starting from 1. The page size is defined by the "pageSize" argument.
    - name: pageSize
      description: The number of machine records per page to retrieve (used for pagination). The page number is defined by the "page" argument.
    - name: limit
      description: The maximum number of records to retrieve. If "pageSize" is defined, this argument is ignored.
      defaultValue: '50'
    description: Get the Machine FQDN and Machine Group Details.
    name: cybereason-get-machine-details
    outputs:
    - contextPath: Cybereason.Sensor.MachineID
      description: Sensor ID of machine.
      type: string
    - contextPath: Cybereason.Sensor.MachineName
      description: Host name of machine.
      type: string
    - contextPath: Cybereason.Sensor.MachineFQDN
      description: FQDN of machine.
      type: string
    - contextPath: Cybereason.Sensor.GroupID
      description: Group ID of machine.
      type: string
    - contextPath: Cybereason.Sensor.GroupName
      description: Group Name of machine.
      type: string
  - arguments:
    - description: Sensor ID of Cybereason Sensor.
      name: sensorID
      required: true
    - description: Reason for Archiving Cybereason Sensor.
      name: archiveReason
      required: true
    description: Archives a Sensor.
    name: cybereason-archive-sensor
  - arguments:
    - description: Sensor ID of Cybereason Sensor.
      name: sensorID
      required: true
    - description: Reason for Unarchiving Cybereason Sensor.
      name: unarchiveReason
      required: true
    description: Unarchives a Sensor.
    name: cybereason-unarchive-sensor
  - arguments:
    - description: Sensor ID of Cybereason Sensor.
      name: sensorID
      required: true
    description: Deletes a Sensor.
    name: cybereason-delete-sensor
  - arguments:
    - description: The hostname of the machine.
      name: machine
    - auto: PREDEFINED
      defaultValue: "false"
      description: Show only suspicious processes.
      name: onlySuspicious
      predefined:
      - "true"
      - "false"
    - defaultValue: "10000"
      description: Maximum number of results to retrieve.
      name: limit
    - description: Process name to filter by.
      name: processName
    - auto: PREDEFINED
      defaultValue: "false"
      description: If true, save the result to the context.
      name: saveToContext
      predefined:
      - "true"
      - "false"
    - auto: PREDEFINED
      defaultValue: "false"
      description: Filter only processes with incoming connections.
      name: hasIncomingConnection
      predefined:
      - "true"
      - "false"
    - auto: PREDEFINED
      defaultValue: "false"
      description: Filter only processes with outgoing connections.
      name: hasOutgoingConnection
      predefined:
      - "true"
      - "false"
    - auto: PREDEFINED
      description: If process has external connection.
      name: hasExternalConnection
      predefined:
      - "true"
      - "false"
    - auto: PREDEFINED
      description: If process is not known to reputation services and its image file is unsigned.
      name: unsignedUnknownReputation
      predefined:
      - "true"
      - "false"
    - auto: PREDEFINED
      description: If process is running from temporary folder.
      name: fromTemporaryFolder
      predefined:
      - "true"
      - "false"
    - auto: PREDEFINED
      description: If process was identified elevating its privileges to local system user.
      name: privilegesEscalation
      predefined:
      - "true"
      - "false"
    - auto: PREDEFINED
      description: If the process was executed by PsExec service and is suspicious as being executed maliciously.
      name: maliciousPsExec
      predefined:
      - "true"
      - "false"
    description: Searches for processes with various filters.
    name: cybereason-query-processes
    outputs:
    - contextPath: Cybereason.Process.Name
      description: The process name.
      type: Unknown
    - contextPath: Cybereason.Process.Malicious
      description: Malicious status of the process.
      type: Unknown
    - contextPath: Cybereason.Process.CreationTime
      description: The process creation time.
      type: Unknown
    - contextPath: Cybereason.Process.EndTime
      description: The process end time.
      type: Unknown
    - contextPath: Cybereason.Process.CommandLine
      description: The command line of the process.
      type: Unknown
    - contextPath: Cybereason.Process.SignedAndVerified
      description: Is the process signed and verified.
      type: Unknown
    - contextPath: Cybereason.Process.ProductType
      description: The product type.
      type: Unknown
    - contextPath: Cybereason.Process.Children
      description: Children of the process.
      type: Unknown
    - contextPath: Cybereason.Process.Parent
      description: The parent process.
      type: Unknown
    - contextPath: Cybereason.Process.OwnerMachine
      description: The machine's hostname.
      type: Unknown
    - contextPath: Cybereason.Process.User
      description: The user who ran the process.
      type: Unknown
    - contextPath: Cybereason.Process.ImageFile
      description: Image file of the process.
      type: Unknown
    - contextPath: Cybereason.Process.SHA1
      description: SHA1 of the process file.
      type: Unknown
    - contextPath: Cybereason.Process.MD5
      description: MD5 of the process file.
      type: Unknown
    - contextPath: Cybereason.Process.CompanyName
      description: The company's name.
      type: Unknown
    - contextPath: Cybereason.Process.ProductName
      description: The product's name.
      type: Unknown
  - arguments:
    - description: The hostname of the machine to check.
      name: machine
      required: true
    description: Checks if the machine is currently connected to the Cybereason server.
    name: cybereason-is-probe-connected
    outputs:
    - contextPath: Cybereason.Machine.isConnected
      description: true if machine is connected, else false.
      type: boolean
    - contextPath: Cybereason.Machine.Name
      description: Machine name.
      type: string
  - arguments:
    - description: Filter connections which contain this IP (in or out).
      name: ip
    - description: Filter connections on the given machine.
      name: machine
    - description: If true, save the result to the context.
      name: saveToContext
      auto: PREDEFINED
      defaultValue: "false"
      predefined:
      - "true"
      - "false"
    description: Searches for connections.
    name: cybereason-query-connections
    outputs:
    - contextPath: Cybereason.Connection.Name
      description: The connection's name.
      type: Unknown
    - contextPath: Cybereason.Connection.Direction
      description: OUTGOING/INCOMING.
      type: Unknown
    - contextPath: Cybereason.Connection.ServerAddress
      description: Address of the Cybereason machine.
      type: Unknown
    - contextPath: Cybereason.Connection.ServerPort
      description: Port of the Cybereason machine.
      type: Unknown
    - contextPath: Cybereason.Connection.PortType
      description: Type of the connection.
      type: Unknown
    - contextPath: Cybereason.Connection.ReceivedBytes
      description: Received bytes count.
      type: Unknown
    - contextPath: Cybereason.Connection.TransmittedBytes
      description: Transmitted bytes count.
      type: Unknown
    - contextPath: Cybereason.Connection.RemoteCountry
      description: The connection's remote country.
      type: Unknown
    - contextPath: Cybereason.Connection.OwnerMachine
      description: The machine's hostname.
      type: Unknown
    - contextPath: Cybereason.Connection.OwnerProcess
      description: The process which performed the connection.
      type: Unknown
    - contextPath: Cybereason.Connection.CreationTime
      description: Creation time of the connection.
      type: Unknown
    - contextPath: Cybereason.Connection.EndTime
      description: End time of the connection.
      type: Unknown
  - arguments:
    - default: true
      description: Machine name to be isolated.
      name: machine
      required: true
    description: Isolates a machine that has been infected from the rest of the network.
    execution: true
    name: cybereason-isolate-machine
    outputs:
    - contextPath: Cybereason.Machine
      description: Machine name.
      type: string
    - contextPath: Cybereason.IsIsolated
      description: Is the machine isolated.
      type: boolean
  - arguments:
    - description: Machine name to be un-isolated.
      name: machine
      default: true
      required: true
    description: Stops isolation of a machine.
    name: cybereason-unisolate-machine
    outputs:
    - contextPath: Cybereason.Machine
      description: Machine name.
      type: string
    - contextPath: Cybereason.IsIsolated
      description: Is the machine isolated.
      type: boolean
    execution: true
  - arguments:
    - description: Filter to filter response by, given in Cybereason API syntax.
      name: filters
    - description: The total number of results to return for your Server. Ensure you make the limit a reasonable number to maximize Server performance and not to overload the system.
      name: totalResultLimit
    - description: The number of items to return per Malop group.
      name: perGroupLimit
    - auto: PREDEFINED
      defaultValue: MALOP
      description: "The level of detail to provide in the response. Possible values include:  SPECIFIC:  References value contain only the count in the ElementValues class. The Suspicions map is calculated for each results, with the suspicion name and the first time the suspicion appeared. The Evidence map is not calculated for the results. CUSTOM:  Reference values contain the specific Elements, up to the limit defined in the perFeatureLimit parameter. The Suspicions map is not calculated for the results. The Evidence map is not calculated for the results. DETAILS:  Reference values contain the specific Elements, up to the limit defined in the perFeatureLimit parameter. The Suspicions map is calculated for each result, containing the suspicion name and the first time the suspicion appeared. The Evidence map is not calculated for the results."
      name: templateContext
      predefined:
      - MALOP
      - SPECIFIC
      - CUSTOM
      - DETAILS
      - OVERVIEW
    - description: Return all the malops within the last days.
      name: withinLastDays
    - description: Malop GUIDs to filter by (Comma separated values supported, e.g. 11.5681864988155542407,11.1773255057963879999).
      name: malopGuid
    description: Returns a list of all Malops and details on the Malops.
    name: cybereason-query-malops
    outputs:
    - contextPath: Cybereason.Malops.GUID
      description: The unique globally unique identifier (guid) for the Malop.
      type: string
    - contextPath: Cybereason.Malops.CreationTime
      description: The time reported as when the malicious behavior began on the system. This is not the time that the Malop was first detected by Cybereason.
      type: string
    - contextPath: Cybereason.Malops.DecisionFeature
      description: The reason that Cybereason has raised the Malop.
      type: string
    - contextPath: Cybereason.Malops.Link
      description: Link to the Malop on Cybereason.
      type: string
    - contextPath: Cybereason.Malops.Suspects
      description: Malop suspect type and name.
      type: string
    - contextPath: Cybereason.Malops.LastUpdatedTime
      description: Last updated time of malop.
      type: string
    - contextPath: Cybereason.Malops.AffectedMachine
      description: List of machines affected by this Malop.
      type: string
    - contextPath: Cybereason.Malops.InvolvedHash
      description: List of file hashes involved in this Malop.
      type: string
    - contextPath: Cybereason.Malops.Status
      description: Malop managemant status.
      type: string
  - arguments:
    - description: malopGuid of the Cybereason Malop.
      name: malopGuid
      required: true
    description: Get Management Malop details.
    name: cybereason-query-malop-management
    outputs:
    - contextPath: Cybereason.Malops.GUID
      description: The unique globally unique identifier (guid) for the Malop.
      type: string
    - contextPath: Cybereason.Malops.CreationTime
      description: The time reported as when the malicious behavior began on the system. This is not the time that the Malop was first detected by Cybereason.
      type: string
    - contextPath: Cybereason.Malops.Link
      description: Link to the Malop on Cybereason.
      type: string
    - contextPath: Cybereason.Malops.LastUpdatedTime
      description: Last updated time of malop.
      type: string
    - contextPath: Cybereason.Malops.InvolvedHash
      description: List of file hashes involved in this Malop.
      type: string
    - contextPath: Cybereason.Malops.Status
      description: Malop managemant status.
      type: string
    - contextPath: Cybereason.Malops.Severity
      description: Severity of Malop.
      type: string
    - contextPath: Cybereason.Malops.Machines
      description: List of Machines involved in this Malop.
      type: string
    - contextPath: Cybereason.Malops.Users
      description: List of Users involved in this Malop.
      type: string
    - contextPath: Cybereason.Malops.DecisionStatuses
      description: List of Decision Statuses involved in this Malop.
      type: string
    - contextPath: Cybereason.Malops.DetectionTypes
      description: List of Detection Types involved in this Malop.
      type: string
    - contextPath: Cybereason.Malops.DetectionEngines
      description: List of Detection Engines involved in this Malop.
      type: string
    - contextPath: Cybereason.Malops.MitreTechniques
      description: List of Mitre Techniques involved in this Malop.
      type: string
    - contextPath: Cybereason.Malops.MalopCloserName
      description: List of Malop Closer Name involved in this Malop.
      type: string
  - arguments:
    - description: processGuid of the Cybereason Malop (can accept multiple guids separated by comma).
      name: processGuid
      required: true
    description: Get Process Attack Tree URL.
    name: cybereason-process-attack-tree
    outputs:
    - contextPath: Cybereason.Process.ProcessID
      description: Cybereason Process ID.
      type: string
    - contextPath: Cybereason.Process.URL
      description: Attack tree url for a given Process.
      type: string
  - arguments:
    - description: Array of malop GUIDs separated by comma. (Malop GUID can be retrieved with the command cybereason-query-malops command).
      name: malopGuids
      required: true
    - description: Machine names which were affected by malop. Comma separated values supported (e.g., machine1,machine2).
      name: machineName
    - description: Starting Date and Time to filter the Processes based on their creation date. The format for the input is ("YYYY/MM/DD HH:MM:SS").
      name: dateTime
    description: Returns a list of malops.
    name: cybereason-malop-processes
    outputs:
    - contextPath: Cybereason.Process.Name
      description: The process name.
      type: string
    - contextPath: Cybereason.Process.Malicious
      description: Malicious status of the process.
      type: Unknown
    - contextPath: Cybereason.Process.CreationTime
      description: The process creation time.
      type: date
    - contextPath: Cybereason.Process.EndTime
      description: The process end time.
      type: date
    - contextPath: Cybereason.Process.CommandLine
      description: The command line of the process.
      type: string
    - contextPath: Cybereason.Process.SignedAndVerified
      description: Is the process signed and verified.
      type: Unknown
    - contextPath: Cybereason.Process.ProductType
      description: The product type.
      type: Unknown
    - contextPath: Cybereason.Process.Children
      description: Children of the process.
      type: Unknown
    - contextPath: Cybereason.Process.Parent
      description: The parent process.
      type: Unknown
    - contextPath: Cybereason.Process.OwnerMachine
      description: The machine's hostname.
      type: Unknown
    - contextPath: Cybereason.Process.User
      description: The user who ran the process.
      type: string
    - contextPath: Cybereason.Process.ImageFile
      description: Image file of the process.
      type: Unknown
    - contextPath: Cybereason.Process.SHA1
      description: SHA1 of the process file.
      type: string
    - contextPath: Cybereason.Process.MD5
      description: MD5 of the process file.
      type: string
    - contextPath: Cybereason.Process.CompanyName
      description: The company's name.
      type: string
    - contextPath: Cybereason.Process.ProductName
      description: The product's name.
      type: string
  - arguments:
    - description: Comment to add to the malop.
      name: comment
      required: true
    - description: Malop GUID to add comment to. (Malop GUID can be retrieved with the command cybereason-query-malops command).
      name: malopGuid
      required: true
    description: Add new comment to malop.
    name: cybereason-add-comment
  - arguments:
    - description: Malop GUID to update its status.
      name: malopGuid
      required: true
    - auto: PREDEFINED
      description: Status to update.
      name: status
      predefined:
      - To Review
      - Unread
      - Remediated
      - Not Relevant
      - Open
      required: true
    description: Updates malop status.
    name: cybereason-update-malop-status
    outputs:
    - contextPath: Cybereason.Malops.GUID
      description: Malop GUID.
      type: string
    - contextPath: Cybereason.Malops.Status
      description: "Malop status: To Review,Unread,Remediated,Not Relevant."
      type: string
  - arguments:
    - description: Malop GUID to update its investigation status.
      name: malopGuid
      required: true
    - auto: PREDEFINED
      description: Investigation status to update.
      name: investigationStatus
      predefined:
      - Pending
      - Reopened
      - Under Investigation
      - On Hold
      - Closed
      required: true
    description: Updates malop investigation status.
    name: cybereason-update-malop-investigation-status
    outputs:
    - contextPath: Cybereason.Malops.GUID
      description: Malop GUID.
      type: string
    - contextPath: Cybereason.Malops.InvestigationStatus
      description: "Malop investigation status: Pending, Reopened, Under Investigation, On Hold, Closed."
      type: string
  - arguments:
    - default: true
      description: Malop process file MD5 to prevent.
      name: md5
      required: true
    description: Prevent malop process file.
    name: cybereason-prevent-file
    outputs:
    - contextPath: Cybereason.Process.MD5
      description: Process file MD5.
      type: string
    - contextPath: Cybereason.Process.Prevent
      description: True if process file is prevented, else false.
      type: boolean
  - arguments:
    - default: true
      description: Malop process file MD5 to unprevent.
      name: md5
      required: true
    description: Unprevent malop process file.
    name: cybereason-unprevent-file
    outputs:
    - contextPath: Cybereason.Process.MD5
      description: Process file MD5.
      type: string
    - contextPath: Cybereason.Process.Prevent
      description: True if process file is prevented, else false.
      type: boolean
  - arguments:
    - default: true
      description: File hash (SHA-1 and MD5 supported).
      name: file_hash
      required: true
    description: Query files as part of investigation.
    name: cybereason-query-file
    outputs:
    - contextPath: Cybereason.File.Path
      description: File path.
      type: string
    - contextPath: Cybereason.File.SHA1
      description: File SHA-1 hash.
      type: string
    - contextPath: Cybereason.File.Machine
      description: Machine name on which file is located.
      type: string
    - contextPath: Cybereason.File.SuspicionsCount
      description: File suspicions count.
      type: number
    - contextPath: Cybereason.File.Name
      description: File name.
      type: string
    - contextPath: Cybereason.File.CreationTime
      description: File creation time.
      type: date
    - contextPath: Cybereason.File.Suspicion
      description: File suspicions object of suspicion as key and detected date as value.
      type: string
    - contextPath: Cybereason.File.OSVersion
      description: Machine OS version on which file is located.
      type: string
    - contextPath: Cybereason.File.ModifiedTime
      description: File modified date.
      type: date
    - contextPath: Cybereason.File.Malicious
      description: Is file malicious.
      type: boolean
    - contextPath: Cybereason.File.Company
      description: Company name.
      type: string
    - contextPath: Cybereason.File.MD5
      description: File MD5 hash.
      type: string
    - contextPath: Cybereason.File.IsConnected
      description: Is machine connected to Cybereason.
      type: boolean
    - contextPath: Cybereason.File.Signed
      description: Is file signed.
      type: boolean
    - contextPath: Cybereason.File.Evidence
      description: File evidences.
      type: string
  - arguments:
    - description: Domain to query.
      name: domain
      required: true
      default: true
    description: Query domains as part of investigation.
    name: cybereason-query-domain
    outputs:
    - contextPath: Cybereason.Domain.Name
      description: Domain name.
      type: string
    - contextPath: Cybereason.Domain.Malicious
      description: Is domain malicious.
      type: boolean
    - contextPath: Cybereason.Domain.IsInternalDomain
      description: Is domain internal.
      type: boolean
    - contextPath: Cybereason.Domain.Reputation
      description: Domain reputation.
      type: string
    - contextPath: Cybereason.Domain.SuspicionsCount
      description: Domain suspicions count.
      type: number
    - contextPath: Cybereason.Domain.WasEverResolved
      description: Was domain ever resolved.
      type: boolean
    - contextPath: Cybereason.Domain.WasEverResolvedAsASecondLevelDomain
      description: Was domain ever resolved as a second level domain.
      type: boolean
  - arguments:
    - description: Username to query.
      name: username
      required: true
      default: true
    description: Query users as part of investigation.
    name: cybereason-query-user
    outputs:
    - contextPath: Cybereason.User.Username
      description: User name.
      type: string
    - contextPath: Cybereason.User.Domain
      description: User domain.
      type: string
    - contextPath: Cybereason.User.LastMachineLoggedInTo
      description: Last machine which user logged in to.
      type: string
    - contextPath: Cybereason.User.LocalSystem
      description: Is local system.
      type: boolean
    - contextPath: Cybereason.User.Organization
      description: User organization.
      type: string
  - arguments:
    - description: Malop GUID for fetching a file from a sensor to download.
      name: malopGUID
      required: true
    - description: The complete Cybereason user name string for the user performing the request.
      name: userName
      required: true
    description: Start fetching the file to download.
    name: cybereason-start-fetchfile
  - arguments:
    - default: true
      description: Malop GUID to know the progress for downloading a file.
      name: malopGuid
      required: true
    description: Return a batch id for files waiting for download.
    name: cybereason-fetchfile-progress
    outputs:
    - contextPath: Cybereason.Download.Progress.fileName
      description: Filename for tha given malop.
      type: string
    - contextPath: Cybereason.Download.Progress.status
      description: Status for batch ID.
      type: boolean
    - contextPath: Cybereason.Download.Progress.batchID
      description: Unique batch id.
      type: Unknown
  - arguments:
    - description: The batch id for the file download operation.
      name: batchID
      required: true
      default: true
    description: Downloads the actual file to the machine.
    name: cybereason-download-file
  - arguments:
    - description: The batch id to abort a file download operation.
      name: batchID
      required: true
      default: true
    description: Aborts a file download operation that is in progress.
    name: cybereason-close-file-batch-id
  - arguments:
    - description: The unique ID assigned by the Cybereason platform for the Malop.
      name: malopGuid
      required: true
    description: Get all remediation action details whatever available for that malop.
    name: cybereason-available-remediation-actions
  - arguments:
    - description: The unique ID assigned by the Cybereason platform for the Malop.
      name: malopGuid
      required: true
    - description: Machine name to kill the process.
      name: machine
      required: true
    - description: Target ID to kill the process.
      name: targetId
      required: true
    - description: The complete Cybereason user name string for the user performing the request.
      name: userName
      required: true
    - description: Comment to add to the malop.
      name: comment
    description: Kill a processes for the malicious file. (User will get inputs by executing the 'cybereason-available-remediation-actions' command if this remediation action is available for that Malop).
    name: cybereason-kill-process
  - arguments:
    - description: The unique ID assigned by the Cybereason platform for the Malop.
      name: malopGuid
      required: true
    - description: Machine name to quarantine a file.
      name: machine
      required: true
    - description: Target ID to quarantine a file.
      name: targetId
      required: true
    - description: The complete Cybereason user name string for the user performing the request.
      name: userName
      required: true
    - description: Comment to add to the malop.
      name: comment
    description: Quarantine the detected malicious file in a secure location. (User will get inputs by executing the 'cybereason-available-remediation-actions' command if this remediation action is available for that Malop).
    name: cybereason-quarantine-file
  - arguments:
    - description: The unique ID assigned by the Cybereason platform for the Malop.
      name: malopGuid
      required: true
    - description: Machine name to unquarantine a file.
      name: machine
      required: true
    - description: Target ID to unquarantine a file.
      name: targetId
      required: true
    - description: The complete Cybereason user name string for the user performing the request.
      name: userName
      required: true
    - description: Comment to add to the malop.
      name: comment
    description: Unquarantine the detected malicious file in a secure location. (User will get inputs by executing the 'cybereason-available-remediation-actions' command if this remediation action is available for that Malop).
    name: cybereason-unquarantine-file
  - arguments:
    - description: The unique ID assigned by the Cybereason platform for the Malop.
      name: malopGuid
      required: true
    - description: Machine name whose files needs to be blocked.
      name: machine
      required: true
    - description: Target ID of file to be blocked.
      name: targetId
      required: true
    - description: The complete Cybereason user name string for the user performing the request.
      name: userName
      required: true
    - description: Comment to add to the malop.
      name: comment
    description: Block a file only in particular machine. (User will get inputs by executing the 'cybereason-available-remediation-actions' command if this remediation action is available for that Malop).
    name: cybereason-block-file
  - arguments:
    - description: The unique ID assigned by the Cybereason platform for the Malop.
      name: malopGuid
      required: true
    - description: Machine name to delete the registry key.
      name: machine
      required: true
    - description: Target ID to delete the registry key.
      name: targetId
      required: true
    - description: The complete Cybereason user name string for the user performing the request.
      name: userName
      required: true
    - description: Comment to add to the malop.
      name: comment
    description: Delete a registry entry associated with a malicious process. (User will get inputs by executing the 'cybereason-available-remediation-actions' command if this remediation action is available for that Malop).
    name: cybereason-delete-registry-key
  - arguments:
    - description: The unique ID assigned by the Cybereason platform for the Malop.
      name: malopGuid
      required: true
    - description: Machine name to prevent detected ransomware from running on the machine.
      name: machine
      required: true
    - description: Target ID to prevent detected ransomware from running on the machine.
      name: targetId
      required: true
    - description: The complete Cybereason user name string for the user performing the request.
      name: userName
      required: true
    - description: Comment to add to the malop.
      name: comment
    description: Prevent detected ransomware from running on the machine. (User will get inputs by executing the 'cybereason-available-remediation-actions' command if this remediation action is available for that Malop).
    name: cybereason-kill-prevent-unsuspend
  - arguments:
    - description: The unique ID assigned by the Cybereason platform for the Malop.
      name: malopGuid
      required: true
    - description: Machine name to prevent a file associated with ransomware.
      name: machine
      required: true
    - description: Target ID to prevent a file associated with ransomware.
      name: targetId
      required: true
    - description: The complete Cybereason user name string for the user performing the request.
      name: userName
      required: true
    - description: Comment to add to the malop.
      name: comment
    description: Prevent a file associated with ransomware. (User will get inputs by executing the 'cybereason-available-remediation-actions' command if this remediation action is available for that Malop).
    name: cybereason-unsuspend-process
  - arguments:
    - description: Filter for Fetching Malwares by Malware needsAttention.
      name: needsAttention
      auto: PREDEFINED
      predefined:
      - "True"
      - "False"
    - description: Filter for Fetching Malwares by Malware Type. (Possible filter values for Type are "KnownMalware,UnknownMalware,FilelessMalware,ApplicationControlMalware,RansomwareMalware").
      name: type
    - description: Filter for Fetching Malwares by Malware Status. (Possible filter values for Status are "Done,Excluded,Detected,Prevented,Remediated,DeleteOnRestart,Quarantined").
      name: status
    - description: Filter for Fetching Malwares by Timestamp. Enter the time (in epoch).
      name: timestamp
    - description: Filter for Fetching Malwares by Malware Limit.
      name: limit
      required: true
    description: Malware query with options and values to filter.
    name: cybereason-malware-query
  - arguments:
    - description: Sensor ID of a sensor. (Comma separated values supported.)
      name: sensorID
      required: true
    - description: Select a method/type to scan a host.
      name: scanType
      required: true
      auto: PREDEFINED
      predefined:
      - FULL
      - QUICK
      - STOP
    description: Start or stop a full or quick scan for a host.
    name: cybereason-start-host-scan
  - arguments:
    - description: The batch ID obtained after initiating the scan.
      name: batchID
      default: true
      required: true
    description: Get the results for host scanning.
    name: cybereason-fetch-scan-status
  - arguments:
    - description: The hostname of the machine.
      name: machineName
    description: Get the Sensor ID of a machine.
    name: cybereason-get-sensor-id
  isfetch: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- Cybereason Test
fromversion: 5.0.0
sectionorder:
- Connect
- Collect