category: Endpoint provider: Deep Instinct commonfields: id: DeepInstinct v3 version: -1 configuration: - display: Base server URL name: base_url defaultvalue: https://my-deep-instinct-path.deepinstinctweb.com type: 0 required: true - display: API Key name: apikey type: 4 required: true - display: First event ID to fetch from name: first_fetch defaultvalue: '0' type: 0 required: false - name: max_fetch display: Maximum number of indicators per fetch, max is 1000. type: 0 defaultvalue: '50' required: false - display: Fetch incidents name: isFetch type: 8 required: false - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' type: 19 required: false - display: Incident type name: incidentType type: 13 required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false description: Deep Instinct is a prevention-first approach to stopping ransomware and other malware using the world's first purpose-built, deep learning cybersecurity framework. display: DeepInstinct v3 name: DeepInstinct v3 script: commands: - arguments: - description: Get device information from its ID. name: device_id required: true description: Get device information from its ID. name: deepinstinctv3-get-device outputs: - contextPath: deepinstinctv3.devices.ID description: Device ID. type: number - contextPath: deepinstinctv3.devices.os description: Device OS. type: string - contextPath: deepinstinctv3.devices.osv description: Device OS version. type: string - contextPath: deepinstinctv3.devices.ip_address description: Device IP address. type: string - contextPath: deepinstinctv3.devices.email description: Device email ip_address. type: sting - contextPath: deepinstinctv3.devices.mac_address description: Device mac address. type: string - contextPath: deepinstinctv3.devices.hostname description: Device hostname. type: string - contextPath: deepinstinctv3.devices.domain description: Device domain. type: string - contextPath: deepinstinctv3.devices.scanned_files description: Num of device scanned files. type: number - contextPath: deepinstinctv3.devices.comment description: Device comment. type: string - contextPath: deepinstinctv3.devices.tag description: Device tag. type: string - contextPath: deepinstinctv3.devices.connectivity_status description: Device connectivity status. type: string - contextPath: deepinstinctv3.devices.deployment_status description: Device deployment status. type: string - contextPath: deepinstinctv3.devices.deployment_status_last_update description: Device last client version update. type: string - contextPath: deepinstinctv3.devices.license_status description: Device license status. type: string - contextPath: deepinstinctv3.devices.last_registration description: Device last registration datetime. type: string - contextPath: deepinstinctv3.devices.last_contact description: Device last contact datetime. type: string - contextPath: deepinstinctv3.devices.distinguished_name description: Device distinguished name. type: string - contextPath: deepinstinctv3.devices.group_name description: Device group name. type: string - contextPath: deepinstinctv3.devices.group_id description: Device group ID. type: number - contextPath: deepinstinctv3.devices.policy_name description: Device policy name. type: string - contextPath: deepinstinctv3.devices.policy_id description: Device policy ID. type: number - contextPath: deepinstinctv3.devices.log_status description: Device log status. type: string - contextPath: deepinstinctv3.devices.agent_version description: Device agent version. type: string - contextPath: deepinstinctv3.devices.brain_version description: Device brain version. type: string - contextPath: deepinstinctv3.devices.logged_in_users description: Device logged in user(s). type: string - contextPath: deepinstinctv3.devices.msp_name description: Device msp name. type: string - contextPath: deepinstinctv3.devices.msp_id description: Device msp ID. type: number - contextPath: deepinstinctv3.devices.tenant_name description: Device tenant name. type: string - contextPath: deepinstinctv3.devices.tenant_id description: Device tenant ID. type: number - arguments: - description: Get all events. Max events in response is 50, use first_event_id parameter to define first event id to get. name: first_event_id required: true defaultValue: '0' description: Get all events after given event ID. name: deepinstinctv3-get-events outputs: - contextPath: deepinstinctv3.Events.events.id description: event ID. type: number - contextPath: deepinstinctv3.Events.events.device_id description: event device ID. type: number - contextPath: deepinstinctv3.Events.events.timestamp description: event timestamp from device. type: string - contextPath: deepinstinctv3.Events.events.insertion_timestamp description: event timestamp from console. type: string - contextPath: deepinstinctv3.Events.events.close_timestamp description: event closed timestamp. type: string - contextPath: deepinstinctv3.Events.events.last_action description: event last last_action. type: string - contextPath: deepinstinctv3.Events.events.status description: event status. type: string - contextPath: deepinstinctv3.Events.events.comment description: event comment. type: string - contextPath: deepinstinctv3.Events.events.recorded_device_info description: event device information. type: unknown - contextPath: deepinstinctv3.Events.events.msp_name description: event msp name. type: string - contextPath: deepinstinctv3.Events.events.msp_id description: event msp id. type: number - contextPath: deepinstinctv3.Events.events.tenant_name description: event tenant name. type: string - contextPath: deepinstinctv3.Events.events.tenant_id description: event tenant id. type: number - contextPath: deepinstinctv3.Events.events.mitre_classifications description: event MITRE classification. type: unknown - contextPath: deepinstinctv3.Events.events.type description: event type. type: string - contextPath: deepinstinctv3.Events.events.trigger description: event trigger. type: string - contextPath: deepinstinctv3.Events.events.action description: event action. type: string - contextPath: deepinstinctv3.Events.events.close_trigger description: event close trigger. type: string - contextPath: deepinstinctv3.Events.events.reoccurrence_count description: event reoccurrence_count. type: number - contextPath: deepinstinctv3.Events.events.file_type description: event file type. type: string - contextPath: deepinstinctv3.Events.events.file_hash description: event file hash. type: string - contextPath: deepinstinctv3.Events.events.file_archive_hash description: event file archive hash. type: string - contextPath: deepinstinctv3.Events.events.path description: event file path. - contextPath: deepinstinctv3.Events.events.file_size description: event file size. type: number - contextPath: deepinstinctv3.Events.events.threat_severity description: event threat severity. type: string - contextPath: deepinstinctv3.Events.events.certificate_thumbprint description: event certificate certificate thumbprint. type: string - contextPath: deepinstinctv3.Events.events.certificate_vendor_name description: event certificate certificate vendor name. type: string - contextPath: deepinstinctv3.Events.events.deep_classification description: Deep Instinct classification. type: string - contextPath: deepinstinctv3.Events.events.file_status description: event file status. type: string - contextPath: deepinstinctv3.Events.events.sandbox_status description: event sandbox status. type: string - arguments: - description: Get all suspicious events. Max events in response is 50, use first_event_id parameter to define first event id to get. name: first_event_id required: true defaultValue: '0' description: Get all suspicious events after given event ID. name: deepinstinctv3-get-suspicious-events outputs: - contextPath: deepinstinctv3.Suspicious-Events.events.ID description: event ID. type: number - contextPath: deepinstinctv3.Suspicious-Events.events.device_id description: event device ID. type: number - contextPath: deepinstinctv3.Suspicious-Events.events.timestamp description: event timestamp from device. type: string - contextPath: deepinstinctv3.Suspicious-Events.events.insertion_timestamp description: event timestamp from console. type: string - contextPath: deepinstinctv3.Suspicious-Events.events.status description: event status. type: string - contextPath: deepinstinctv3.Suspicious-Events.events.recorded_device_info description: event device info. type: unkown - contextPath: deepinstinctv3.Suspicious-Events.events.msp_name description: event msp name. type: string - contextPath: deepinstinctv3.Suspicious-Events.events.msp_id description: event msp id. type: number - contextPath: deepinstinctv3.Suspicious-Events.events.tenant_name description: event tenant name. type: string - contextPath: deepinstinctv3.Suspicious-Events.events.tenant_id description: event tenant id. type: number - contextPath: deepinstinctv3.Suspicious-Events.events.mitre_classifications description: event MITRE classification. type: unknown - contextPath: deepinstinctv3.Suspicious-Events.events.type description: event type. type: string - contextPath: deepinstinctv3.Suspicious-Events.events.trigger description: event trigger. type: string - contextPath: deepinstinctv3.Suspicious-Events.events.action description: event action. type: string - contextPath: deepinstinctv3.Suspicious-Events.events.close_trigger description: event close trigger. type: string - contextPath: deepinstinctv3.Suspicious-Events.events.file_type description: event file type. type: string - contextPath: deepinstinctv3.Suspicious-Events.events.rule_trigger description: event rule trigger. type: string - contextPath: deepinstinctv3.Suspicious-Events.events.file_archive_hash description: event file archive hash. type: string - contextPath: deepinstinctv3.Suspicious-Events.events.remediation description: event remediation. type: unknown - contextPath: deepinstinctv3.Suspicious-Events.events.path description: event file path. type: unknown - name: deepinstinctv3-get-all-groups outputs: - contextPath: deepinstinctv3.Groups.ID description: group id. type: number - contextPath: deepinstinctv3.Groups.is_default_group description: True if group is a default group, false otherwise. type: boolean - contextPath: deepinstinctv3.Groups.msp_id description: msp ID. type: number - contextPath: deepinstinctv3.Groups.name description: group name. type: string - contextPath: deepinstinctv3.Groups.os description: group operation system. type: string - contextPath: deepinstinctv3.Groups.policy_id description: group policy ID. type: number description: Get all groups. - name: deepinstinctv3-get-all-policies outputs: - contextPath: deepinstinctv3.Policies.ID description: policy ID. type: number - contextPath: deepinstinctv3.Policies.name description: policy name. type: string - contextPath: deepinstinctv3.Policies.os description: policy operating system. type: string - contextPath: deepinstinctv3.Policies.is_default_policy description: True if policy is a default policy, False otherwise. type: boolean - contextPath: deepinstinctv3.Policies.msp_id description: msp ID. type: number - contextPath: deepinstinctv3.Policies.msp_name description: msp name. type: string description: Get list of all policies. - arguments: - description: Policy ID. name: policy_id required: true - description: file hash. name: file_hash required: true - name: comment description: comment to hash field. description: Add file hash to Deny List. name: deepinstinctv3-add-hash-to-deny-list - arguments: - description: Policy ID. name: policy_id required: true - description: file hash. name: file_hash required: true - name: comment description: comment to hash field. description: Add file hash to Allow List. name: deepinstinctv3-add-hash-to-allow-list - arguments: - description: Policy ID. name: policy_id required: true - description: file hash. name: file_hash required: true description: Remove hash from Deny List. name: deepinstinctv3-remove-hash-from-deny-list - arguments: - description: Policy ID. name: policy_id required: true - description: file hash. name: file_hash required: true description: Remove hash from Allow List. name: deepinstinctv3-remove-hash-from-allow-list - arguments: - description: group ID. name: group_id required: true - description: comma seperated list of device ids to address. name: device_ids required: true description: Add multiple devices to a group. name: deepinstinctv3-add-devices-to-group - arguments: - description: Group ID to remove from. name: group_id required: true - description: Comma seperated list of device ids to remove. name: device_ids required: true description: Remove list of devices from groups. name: deepinstinctv3-remove-devices-from-group - arguments: - description: comma separated list of event ids. name: event_ids required: true description: Delete multiple files remotely. name: deepinstinctv3-delete-files-remotely - arguments: - description: comma separated list of event ids. name: event_ids required: true description: Terminate list of processes. name: deepinstinctv3-terminate-processes - arguments: - description: comma separated list of event ids. name: event_ids required: true description: Close list of events. name: deepinstinctv3-close-events - arguments: - description: single device id. name: device_id required: true description: Disable device at next check-in. name: deepinstinctv3-disable-device - arguments: - description: single device id. name: device_id required: true description: Enable device at next check-in. name: deepinstinctv3-enable-device - arguments: - description: comma separated list of device ids. name: device_ids required: true description: Isolate device(s) from Network. name: deepinstinctv3-isolate-from-network - arguments: - description: comma separated list of device ids. name: device_ids required: true description: Release device(s) from isolation. name: deepinstinctv3-release-from-isolation - arguments: - name: event_id required: true description: the event id. description: Upload file associated with given event id at next check-in. name: deepinstinctv3-remote-file-upload - arguments: - description: single device id. name: device_id required: true description: Upload device logs from given device at next check-in. name: deepinstinctv3-upload-logs - arguments: - description: single device id. name: device_id required: true description: Remove agent from device at next check-in. name: deepinstinctv3-remove-device dockerimage: demisto/python3:3.12.13.10116658 isfetch: true script: '-' type: python subtype: python3 fromversion: 6.2.0 tests: - No tests (auto formatted)