category: Endpoint
provider: Trellix
sectionorder:
- Connect
- Collect
commonfields:
  id: FireEyeHX v2
  version: -1
configuration:
- display: Server URL (e.g., https://192.168.0.1:3000)
  name: server
  required: true
  defaultvalue: https://example.com/
  type: 0
  section: Connect
- display: User Name
  name: userName
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: 'false'
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  defaultvalue: 'false'
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: '50'
  display: Fetch limit
  name: max_fetch
  type: 0
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 3 days)
  name: first_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: '60'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
description: FireEye Endpoint Security is an integrated solution that detects and protects endpoints against known and unknown threats. This integration provides access to information about endpoints, acquisitions, alerts, indicators, and containment. You can extract critical data and effectively operate the security operations automated playbook.
display: FireEye Endpoint Security (HX) v2
name: FireEyeHX v2
script:
  commands:
  - arguments:
    - description: The agent ID. If the agent ID is not specified, the hostName must be specified.
      name: agentId
    - description: The host name. If the hostName is not specified, the agent ID must be specified.
      name: hostName
    description: Returns information on a host associated with an agent.
    name: fireeye-hx-get-host-information
    outputs:
    - contextPath: FireEyeHX.Hosts._id
      description: The ID of the FireEye HX Agent.
      type: String
    - contextPath: FireEyeHX.Hosts.agent_version
      description: The version of the agent.
      type: String
    - contextPath: FireEyeHX.Hosts.excluded_from_containment
      description: Determines whether the host is excluded from containment.
      type: Boolean
    - contextPath: FireEyeHX.Hosts.containment_missing_software
      description: Whether there is containment missing software.
      type: Boolean
    - contextPath: FireEyeHX.Hosts.containment_queued
      description: Determines whether the host is queued for containment.
      type: Boolean
    - contextPath: FireEyeHX.Hosts.containment_state
      description: The containment state of the host. Possible values normal,contain,contain_fail,containing,contained,uncontain,uncontaining,wtfc,wtfu.
      type: String
    - contextPath: FireEyeHX.Hosts.stats.alerting_conditions
      description: The number of conditions that have alerted for the host.
      type: Number
    - contextPath: FireEyeHX.Hosts.stats.alerts
      description: The total number of alerts, including exploit-detection alerts.
      type: Number
    - contextPath: FireEyeHX.Hosts.stats.exploit_blocks
      description: The number of blocked exploits on the host.
      type: Number
    - contextPath: FireEyeHX.Hosts.stats.malware_alerts
      description: The number of malware alerts associated with the host.
      type: Number
    - contextPath: FireEyeHX.Hosts.hostname
      description: The name of the host.
      type: String
    - contextPath: FireEyeHX.Hosts.domain
      description: The name of the domain.
      type: String
    - contextPath: FireEyeHX.Hosts.timezone
      description: The time zone of the host.
      type: String
    - contextPath: FireEyeHX.Hosts.primary_ip_address
      description: The IP address of the host.
      type: String
    - contextPath: FireEyeHX.Hosts.last_poll_timestamp
      description: The timestamp of the last system poll preformed on the host.
      type: String
    - contextPath: FireEyeHX.Hosts.initial_agent_checkin
      description: The timestamp of the initial agent check-in.
      type: String
    - contextPath: FireEyeHX.Hosts.last_alert_timestamp
      description: The time stamp of the last alert for the host.
      type: String
    - contextPath: FireEyeHX.Hosts.last_exploit_block_timestamp
      description: The time when the last exploit was blocked on the host. The value is null if no exploits have been blocked.
      type: Unknown
    - contextPath: FireEyeHX.Hosts.os.product_name
      description: The operating system of the host.
      type: String
    - contextPath: FireEyeHX.Hosts.os.bitness
      description: The bitness of the operating system.
      type: String
    - contextPath: FireEyeHX.Hosts.os.platform
      description: The list of operating systems. Valid values are win, osx, and linux.
      type: Unknown
    - contextPath: FireEyeHX.Hosts.primary_mac
      description: The MAC address of the host.
      type: String
  - arguments:
    - description: Specifies which record to start with in the response. Default is 0.
      name: offset
    - description: Limits the number of results.
      name: limit
    description: Returns information on all hosts.
    name: fireeye-hx-get-all-hosts-information
    outputs:
    - contextPath: FireEyeHX.Hosts._id
      description: The FireEye HX Agent ID.
      type: String
    - contextPath: FireEyeHX.Hosts.agent_version
      description: The version of the agent.
      type: String
    - contextPath: FireEyeHX.Hosts.excluded_from_containment
      description: Determines whether the host is excluded from containment.
      type: Boolean
    - contextPath: FireEyeHX.Hosts.containment_missing_software
      description: Whether there is containment missing software.
      type: Boolean
    - contextPath: FireEyeHX.Hosts.containment_queued
      description: Determines whether the host is queued for containment.
      type: Boolean
    - contextPath: FireEyeHX.Hosts.containment_state
      description: The containment state of the host. Possible values are normal, contain, contain_fail, containing, contained, uncontain, uncontaining, wtfc, wtfu.
      type: String
    - contextPath: FireEyeHX.Hosts.stats.alerting_conditions
      description: The number of conditions that have been alerted for the host.
      type: Number
    - contextPath: FireEyeHX.Hosts.stats.alerts
      description: The total number of alerts, including exploit-detection alerts.
      type: Number
    - contextPath: FireEyeHX.Hosts.stats.exploit_blocks
      description: The number of blocked exploits on the host.
      type: Number
    - contextPath: FireEyeHX.Hosts.stats.malware_alerts
      description: The number of malware alerts associated with the host.
      type: Number
    - contextPath: FireEyeHX.Hosts.hostname
      description: The name of the host.
      type: String
    - contextPath: FireEyeHX.Hosts.domain
      description: The name of the domain.
      type: String
    - contextPath: FireEyeHX.Hosts.timezone
      description: The time zone of the host.
      type: String
    - contextPath: FireEyeHX.Hosts.primary_ip_address
      description: The IP address of the host.
      type: String
    - contextPath: FireEyeHX.Hosts.last_poll_timestamp
      description: The timestamp of the last system poll preformed on the host.
      type: String
    - contextPath: FireEyeHX.Hosts.initial_agent_checkin
      description: The timestamp of the initial agent check-in.
      type: String
    - contextPath: FireEyeHX.Hosts.last_alert_timestamp
      description: The time stamp of the last alert for the host.
      type: String
    - contextPath: FireEyeHX.Hosts.last_exploit_block_timestamp
      description: The time when the last exploit was blocked on the host. The value is null if no exploits have been blocked.
      type: Unknown
    - contextPath: FireEyeHX.Hosts.os.product_name
      description: The operating system of the host.
      type: String
    - contextPath: FireEyeHX.Hosts.os.bitness
      description: The bitness of the operating system.
      type: String
    - contextPath: FireEyeHX.Hosts.os.platform
      description: The list of operating systems. Valid values are win, osx, and linux.
      type: String
    - contextPath: FireEyeHX.Hosts.primary_mac
      description: The host MAC address.
      type: String
  - arguments:
    - description: The host name to be contained. If the hostName is not specified, the agentId must be specified.
      name: hostName
    - description: The agent ID running on the host to be contained. If the agentId is not specified, the hostName must be specified.
      name: agentId
    description: Applies containment for a specific host, so that it no longer has access to other systems. If the user does not have the necessary permissions, the command will not approve the request. The permission required to approve the request is api_admin role.
    name: fireeye-hx-host-containment
    outputs:
    - contextPath: FireEyeHX.Hosts._id
      description: The ID of the FireEye HX Agent.
      type: String
    - contextPath: FireEyeHX.Hosts.agent_version
      description: The version of the agent.
      type: String
    - contextPath: FireEyeHX.Hosts.excluded_from_containment
      description: Determines whether the host is excluded from containment.
      type: Boolean
    - contextPath: FireEyeHX.Hosts.containment_missing_software
      description: Whether there is containment missing software.
      type: Boolean
    - contextPath: FireEyeHX.Hosts.containment_queued
      description: Determines whether the host is queued for containment.
      type: Boolean
    - contextPath: FireEyeHX.Hosts.containment_state
      description: The containment state of the host. Possible values are normal, contain, contain_fail, containing, contained, uncontain, uncontaining, wtfc, wtfu.
      type: String
    - contextPath: FireEyeHX.Hosts.stats.alerting_conditions
      description: The number of conditions that have been alerted for the host.
      type: Number
    - contextPath: FireEyeHX.Hosts.stats.alerts
      description: The total number of alerts, including exploit-detection alerts.
      type: Number
    - contextPath: FireEyeHX.Hosts.stats.exploit_blocks
      description: The number of blocked exploits on the host.
      type: Number
    - contextPath: FireEyeHX.Hosts.stats.malware_alerts
      description: The number of malware alerts associated with the host.
      type: Number
    - contextPath: FireEyeHX.Hosts.hostname
      description: The name of the host.
      type: String
    - contextPath: FireEyeHX.Hosts.domain
      description: The name of the domain.
      type: String
    - contextPath: FireEyeHX.Hosts.timezone
      description: The time zone of the host.
      type: String
    - contextPath: FireEyeHX.Hosts.primary_ip_address
      description: The IP address of the host.
      type: String
    - contextPath: FireEyeHX.Hosts.last_poll_timestamp
      description: The timestamp of the last system poll preformed on the host.
      type: String
    - contextPath: FireEyeHX.Hosts.initial_agent_checkin
      description: The timestamp of the initial agent check-in.
      type: String
    - contextPath: FireEyeHX.Hosts.last_alert_timestamp
      description: The time stamp of the last alert for the host.
      type: String
    - contextPath: FireEyeHX.Hosts.last_exploit_block_timestamp
      description: The time when the last exploit was blocked on the host. The value is null if no exploits have been blocked.
      type: String
    - contextPath: FireEyeHX.Hosts.os.product_name
      description: The operating system of the host.
      type: String
    - contextPath: FireEyeHX.Hosts.os.bitness
      description: The bitness of the operating system.
      type: String
    - contextPath: FireEyeHX.Hosts.os.platform
      description: The list of operating systems. Valid values are win, osx, and linux.
      type: String
    - contextPath: FireEyeHX.Hosts.primary_mac
      description: The host MAC address.
      type: String
  - arguments:
    - description: The host name to be contained. If the hostName is not specified, the agentId must be specified.
      name: hostName
    - description: The agent ID running on the host to be contained. If the agentId is not specified, the hostName must be specified.
      name: agentId
    description: Releases a specific host from containment.
    name: fireeye-hx-cancel-containment
    compliantpolicies:
    - EndPoint Isolation
  - arguments:
    - description: The acquisition script in JSON format.
      name: script
    - description: The script name. If the acquisition script is specified, the script name must be specified as well.
      name: scriptName
    - auto: PREDEFINED
      description: Select the host system to use the default system script.
      name: defaultSystemScript
      predefined:
      - osx
      - win
      - linux
    - description: The agent ID. If the hostName is not specified, the agent ID must be specified.
      name: agentId
    - description: The host name. If the agent ID is not specified, the hostName must be specified.
      name: hostName
    description: Initiates a data acquisition process to collect artifacts from the system disk and memory.
    name: fireeye-hx-initiate-data-acquisition
    outputs:
    - contextPath: FireEyeHX.Acquisitions.Data._id
      description: The unique ID of the acquisition.
      type: string
    - contextPath: FireEyeHX.Acquisitions.Data.state
      description: The state of the acquisition.
      type: string
    - contextPath: FireEyeHX.Acquisitions.Data.md5
      description: The MD5 of the file.
      type: string
    - contextPath: FireEyeHX.Acquisitions.Data.host._id
      description: The ID of the agent.
      type: string
    - contextPath: FireEyeHX.Acquisitions.Data.host.hostname
      description: The name of the host.
      type: string
    - contextPath: FireEyeHX.Acquisitions.Data.instance
      description: The FireEye HX instance.
      type: string
    - contextPath: FireEyeHX.Acquisitions.Data.finish_time
      description: The time when the acquisition finished.
      type: date
  - arguments:
    - description: The ID of a specific host set to return.
      name: hostSetID
    - description: Specifies which record to start with in the response. The offset value must be an unsigned 32-bit integer. Default is 0.
      name: offset
    - description: Specifies how many records are returned. The limit value must be an unsigned 32-bit integer. Default is 50.
      name: limit
    - description: Searches the names of all host sets connected to the specified HX appliance.
      name: search
    - description: Sorts the results by the specified field in ascending or descending order. The default sorts in ascending order, by name. Sortable fields are _id (host set ID) and name (host set name).
      name: sort
    - description: Specifies the name of the host set for which to search.
      name: name
    - description: Specifies the type of host set for which to search.
      name: type
      auto: PREDEFINED
      predefined:
      - venn
      - static
    description: Returns a list of all host sets known to your HX Series appliance.
    name: fireeye-hx-get-host-set-information
    outputs:
    - contextPath: FireEyeHX.HostSets._id
      description: The ID of the host set.
      type: number
    - contextPath: FireEyeHX.HostSets._revision
      description: The number of the host set revision.
      type: date
    - contextPath: FireEyeHX.HostSets.name
      description: The name of the host set.
      type: string
    - contextPath: FireEyeHX.HostSets.type
      description: The type of the host set (static/dynamic/hidden).
      type: string
    - contextPath: FireEyeHX.HostSets.url
      description: The FireEye URL of the host set.
      type: string
    - contextPath: FireEyeHX.HostSets.deleted
      description: Was the host set deleted.
      type: boolean
  - arguments:
    - description: Specifies which record to start with in the response. Default is 0.
      name: offset
    - description: Limits the number of results.
      name: limit
    - description: The name of the policy.
      name: policyName
    - description: The unique policy ID.
      name: policyId
    - description: Whether the policy is enabled ("true") or disabled ("false").
      name: enabled
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    description: Returns a list of all policies.
    name: fireeye-hx-list-policy
    outputs:
    - contextPath: FireEyeHX.Policy._id
      description: The ID of the unique policy.
      type: String
    - contextPath: FireEyeHX.Policy.name
      description: The name of the policy.
      type: String
    - contextPath: FireEyeHX.Policy.description
      description: The description of the policy.
      type: String
    - contextPath: FireEyeHX.Policy.policy_type_id
      description: The ID of the unique policy type.
      type: String
    - contextPath: FireEyeHX.Policy.priority
      description: The priority order of the policy.
      type: Number
    - contextPath: FireEyeHX.Policy.enabled
      description: Whether the policy is enabled ("true") or disabled ("false").
      type: Boolean
    - contextPath: FireEyeHX.Policy.default
      description: Whether it is the default policy (true). There can only be one policy marked as default.
      type: Boolean
    - contextPath: FireEyeHX.Policy.migrated
      description: Whether it is a migrated policy (true).
      type: Boolean
    - contextPath: FireEyeHX.Policy.created_by
      description: The user who created the policy.
      type: String
    - contextPath: FireEyeHX.Policy.created_at
      description: The time the policy was first created.
      type: String
    - contextPath: FireEyeHX.Policy.updated_at
      description: The time the policy was last updated.
      type: String
    - contextPath: FireEyeHX.Policy.categories
      description: The collection of categories that the policy is associated.
      type: Unknown
    - contextPath: FireEyeHX.Policy.display_created_at
      description: The time since the display was first created.
      type: String
    - contextPath: FireEyeHX.Policy.display_updated_at
      description: The time since the display was last updated.
      type: String
  - arguments:
    - description: Specifies which record to start with in the response. Default is 0.
      name: offset
    - description: Limits the number of results.
      name: limit
    - description: The host set ID.
      name: hostSetId
    - description: The unique policy ID.
      name: policyId
    description: Returns a list of all policies for all host sets.
    name: fireeye-hx-list-host-set-policy
    outputs:
    - contextPath: FireEyeHX.HostSets.Policy.policy_id
      description: The ID of the unique policy.
      type: String
    - contextPath: FireEyeHX.HostSets.Policy.persist_id
      description: The ID of the host set.
      type: Number
  - arguments:
    - description: Specifies which record to start with in the response. Default is 0.
      name: offset
    - description: Limits the number of results.
      name: limit
    - description: 'Must be from type of -> String: date-time.'
      name: state_update_time
    name: fireeye-hx-list-containment
    description: Fetches all containment states across known hosts.
    outputs:
    - contextPath: FireEyeHX.Hosts._id
      description: The FireEye HX Agent ID.
      type: String
    - contextPath: FireEyeHX.Hosts.last_sysinfo
      description: The Last Sysinfo date.
      type: String
    - contextPath: FireEyeHX.Hosts.requested_by_actor
      description: The action requested by actor.
      type: String
    - contextPath: FireEyeHX.Hosts.requested_on
      description: When the containment was requested.
      type: String
    - contextPath: FireEyeHX.Hosts.contained_by_actor
      description: The action contained by actor.
      type: String
    - contextPath: FireEyeHX.Hosts.contained_on
      description: When the host was contained.
      type: String
    - contextPath: FireEyeHX.Hosts.queued
      description: Determines whether the hosts are queued for containment.
      type: Boolean
    - contextPath: FireEyeHX.Hosts.excluded
      description: Whether the hosts are excluded.
      type: Boolean
    - contextPath: FireEyeHX.Hosts.missing_software
      description: Whether there is missing software.
      type: Boolean
    - contextPath: FireEyeHX.Hosts.reported_clone
      description: Whether there is a reported clone.
      type: Boolean
    - contextPath: FireEyeHX.Hosts.state
      description: The state of the hosts.
      type: String
    - contextPath: FireEyeHX.Hosts.state_update_time
      description: The state update time of the hosts.
      type: String
    - contextPath: FireEyeHX.Hosts.url
      description: The URL of the hosts.
      type: String
  - arguments:
    - description: Specifies which record to start with in the response. Default is 0.
      name: offset
    - description: Specifies how many records are returned. Default is 50.
      name: limit
    - description: Filter by search state.
      name: state
      auto: PREDEFINED
      predefined:
      - RUNNING
      - STOPPED
    - description: Sorts the results by the specified field. Default is sort by _id.
      name: sort
      auto: PREDEFINED
      predefined:
      - _id
      - state
      - host_set._id
      - update_time
      - create_time
      - update_actor._id
      - update_actor.username
      - create_actor._id
      - create_actor.username
    - description: 'Filters searches by host set ID - <Integer>.'
      name: hostSetId
    - description: Returns a single enterprise search record. If you enter this argument, there is no need for other arguments.
      name: searchId
      isArray: true
    - description: 'Filters searches by username that created searches - <String>.'
      name: actorUsername
    description: Fetches all enterprise searches.
    name: fireeye-hx-search-list
    outputs:
    - contextPath: FireEyeHX.Search._id
      description: The ID of the unique search.
      type: Number
    - contextPath: FireEyeHX.Search.state
      description: The state of the search, whether it stopped or ran.
      type: String
    - contextPath: FireEyeHX.Search.scripts
      description: A list of reference objects for the scripts utilized in this search.
      type: Unknown
    - contextPath: FireEyeHX.Search.update_time
      description: The time the search was last updated.
      type: String
    - contextPath: FireEyeHX.Search.create_time
      description: The time the search was created.
      type: String
    - contextPath: FireEyeHX.Search.scripts.platform
      description: The platform for which this script is used.
      type: Unknown
    - contextPath: FireEyeHX.Search.update_actor
      description: The actor who last updated the search.
      type: Unknown
    - contextPath: FireEyeHX.Search.create_actor
      description: The actor who created the search.
      type: Unknown
    - contextPath: FireEyeHX.Search.error
      description: Collection of errors per agents for the search.
      type: Unknown
    - contextPath: FireEyeHX.Search._revision
      description: The ETag that can be used for concurrency checking.
      type: String
    - contextPath: FireEyeHX.Search.input_type
      description: The input method that was used to start the search.
      type: String
    - contextPath: FireEyeHX.Search.url
      description: The URI to retrieve data for this record.
      type: String
    - contextPath: FireEyeHX.Search.host_set
      description: The Host Set information.
      type: Unknown
    - contextPath: FireEyeHX.Search.stats
      description: The stats information.
      type: Unknown
    - contextPath: FireEyeHX.Search.stats.hosts
      description: The number of hosts running this operation.
      type: Number
    - contextPath: FireEyeHX.Search.stats.skipped_hosts
      description: The number of hosts that were skipped.
      type: Number
    - contextPath: FireEyeHX.Search.stats.search_state
      description: The number of search in different states.
      type: Unknown
    - contextPath: FireEyeHX.Search.stats.search_issues
      description: The issues encountered for searches.
      type: Unknown
    - contextPath: FireEyeHX.Search.settings.query_terms.terms
      description: The terms for the operation.
      type: Unknown
    - contextPath: FireEyeHX.Search.stats.hosts.settings.query_terms.exhaustive_terms
      description: The exhaustive terms for the operation.
      type: Unknown
    - contextPath: FireEyeHX.Search.stats.settings.search_type
      description: The type of search.
      type: String
    - contextPath: FireEyeHX.Search.stats.settings.exhaustive
      description: Whether a search is exhaustive.
      type: String
    - contextPath: FireEyeHX.Search.stats.settings.mode
      description: Whether a search is a HOST type or GRID type.
      type: String
    - contextPath: FireEyeHX.Search.stats.settings.displayname
      description: The name of the search.
      type: String
  - arguments:
    - description: Unique search ID - Required.
      name: searchId
      required: true
      isArray: true
    description: Stops a specific running search.
    name: fireeye-hx-search-stop
    outputs:
    - contextPath: FireEyeHX.Search._id
      description: The ID of the unique search.
      type: Number
    - contextPath: FireEyeHX.Search.state
      description: The state of the search, whether it stopped or ran.
      type: String
    - contextPath: FireEyeHX.Search.scripts
      description: A list of reference objects for the scripts utilized in this search.
      type: Unknown
    - contextPath: FireEyeHX.Search.update_time
      description: The time the search was last updated.
      type: String
    - contextPath: FireEyeHX.Search.create_time
      description: The time the search was created.
      type: String
    - contextPath: FireEyeHX.Search.scripts.platform
      description: The platform for which this script is used.
      type: Unknown
    - contextPath: FireEyeHX.Search.update_actor
      description: The actor who last updated the search.
      type: Unknown
    - contextPath: FireEyeHX.Search.create_actor
      description: The actor who created the search.
      type: Unknown
    - contextPath: FireEyeHX.Search.error
      description: The collection of errors per agents for the search.
      type: Unknown
    - contextPath: FireEyeHX.Search._revision
      description: ETag that can be used for concurrency checking.
      type: Unknown
    - contextPath: FireEyeHX.Search.input_type
      description: The input method that was used to start the search.
      type: String
    - contextPath: FireEyeHX.Search.url
      description: The URI to retrieve data for this record.
      type: String
    - contextPath: FireEyeHX.Search.host_set
      description: The Host Set information.
      type: Unknown
    - contextPath: FireEyeHX.Search.stats
      description: The stats information.
      type: Unknown
    - contextPath: FireEyeHX.Search.stats.hosts
      description: The number of hosts running this operation.
      type: Number
    - contextPath: FireEyeHX.Search.stats.skipped_hosts
      description: The number of hosts that were skipped.
      type: Number
    - contextPath: FireEyeHX.Search.stats.search_state
      description: The number of search in different states.
      type: Unknown
    - contextPath: FireEyeHX.Search.stats.search_issues
      description: The issues encountered for searches.
      type: Unknown
    - contextPath: FireEyeHX.Search.settings.query_terms.terms
      description: The terms for the operation.
      type: Unknown
    - contextPath: FireEyeHX.Search.stats.hosts.settings.query_terms.exhaustive_terms
      description: The exhaustive terms for the operation.
      type: Unknown
    - contextPath: FireEyeHX.Search.stats.settings.search_type
      description: The type of search.
      type: String
    - contextPath: FireEyeHX.Search.stats.settings.exhaustive
      description: Whether a search is exhaustive.
      type: String
    - contextPath: FireEyeHX.Search.stats.settings.mode
      description: Whether a search is a HOST type or GRID type.
      type: String
    - contextPath: FireEyeHX.Search.stats.settings.displayname
      description: The name of the search.
      type: String
  - arguments:
    - description: The Unique search ID.
      name: searchId
      required: true
    - description: limit of results to return per search.
      name: limit
      required: false
    description: Fetches the results for a specific enterprise search.
    name: fireeye-hx-search-result-get
    outputs:
    - contextPath: FireEyeHX.Search.host._id
      description: The ID of the unique agent.
      type: String
    - contextPath: FireEyeHX.Search.host.url
      description: The URI to retrieve data for this record.
      type: String
    - contextPath: FireEyeHX.Search.host.hostname
      description: The name of the host.
      type: String
    - contextPath: FireEyeHX.Search.results._id
      description: The unique ID.
      type: Number
    - contextPath: FireEyeHX.Search.results.type
      description: The type of the search result data.
      type: String
    - contextPath: FireEyeHX.Search.results.data
      description: The object containing data relating to the search result for the host.
      type: Unknown
  - arguments:
    - description: searchId.
      name: searchId
    - description: The IDs of the gents to be searched.
      name: agentsIds
      isArray: true
    - description: The names of hosts to be searched.
      name: hostsNames
      isArray: true
    - description: The ID of host set to be searched.
      name: hostSet
    - description: The name of host set to be searched.
      name: hostSetName
    - description: Limits the results count (default is 1000).
      name: limit
      defaultValue: '1000'
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Whether a search is exhaustive or quick.
      name: exhaustive
      predefined:
      - yes
      - no
    - description: A valid IPv4 address for which to search.
      name: ipAddress
      isArray: true
    - auto: PREDEFINED
      description: Which operator to apply to the given IP address.
      name: ipAddressOperator
      predefined:
      - equals
      - not equals
    - auto: PREDEFINED
      description: Whether to use Cortex XSOAR's built-in polling to retrieve the result, when ready.
      name: polling
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '60'
      description: The interval in seconds between each poll.
      name: interval_in_seconds
    - description: A 32-character MD5 hash value for which to search.
      name: fileMD5Hash
      isArray: true
    - auto: PREDEFINED
      description: Which operator to apply to the given MD5 hash.
      name: fileMD5HashOperator
      predefined:
      - equals
      - not equals
    - description: The full path of file to search.
      name: fileFullPath
      isArray: true
    - auto: PREDEFINED
      description: Which operator to apply to the given file path.
      name: fileFullPathOperator
      predefined:
      - equals
      - not equals
      - contains
      - not contains
    - description: The DNS value for which to search.
      name: dnsHostname
      isArray: true
    - auto: PREDEFINED
      description: Which operator to apply to the given DNS.
      name: dnsHostnameOperator
      predefined:
      - equals
      - not equals
      - contains
      - not contains
    - auto: PREDEFINED
      description: The method by which the search should be stopped after finding <limit> number of results.
      name: stopSearch
      predefined:
      - stopAndDelete
      - stop
    - description: Searchable fields - If using this argument, the 'fieldSearchOperator' and 'fieldSearchValue' arguments are required.
      name: fieldSearchName
      auto: PREDEFINED
      predefined:
      - Application Name
      - Browser Name
      - Browser Version
      - Cookie Flags
      - Cookie Name
      - Cookie Value
      - Driver Device Name
      - Driver Module Name
      - Executable Exported Dll Name
      - Executable Exported Function Name
      - Executable Imported Function Name
      - Executable Imported Module Name
      - Executable Injected
      - Executable PE Type
      - Executable Resource Name
      - File Attributes
      - File Certificate Issuer
      - File Certificate Subject
      - File Download Mime Type
      - File Download Referrer
      - File Download Type
      - File Name
      - File SHA1 Hash
      - File SHA256 Hash
      - File Signature Exists
      - File Signature Verified
      - File Stream Name
      - File Text Written
      - Group Name
      - HTTP Header
      - Host Set
      - Hostname
      - Local IP Address
      - Local Port
      - Parent Process Name
      - Parent Process Path
      - Port
      - Port Protocol
      - Port State
      - Process Arguments
      - Process Name
      - Quarantine Event Sender Address
      - Quarantine Event Sender Name
      - Registry Key Full Path
      - Registry Key Value Name
      - Registry Key Value Text
      - Remote IP Address
      - Remote Port
      - Service DLL
      - Service Mode
      - Service Name
      - Service Status
      - Service Type
      - Size in bytes
      - Syslog Event ID
      - Syslog Event Message
      - Syslog Facility
    - description: Which operator to apply to the given search field.
      name: fieldSearchOperator
      auto: PREDEFINED
      predefined:
      - equals
      - not equals
      - contains
      - not contains
      - less than
      - greater than
    - description: One or more values that match the selected search type.
      name: fieldSearchValue
      isArray: true
    description: Searches endpoints to check all hosts or a subset of hosts for a specific file or indicator.
    name: fireeye-hx-search
    polling: true
    outputs:
    - contextPath: FireEyeHX.Search.results.data.Timestamp - Modified
      description: The time when the entry was last modified.
      type: string
    - contextPath: FireEyeHX.Search.results.data.File Text Written
      description: The file text content.
      type: string
    - contextPath: FireEyeHX.Search.results.data.File Name
      description: The name of the file.
      type: string
    - contextPath: FireEyeHX.Search.results.data.File Full Path
      description: The full path of the file.
      type: string
    - contextPath: FireEyeHX.Search.results.data.File Bytes Written
      description: The number of bytes written to the file.
      type: string
    - contextPath: FireEyeHX.Search.results.data.Size in bytes
      description: The size of the file in bytes.
      type: string
    - contextPath: FireEyeHX.Search.results.data.Browser Version
      description: The version of the browser.
      type: string
    - contextPath: FireEyeHX.Search.results.data.Browser Name
      description: The name of the browser.
      type: string
    - contextPath: FireEyeHX.Search.results.data.Cookie Name
      description: The name of the cookie.
      type: string
    - contextPath: FireEyeHX.Search.results.data.DNS Hostname
      description: The name of the DNS host.
      type: string
    - contextPath: FireEyeHX.Search.results.data.URL
      description: The event URL.
      type: string
    - contextPath: FireEyeHX.Search.results.data.Username
      description: The event username.
      type: string
    - contextPath: FireEyeHX.Search.results.data.File MD5 Hash
      description: The MD5 hash of the file.
      type: string
    - contextPath: FireEyeHX.Search.host._id
      description: The ID of the host.
      type: string
    - contextPath: FireEyeHX.Search.host.hostname
      description: The name of host.
      type: string
    - contextPath: FireEyeHX.Search.host.url
      description: The Inner FireEye host URL.
      type: string
    - contextPath: FireEyeHX.Search.results.data
      description: The ID of the performed search.
      type: string
    - contextPath: FireEyeHX.Search.results.data.Timestamp - Accessed
      description: The last accessed time.
      type: string
    - contextPath: FireEyeHX.Search.results.data.Port
      description: The Port.
      type: number
    - contextPath: FireEyeHX.Search.results.data.Process ID
      description: The ID of the process.
      type: string
    - contextPath: FireEyeHX.Search.results.data.Local IP Address
      description: The local IP Address.
      type: string
    - contextPath: FireEyeHX.Search.results.data.Local Port
      description: The local Port.
      type: number
    - contextPath: FireEyeHX.Search.results.data.Remote Port
      description: The remote port.
      type: number
    - contextPath: FireEyeHX.Search.results.data.IP Address
      description: The IP address.
      type: string
    - contextPath: FireEyeHX.Search.results.data.Process Name
      description: The process name.
      type: string
    - contextPath: FireEyeHX.Search.results.data.Timestamp - Event
      description: The timestamp of the event.
      type: string
    - contextPath: FireEyeHX.Search.results.type
      description: The type of the event.
      type: string
    - contextPath: FireEyeHX.Search.results.id
      description: The ID of the result.
      type: string
  - arguments:
    - description: The alert ID.
      name: alertId
      required: true
    description: Get details of a specific alert.
    name: fireeye-hx-get-alert
    outputs:
    - contextPath: FireEyeHX.Alerts._id
      description: The ID of the FireEye alert.
      type: Number
    - contextPath: FireEyeHX.Alerts.agent._id
      description: The ID of the FireEye agent.
      type: Unknown
    - contextPath: FireEyeHX.Alerts.agent.containment_state
      description: The containment state of the agent.
      type: Unknown
    - contextPath: FireEyeHX.Alerts.condition._id
      description: The unique ID of the condition.
      type: String
    - contextPath: FireEyeHX.Alerts.event_at
      description: The time when the event occurred.
      type: String
    - contextPath: FireEyeHX.Alerts.matched_at
      description: The time when the event was matched.
      type: String
    - contextPath: FireEyeHX.Alerts.reported_at
      description: The time when the event was reported.
      type: String
    - contextPath: FireEyeHX.Alerts.source
      description: The source of the alert.
      type: String
    - contextPath: FireEyeHX.Alerts.matched_source_alerts._id
      description: The ID of the source alert.
      type: Unknown
    - contextPath: FireEyeHX.Alerts.matched_source_alerts.appliance_id
      description: The ID of the appliance.
      type: Unknown
    - contextPath: FireEyeHX.Alerts.matched_source_alerts.meta
      description: The source alert meta.
      type: Unknown
    - contextPath: FireEyeHX.Alerts.matched_source_alerts.indicator_id
      description: The ID of the indicator.
      type: Unknown
    - contextPath: FireEyeHX.Alerts.resolution
      description: The alert resolution.
      type: String
    - contextPath: FireEyeHX.Alerts.event_type
      description: The type of the event.
      type: String
  - arguments:
    - description: The alert ID. The alert ID is listed in the output of 'get-alerts'. command.
      name: alertId
      required: true
    description: Suppresses an alert by ID.
    name: fireeye-hx-suppress-alert
  - arguments:
    - description: The category of the indicator.
      name: category
    - description: The searchTerm can be any name, category, signature, source, or condition value.
      name: searchTerm
    - auto: PREDEFINED
      description: Determines who can see the indicator. They must belong to the correct authorization group.
      name: shareMode
      predefined:
      - any
      - restricted
      - unrestricted
      - visible
    - auto: PREDEFINED
      description: Sorts the results by the specified field in ascending order.
      name: sort
      predefined:
      - category
      - activeSince
      - createdBy
      - alerted
    - description: The person who created the indicator.
      name: createdBy
    - auto: PREDEFINED
      description: Whether the indicator resulted in alerts.
      name: alerted
      predefined:
      - yes
      - no
    - description: Limits the number of results.
      name: limit
    description: Get a list of indicators.
    name: fireeye-hx-get-indicators
    outputs:
    - contextPath: FireEyeHX.Indicators._id
      description: FireEye unique indicator ID.
      type: String
    - contextPath: FireEyeHX.Indicators.name
      description: The indicator name as displayed in the UI.
      type: String
    - contextPath: FireEyeHX.Indicators.description
      description: The description of the indicator.
      type: String
    - contextPath: FireEyeHX.Indicators.category.name
      description: The Category name.
      type: String
    - contextPath: FireEyeHX.Indicators.created_by
      description: The "Created By" field as displayed in UI.
      type: String
    - contextPath: FireEyeHX.Indicators.active_since
      description: The date the indicator became active.
      type: String
    - contextPath: FireEyeHX.Indicators.stats.source_alerts
      description: The total number of source alerts associated with this indicator.
      type: Unknown
    - contextPath: FireEyeHX.Indicators.stats.alerted_agents
      description: The total number of agents with HX alerts associated with this indicator.
      type: Unknown
    - contextPath: FireEyeHX.Indicators.platforms
      description: The list of operating systems.
      type: Unknown
    - contextPath: FireEyeHX.Indicators.uri_name
      description: The URI formatted name of the indicator.
      type: String
    - contextPath: FireEyeHX.Indicators.category.uri_name
      description: The URI name of the category.
      type: String
  - arguments:
    - description: The category of the indicator. Use the `uri_category` value.
      name: category
      required: true
    - description: The name of the indicator. Use the `uri_name` value.
      name: name
      required: true
    description: Get details of a specific indicator.
    name: fireeye-hx-get-indicator
    outputs:
    - contextPath: FireEyeHX.Indicators._id
      description: The FireEye unique indicator ID.
      type: String
    - contextPath: FireEyeHX.Indicators.name
      description: The indicator name as displayed in the UI.
      type: String
    - contextPath: FireEyeHX.Indicators.description
      description: The description of the indicator.
      type: String
    - contextPath: FireEyeHX.Indicators.category.name
      description: The name of the category.
      type: String
    - contextPath: FireEyeHX.Indicators.created_by
      description: The "Created By" field as displayed in UI.
      type: String
    - contextPath: FireEyeHX.Indicators.active_since
      description: The date the indicator became active.
      type: String
    - contextPath: FireEyeHX.Indicators.stats.source_alerts
      description: The total number of source alerts associated with this indicator.
      type: Unknown
    - contextPath: FireEyeHX.Indicators.stats.alerted_agents
      description: The total number of agents with HX alerts associated with this indicator.
      type: Unknown
    - contextPath: FireEyeHX.Indicators.platforms
      description: The list of operating systems.
      type: Unknown
    - contextPath: FireEyeHX.Conditions._id
      description: The ID of the FireEye unique condition.
      type: Unknown
    - contextPath: FireEyeHX.Conditions.event_type
      description: The type of the event.
      type: Unknown
    - contextPath: FireEyeHX.Conditions.enabled
      description: Indicates whether the condition is enabled.
      type: Unknown
  - arguments:
    - description: The indicator category. Use the `uri_category` value.
      name: category
      required: true
    - description: The name of the indicator. Use the `uri_name` value.
      name: name
      required: true
    - description: A list of conditions to add. The list can include a list of IPv4 addresses, MD5 files, and domain names. For example, example.netexample.orgexample.
      name: condition
      required: true
    description: Add conditions to an indicator. Conditions can be MD5, hash values, domain names, and IP addresses.
    name: fireeye-hx-append-conditions
  - arguments:
    - description: The search ID.
      name: searchId
      required: true
      isArray: true
    description: Deletes the search by ID.
    name: fireeye-hx-search-delete
  - arguments:
    - description: The acquisition ID.
      name: acquisitionId
      required: true
    description: Deletes the file acquisition by ID.
    name: fireeye-hx-delete-file-acquisition
  - arguments:
    - description: The Agent ID - this argument is required.
      name: agentId
      required: true
    description: Approves pending containment requests made by other components or users. The required permission is api_admin role.
    name: fireeye-hx-approve-containment
    compliantpolicies:
    - EndPoint Isolation
  - arguments:
    - description: The Host Set ID - this argument is required.
      name: hostSetId
      required: true
    - description: The Policy ID - this argument is required.
      name: policyId
      required: true
    description: Inserts a new host set policy on your Endpoint Security server.
    name: fireeye-hx-assign-host-set-policy
  - arguments:
    - description: The acquisition unique ID.
      name: acquisitionId
      required: true
    description: Collects artifacts from the system disk and memory for the given acquisition ID. The data is fetched as a MANS file.
    name: fireeye-hx-get-data-acquisition
    outputs:
    - contextPath: FireEyeHX.Acquisitions.Data._id
      description: The unique ID of the acquisition.
      type: string
    - contextPath: FireEyeHX.Acquisitions.Data.state
      description: The state of the acquisition.
      type: string
    - contextPath: FireEyeHX.Acquisitions.Data.md5
      description: The MD5 of the file.
      type: string
    - contextPath: FireEyeHX.Acquisitions.Data.host._id
      description: The ID of the agent.
      type: string
    - contextPath: FireEyeHX.Acquisitions.Data.finish_time
      description: The time when the acquisition finished.
      type: string
    - contextPath: FireEyeHX.Acquisitions.Data.host.hostname
      description: The hostname.
      type: string
    - contextPath: FireEyeHX.Acquisitions.Data.instance
      description: The FireEye HX instance.
      type: date
  - arguments:
    - description: The acquisition script in JSON format.
      name: script
    - description: The script name. If the Acquisition script is specified, the script name must be specified as well.
      name: scriptName
    - auto: PREDEFINED
      description: Select the host system, which uses the default script.
      name: defaultSystemScript
      predefined:
      - osx
      - win
      - linux
    - description: The agent ID. If the host name is not specified, the agent ID must be specified.
      name: agentId
    - description: The host name. If the agent ID is not specified, the host name must be specified.
      name: hostName
    - description: This argument is deprecated.
      name: acquisition_id
    - auto: PREDEFINED
      description: Whether to use Cortex XSOAR's built-in polling to retrieve the result when ready.
      name: polling
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '60'
      description: The interval in seconds between each poll.
      name: interval_in_seconds
    description: Start a data acquisition process to gather artifacts from the system disk and memory. The data is fetched as a MANS file.
    name: fireeye-hx-data-acquisition
    polling: true
    outputs:
    - contextPath: FireEyeHX.Acquisitions.Data._id
      description: The unique ID of the acquisition.
      type: Number
    - contextPath: FireEyeHX.Acquisitions.Data.state
      description: The state of the acquisition.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Data.md5
      description: The MD5 of the file.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Data.finish_time
      description: The time when the acquisition finished.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Data.host._id
      description: The ID of the agent.
      type: Unknown
  - arguments:
    - auto: PREDEFINED
      description: Identifies which alerts result from indicators with the specified share mode.
      name: hasShareMode
      predefined:
      - any
      - restricted
      - unrestricted
    - auto: PREDEFINED
      description: Sorts the results by the specified field.
      name: resolution
      predefined:
      - active_threat
      - alert
      - block
      - partial_block
    - description: Filter by the agent ID.
      name: agentId
    - description: Filter by condition ID.
      name: conditionId
    - description: Filter by the event occurred time. ISO-8601 timestamp.
      name: eventAt
    - description: Filter by the alert ID.
      name: alertId
    - description: Filter by the match detection time. ISO-8601 timestamp.
      name: matchedAt
    - description: Filter by returning only records with an alertId field value greater than the minId value.
      name: minId
    - description: Filter by the reported time. ISO-8601 timestamp.
      name: reportedAt
    - auto: PREDEFINED
      description: The source of the alert-indicator of compromise.
      name: IOCsource
      predefined:
      - yes
    - auto: PREDEFINED
      description: The source of the alert - exploit detection.
      name: EXDsource
      predefined:
      - yes
    - auto: PREDEFINED
      description: The Source of the malware alert.
      name: MALsource
      predefined:
      - yes
    - description: Limit the results returned.
      name: limit
    - auto: PREDEFINED
      description: Sorts the results by the specified field in ascending order.
      name: sort
      predefined:
      - agentId
      - conditionId
      - eventAt
      - alertId
      - matchedAt
      - id
      - reportedAt
    - auto: PREDEFINED
      description: The sort order for the results.
      name: sortOrder
      predefined:
      - ascending
      - descending
    description: Returns a list of alerts. Use the different arguments to filter the results returned.
    name: fireeye-hx-get-alerts
    outputs:
    - contextPath: FireEyeHX.Alerts._id
      description: The ID of the FireEye alert.
      type: Number
    - contextPath: FireEyeHX.Alerts.agent._id
      description: The ID of the FireEye agent.
      type: Unknown
    - contextPath: FireEyeHX.Alerts.agent.containment_state
      description: The state of the agent containment.
      type: Unknown
    - contextPath: FireEyeHX.Alerts.condition._id
      description: The unique ID of the alert.
      type: String
    - contextPath: FireEyeHX.Alerts.event_at
      description: The time when the event occurred.
      type: String
    - contextPath: FireEyeHX.Alerts.matched_at
      description: The time when the event was matched.
      type: String
    - contextPath: FireEyeHX.Alerts.reported_at
      description: The time when the event was reported.
      type: String
    - contextPath: FireEyeHX.Alerts.source
      description: The source of the alert.
      type: String
    - contextPath: FireEyeHX.Alerts.matched_source_alerts._id
      description: The ID of the source alert.
      type: Unknown
    - contextPath: FireEyeHX.Alerts.matched_source_alerts.appliance_id
      description: The ID of the appliance.
      type: Unknown
    - contextPath: FireEyeHX.Alerts.matched_source_alerts.meta
      description: The source alert meta.
      type: Unknown
    - contextPath: FireEyeHX.Alerts.matched_source_alerts.indicator_id
      description: The ID of the indicator.
      type: Unknown
    - contextPath: FireEyeHX.Alerts.resolution
      description: The alert resolution.
      type: String
    - contextPath: FireEyeHX.Alerts.event_type
      description: The type of the event.
      type: String
  - arguments:
    - description: The acquisition ID. This argument is deprecated.
      name: acquisition_id
    - description: The file name.
      name: fileName
      required: true
    - description: The file path.
      name: filePath
      required: true
    - auto: PREDEFINED
      description: Whether to acquire the file using the API or RAW. By default, the RAW file will be acquired. Use the API option when file is encrypted.
      name: acquireUsing
      predefined:
      - API
      - RAW
    - description: The agent ID associated with the host that holds the file. If the host name is not specified, the agentId must be specified.
      name: agentId
    - description: The host that holds the file. If the agentId is not specified, hostName must be specified.
      name: hostName
    - auto: PREDEFINED
      description: Whether to use Cortex XSOAR's built-in polling to retrieve the result when ready.
      name: polling
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'true'
    - defaultValue: '60'
      description: The interval in seconds between each poll.
      name: interval_in_seconds
    description: Acquires a specific file as a password protected zip file. The password for unlocking the zip file is 'unzip-me'.
    name: fireeye-hx-file-acquisition
    polling: true
    outputs:
    - contextPath: FireEyeHX.Acquisitions.Files._id
      description: The acquisition unique ID.
      type: Number
    - contextPath: FireEyeHX.Acquisitions.Files.state
      description: The acquisition state.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Files.md5
      description: The MD5 of the file.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Files.req_filename
      description: The name of the file.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Files.req_path
      description: The path of the file.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Files.host._id
      description: The ID of the FireEye HX agent.
      type: String
  - arguments:
    - description: The indicator category.
      name: category
      required: true
    - description: Display name for the indicator.
      name: display_name
    - description: Description for the indicator.
      name: description
    - auto: PREDEFINED
      description: The platform for the indicator. If not selected, the indicator will be created for all platforms.
      name: platforms
      isArray: true
      predefined:
      - 'win'
      - 'linux'
      - 'mac'
    description: Create a new indicator.
    name: fireeye-hx-create-indicator
    outputs:
    - contextPath: FireEyeHX.Indicators.active_since
      description: The date the indicator became active.
      type: date
    - contextPath: FireEyeHX.Indicators.meta
      description: The meta data for new indicator.
      type: string
    - contextPath: FireEyeHX.Indicators.display_name
      description: The display name of the indicator.
      type: string
    - contextPath: FireEyeHX.Indicators.name
      description: The indicator name, as displayed in the UI.
      type: string
    - contextPath: FireEyeHX.Indicators.created_by
      description: The "Created By" field, as displayed in UI.
      type: string
    - contextPath: FireEyeHX.Indicators.url
      description: The data URL.
      type: string
    - contextPath: FireEyeHX.Indicators.create_text
      description: The indicator created text.
      type: Unknown
    - contextPath: FireEyeHX.Indicators.platforms
      description: The list of operating systems.
      type: string
    - contextPath: FireEyeHX.Indicators.create_actor._id
      description: The ID of the actor.
      type: number
    - contextPath: FireEyeHX.Indicators.create_actor.username
      description: The user name of the actor.
      type: string
    - contextPath: FireEyeHX.Indicators.signature
      description: The signature of the indicator.
      type: string
    - contextPath: FireEyeHX.Indicators._revision
      description: The indicator revision.
      type: string
    - contextPath: FireEyeHX.Indicators._id
      description: The ID of the FireEye unique indicator.
      type: string
    - contextPath: FireEyeHX.Indicator.description
      description: The description of the indicator.
      type: string
    - contextPath: FireEyeHX.Indicators.category._id
      description: The ID of the category.
      type: number
    - contextPath: FireEyeHX.Indicators.category.name
      description: The name of the category.
      type: string
    - contextPath: FireEyeHX.Indicators.category.share_mode
      description: The share mode of the category.
      type: string
    - contextPath: FireEyeHX.Indicators.category.uri_name
      description: The URI name of the category.
      type: string
    - contextPath: FireEyeHX.Indicators.category.url
      description: The URL of the category.
      type: string
    - contextPath: FireEyeHX.Indicators.uri_name
      description: The URI name of the indicator.
      type: string
    - contextPath: FireEyeHX.Indicators.stats.active_conditions
      description: The active conditions of the indicator.
      type: number
    - contextPath: FireEyeHX.Indicators.stats.alerted_agents
      description: The total number of agents with HX alerts associated with this indicator.
      type: number
    - contextPath: FireEyeHX.Indicators.stats.source_alerts
      description: The total number of source alerts associated with this indicator.
      type: number
    - contextPath: FireEyeHX.Indicators.update_actor._id
      description: The ID of the updated actor.
      type: number
    - contextPath: FireEyeHX.Indicators.update_actor.username
      description: The updated name of the actor.
      type: string
  - arguments:
    - description: The host set ID.
      name: hostSetId
      required: true
    - description: The policy ID.
      name: policyId
      required: true
    description: Deletes a Host Set policy.
    name: fireeye-hx-delete-host-set-policy
  - arguments:
    - description: The acquisition ID.
      name: acquisitionId
      required: true
    description: Deletes data acquisition.
    name: fireeye-hx-delete-data-acquisition
  - name: fireeye-hx-delete-indicator-condition
    arguments:
    - name: category
      required: true
      description: The indicator category.
    - name: indicator_name
      required: true
      description: The name of the indicator. Use the `uri_name` value.
    - name: type
      required: true
      auto: PREDEFINED
      predefined:
      - presence
      - execution
      description: The condition type.
    - name: condition_id
      required: true
      description: The condition ID, which is part of the response when you request a list of all conditions known to the HX Series appliance.
    description: Delete an indicator condition.
  - name: fireeye-hx-list-indicator-category
    arguments:
    - name: search
      description: Performs a search of indicator categories. Searchable values are based on the name, display_name, retention_policy, ui_edit_policy, ui_signature_enabled, ui_source_alerts_enabled.
    - name: name
      description: Filter for indicator categories with the specified name.
    - name: display_name
      description: Filter for indicator categories with given display name.
    - name: retention_policy
      auto: PREDEFINED
      predefined:
      - manual
      - auto
      - intel
      description: The retention policy.
    - name: ui_edit_policy
      auto: PREDEFINED
      predefined:
      - full
      - edit_delete
      - delete
      - read_only
      description: The UI edit policy.
    - name: ui_signature_enabled
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Whether to enable the UI signature.
    - name: ui_source_alerts_enabled
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: Whether to enable UI source alerts.
    - name: share_mode
      auto: PREDEFINED
      predefined:
      - restricted
      - unrestricted
      - silent
      - visible
      - any
      description: Share mode.
    - name: limit
      description: The maximum number of results to return.
      defaultValue: '50'
    - name: offset
      description: Result offset.
      defaultValue: '0'
    outputs:
    - contextPath: FireEyeHX.IndicatorCategory.uri_name
      description: The policy ID of the indicator category.
      type: number
    - contextPath: FireEyeHX.IndicatorCategory.name
      description: The name of the indicator category.
      type: string
    - contextPath: FireEyeHX.IndicatorCategory._revision
      description: The revision of the indicator category.
      type: number
    - contextPath: FireEyeHX.IndicatorCategory.display_name
      description: The display name of the indicator category.
      type: string
    - contextPath: FireEyeHX.IndicatorCategory.retention_policy
      description: The retention policy of the indicator category.
      type: string
    - contextPath: FireEyeHX.IndicatorCategory.ui_edit_policy
      description: The UI edit policy of the indicator category.
      type: string
    - contextPath: FireEyeHX.IndicatorCategory.ui_signature_enabled
      description: Whether the UI signature is enabled.
      type: boolean
    - contextPath: FireEyeHX.IndicatorCategory.ui_source_alerts_enabled
      description: Whether the UI source alerts is enabled.
      type: boolean
    - contextPath: FireEyeHX.IndicatorCategory.share_mode
      description: The share mode of the indicator category.
      type: string
    description: Lists the indicator categories.
  - name: fireeye-hx-delete-indicator
    arguments:
    - name: category
      required: true
      description: The category name.
    - name: indicator_name
      required: true
      description: The name of the indicator. Use the `uri_name` value.
    description: Delete an indicator.
  - arguments:
    - description: The host set ID.
      name: host_set_id
      required: true
    description: Deletes a host set. To use this command you must have admin permissions.
    execution: true
    name: fireeye-hx-delete-host-set
    outputs:
    - contextPath: FireEyeHX.HostSets._id
      description: The host set ID.
      type: String
    - contextPath: FireEyeHX.HostSets.deleted
      description: Was the host set deleted.
      type: Boolean
  - arguments:
    - description: The host set name.
      name: host_set_name
      required: true
    - description: The hosts IDs to add to the host set.
      isArray: true
      name: hosts_ids
      required: true
    description: Creates a static host set. To use this command you must have admin permissions.
    name: fireeye-hx-create-host-set-static
    outputs:
    - contextPath: FireEyeHX.HostSets._id
      description: The host set ID.
      type: String
    - contextPath: FireEyeHX.HostSets.url
      description: URI to retrieve data for this record.
      type: String
    - contextPath: FireEyeHX.HostSets.name
      description: The host set name.
      type: String
    - contextPath: FireEyeHX.HostSets._revision
      description: Date of last update. Used for preventing updates with obsolete data. If _revision in the request body does not match _revision in the database, the update will fail.
      type: Date
    - contextPath: FireEyeHX.HostSets.deleted
      description: Was the host set deleted.
      type: Boolean
  - arguments:
    - description: The host set name.
      name: host_set_name
      required: true
    - description: Free text query. Cannot be used with the other query arguments.
      name: query
    - auto: PREDEFINED
      description: The query key. Must be provided with the query_value and query_operator.
      name: query_key
      predefined:
      - domain
      - product_name
      - patch_level
      - timezone
      - os_bitness
      - cloud_provider
      - app_version
      - hostname
      - server_time
      - gmt_offset_seconds
      - primary-ip_address
      - normalized_app_version
      - litmus_script_id
      - app_config_hash
      - platform
    - description: The query value. Must be provided with the query_key and query_operator.
      name: query_value
    - auto: PREDEFINED
      description: The query operator. Must be provided with the query_key and query_value.
      name: query_operator
      predefined:
      - eq
      - gt
      - lt
      - lte
      - gte
      - exists
      - cidr
    description: Creates a dynamic host set. To use this command you must have admin permissions.
    name: fireeye-hx-create-host-set-dynamic
    outputs:
    - contextPath: FireEyeHX.HostSets._id
      description: The host set ID.
      type: String
    - contextPath: FireEyeHX.HostSets.url
      description: URI to retrieve data for this record.
      type: String
    - contextPath: FireEyeHX.HostSets.name
      description: The host set name.
      type: String
    - contextPath: FireEyeHX.HostSets._revision
      description: Date of last update. Used for preventing updates with obsolete data. If _revision in the request body does not match _revision in the database, the update will fail.
      type: Date
    - contextPath: FireEyeHX.HostSets.deleted
      description: Was the host set deleted.
      type: Boolean
  - arguments:
    - description: The host set ID.
      name: host_set_id
      required: true
    - description: The host set name.
      name: host_set_name
      required: true
    - description: The host sets IDs to add.
      isArray: true
      name: add_host_ids
    - description: The host set IDs to remove.
      isArray: true
      name: remove_host_ids
    description: Updates a static host set. To use this command you must have admin permissions.
    name: fireeye-hx-update-host-set-static
    outputs:
    - contextPath: FireEyeHX.HostSets._id
      description: The host set ID.
      type: String
    - contextPath: FireEyeHX.HostSets.url
      description: URI to retrieve data for this record.
      type: String
    - contextPath: FireEyeHX.HostSets.name
      description: The host set name.
      type: String
    - contextPath: FireEyeHX.HostSets._revision
      description: Date of last update. Used for preventing updates with obsolete data. If _revision in the request body does not match _revision in the database, the update will fail.
      type: Date
    - contextPath: FireEyeHX.HostSets.deleted
      description: Was the host set deleted.
      type: Boolean
  - arguments:
    - description: The host set ID.
      name: host_set_id
      required: true
    - description: The host set name.
      name: host_set_name
      required: true
    - description: Free text query. Cannot be used with the other query arguments. The query is limited to 2 operands. For information about the query, refer to https://fireeye.dev/apis/lighthouse/ .
      name: query
    - auto: PREDEFINED
      description: The query key. Must be provided with the query_value and query_operator.
      name: query_key
      predefined:
      - domain
      - product_name
      - patch_level
      - timezone
      - os_bitness
      - cloud_provider
      - app_version
      - hostname
      - server_time
      - gmt_offset_seconds
      - primary-ip_address
      - normalized_app_version
      - litmus_script_id
      - app_config_hash
      - platform
    - description: The query value. Must be provided with the query_key and query_operator.
      name: query_value
    - auto: PREDEFINED
      description: The query operator. Must be provided with the query_value and query_key.
      name: query_operator
      predefined:
      - eq
      - gt
      - lt
      - lte
      - gte
      - exists
      - cidr
    description: Updates dynamic host set. To use this command you must have admin permissions.
    name: fireeye-hx-update-host-set-dynamic
    outputs:
    - contextPath: FireEyeHX.HostSets._id
      description: The host set ID.
      type: String
    - contextPath: FireEyeHX.HostSets.url
      description: URI to retrieve data for this record.
      type: String
    - contextPath: FireEyeHX.HostSets.name
      description: The host set name.
      type: String
    - contextPath: FireEyeHX.HostSets._revision
      description: Date of last update. Used for preventing updates with obsolete data. If _revision in the request body does not match _revision in the database, the update will fail.
      type: Date
    - contextPath: FireEyeHX.HostSets.deleted
      description: Was the host set deleted.
      type: Boolean
  - name: fireeye-hx-triage-acquisition-package-get
    description: Gets the triage acquisition package for the given acquisition ID.
    arguments:
    - name: acquisitionId
      description: The acquisition ID.
      required: true
    outputs:
    - contextPath: FireEyeHX.Acquisitions.Triage._id
      description: The triage ID.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Triage.state
      description: The acquisition state.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Triage.host._id
      description: The host ID.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Triage.host.hostname
      description: The hostname.
      type: String
  - name: fireeye-hx-triage-acquisition-get
    description: Gets information about a specified triage acquisition.
    arguments:
    - name: acquisitionId
      required: true
      description: The acquisition ID.
    outputs:
    - contextPath: FireEyeHX.Acquisitions.Triage._id
      description: The triage ID.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Triage.state
      description: The acquisition state.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Triage.host._id
      description: The host ID.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Triage.host.hostname
      description: The hostname.
      type: String
  - name: fireeye-hx-triage-acquisition-delete
    description: Deletes a triage acquisition.
    arguments:
    - name: acquisitionId
      required: true
      description: The acquisition ID.
  - name: fireeye-hx-triage-acquisition-start
    arguments:
    - name: hostName
      description: The host name. If the host name is not specified, the agent ID must be specified.
    - name: agentId
      description: The agent ID. If the agent ID is not specified, the host name must be specified.
    outputs:
    - contextPath: FireEyeHX.Acquisitions.Triage._id
      description: The triage ID.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Triage.state
      description: The acquisition state.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Triage.host._id
      description: The host ID.
      type: String
    - contextPath: FireEyeHX.Acquisitions.Triage.host.hostname
      description: The hostname.
      type: String
    description: Starts a triage acquisition
  - name: fireeye-hx-host-acquisitions-list
    description: Gets all acquisitions for a host
    arguments:
    - name: hostName
      description: The host name. If the host name is not specified, the agent ID must be specified.
    - name: agentId
      description: The agent ID. If the agent ID is not specified, the host name must be specified.
    outputs:
    - contextPath: FireEyeHX.Host.Acquisitions.All._id
      description: The acquisition ID.
      type: String
    - contextPath: FireEyeHX.Host.Acquisitions.All.state
      description: The state of the acquisition.
      type: String
    - contextPath: FireEyeHX.Host.Acquisitions.All.acq_type
      description: The type of acquisition.
      type: String
    - contextPath: FireEyeHX.Host.Acquisitions.All.request_time
      description: The requested date of the acquisition.
      type: Date
  isfetch: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.0.0
tests:
- FireEyeHX_v2
- FireEyeHXv2_without_polling