commonfields:
  id: fireeye
  version: -1
name: fireeye
fromversion: 5.0.0
display: FireEye (AX Series)
category: Forensics & Malware Analysis
provider: Trellix
description: Perform malware dynamic analysis.
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: server
  defaultvalue: ""
  type: 0
  required: true
- display: Username
  name: credentials
  defaultvalue: ""
  type: 9
  required: false
- display: Client token
  name: clientToken
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
- displaypassword: Client Token
  name: credentials_client_token
  hiddenusername: true
  type: 9
  required: false
- display: Version
  name: version
  defaultvalue: 1.1.0
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: fe-report
    arguments:
    - name: report_type
      required: true
      description: commands.server.feReport.arguments.reportType.description.
    - name: type
      required: true
      description: commands.server.feReport.arguments.type.description.
    - name: start_time
      required: true
      description: Report start time.
    - name: end_time
      required: true
      description: Report end time.
    - name: command
      description: Report command.
    - name: module
      description: Report module.
    - name: frame
      description: commands.server.feReport.arguments.frame.description.
    description: commands.server.feReport.description.
  - name: fe-submit-status
    arguments:
    - name: submission_Key
      required: true
      description: commands.server.feSubmit.arguments.submissionKey.description.
    outputs:
    - contextPath: FireEyeAX.Submissions.Key
      description: The file submission key.
    - contextPath: FireEyeAX.Submissions.Status
      description: The file submission status.
    description: commands.server.feSubmitStatus.description.
  - name: fe-alert
    arguments:
    - name: duration
      description: commands.server.feAlert.arguments.duration.description.
    - name: start_time
      description: commands.server.feAlert.arguments.startTime.description.
    - name: end_time
      description: commands.server.feAlert.arguments.endTime.description.
    - name: src_ip
      description: commands.server.feAlert.arguments.srcIP.description.
    - name: dst_ip
      description: commands.server.feAlert.arguments.dstIP.description.
    - name: malware_name
      description: commands.server.feAlert.arguments.malwareName.description.
    - name: malware_type
      description: commands.server.feAlert.arguments.malwareType.description.
    - name: sender_email
      description: commands.server.feAlert.arguments.senderMail.description.
    - name: recipient_email
      description: commands.server.feAlert.arguments.recipientEMail.description.
    - name: file_name
      description: commands.server.feAlert.arguments.fileName.description.
    - name: file_type
      description: commands.server.feAlert.arguments.fileType.description.
    - name: url
      description: commands.server.feAlert.arguments.url.description.
    - name: md5
      description: commands.server.feAlert.arguments.md5.description.
    - name: info_level
      description: commands.server.feAlert.arguments.infoLevel.description.
    - name: callback_domain
      description: commands.server.feAlert.arguments.callbackDomain.description.
    description: commands.server.feAlert.description.
  - name: fe-submit-result
    arguments:
    - name: submission_Key
      required: true
      description: commands.server.feSubmit.arguments.submissionKey.description.
    - name: info_level
      auto: PREDEFINED
      predefined:
      - concise
      - normal
      - extended
      description: commands.server.feAlert.arguments.infoLevel.description.
      defaultValue: concise
    outputs:
    - contextPath: FireEyeAX.Submissions.Key
      description: The submission key.
    - contextPath: FireEyeAX.Submissions.Severity
      description: The severity level of the file.
    - contextPath: DBotScore.Score
      description: The actual score.
    - contextPath: DBotScore.Indicator
      description: The indicator we tested.
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
    - contextPath: DBotScore.Type
      description: The type of the indicator.
    - contextPath: File.MD5
      description: Bad hash found.
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
    description: Results of the file submission.
  - name: fe-submit
    arguments:
    - name: upload
      description: commands.server.feSubmit.arguments.upload.description.
      deprecated: true
    - name: uploadFile
      description: commands.server.feSubmit.arguments.uploadFile.description.
    - name: analysistype
      required: true
      description: commands.server.feSubmit.arguments.analysisType.description.
    - name: profiles
      required: true
      description: commands.server.feSubmit.arguments.profile.description.
    - name: application
      required: true
      description: commands.server.feSubmit.arguments.application.description.
    - name: priority
      required: true
      description: commands.server.feSubmit.arguments.priority.description.
    - name: force
      required: true
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: commands.server.feSubmit.arguments.force.description.
    - name: prefetch
      required: true
      description: commands.server.feSubmit.arguments.prefetch.description.
    - name: timeout
      required: true
      description: commands.server.feSubmit.arguments.timeout.description.
    outputs:
    - contextPath: FireEyeAX.Submissions.Key
      description: The file submission key.
    description: commands.server.feSubmit.description.
  - name: fe-config
    arguments: []
    outputs:
    - contextPath: FireEyeAX.Sensors.Address
      description: Sensor IP address.
    - contextPath: FireEyeAX.Sensors.ID
      description: Sensor FireEye id.
    - contextPath: FireEyeAX.Sensors.Name
      description: Sensor name.
    - contextPath: FireEyeAX.Sensors.Profiles.ID
      description: ID of FireEye sensor profile.
    - contextPath: FireEyeAX.Sensors.Profiles.Name
      description: Name of FireEye sensor name.
    - contextPath: FireEyeAX.Sensors.Profiles.Applications.-id
      description: FireEye application ID.
    - contextPath: FFireEyeAX.Sensors.Profiles.Applications.-name
      description: FireEye application name.
    description: commands.server.feConfig.description.
  - name: fe-submit-url
    arguments:
    - name: analysistype
      required: true
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      description: 'Specify live or sandbox analysis mode. 1—Live, analyze suspected malware objects live within the MAS Multivector Virtual Execution (MVX) analysis engine. 2—Sandbox, analyze suspected malware objects in a closed, protected environment. Example: analysisType=1.'
    - name: profiles
      required: true
      description: Select the MAS profile to use for analysis. To determine the available profiles, use the configuration command.  To submit profiles, add them as a parameter using a comma to separate them.  For example, profiles="win7-sp1,winxp-sp3".
    - name: application
      required: true
      description: 'Specifies the application to be used for the analysis. To determine the available applications  for a specific profile, use the configuration command. Note: Setting the application value to 0, allows the MAS to determine the file type for you.'
    - name: priority
      required: true
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      description: 'Sets the analysis priority: 0—Normal, adds analysis to the bottom of queue. 1—Urgent, places the analysis at the top of the queue.'
    - name: force
      required: true
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: 'Specify whether to perform an analysis on the malware object even if the object exactly matches an analysis that has already been performed. In most cases, it is not necessary to reanalyze malware. (default: false) False, Do not analyze duplicate objects. True, Force analysis.'
    - name: prefetch
      required: true
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      description: Specifies whether to determine the file target based on an internal determination rather than browsing to the target location. 0—No 1—Yes. If analysistype is set to 0 for sandbox analysis, prefetch must be set to 1.
    - name: timeout
      required: true
      description: Sets the analysis timeout (in seconds).
    - name: urls
      required: true
      description: URLs to be analyzed. To submit URLs, add them as a parameter using a comma to separate them.  For example, urls="www.demisto.com,www.google.com".
    outputs:
    - contextPath: FireEyeAX.Submissions.Key
      description: The file submission key.
    description: Submit a url for analysis by FireEye.
  - name: fe-submit-url-status
    arguments:
    - name: submission_Key
      required: true
      description: Submission key of the submission.
    outputs:
    - contextPath: FireEyeAX.Submissions.Key
      description: The url submission key.
    - contextPath: FireEyeAX.Submissions.InfoLevel
      description: The info level of the report.
      type: String
    - contextPath: FireEyeAX.Submissions.Status
      description: The url submission status.
    - contextPath: FireEyeAX.Submissions.ID
      description: The ID of URL submission results.
    description: Get a status for a url submitted to FireEye analysis.
  - name: fe-submit-url-result
    arguments:
    - name: submissionID
      required: true
      description: Submission ID of the submission.
    - name: info_level
      auto: PREDEFINED
      predefined:
      - concise
      - normal
      - extended
      description: 'Specifies the level of information to be returned. Unless otherwise specified, the info_level is set to concise. You can select the following information levels concise: (default), normal, extended.'
      defaultValue: concise
    outputs:
    - contextPath: FireEyeAX.Submissions.Key
      description: The submission key.
    - contextPath: FireEyeAX.Submissions.Severity
      description: The severity level of the file.
    - contextPath: FireEyeAX.Submissions.InfoLevel
      description: The info level of the report.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
    - contextPath: DBotScore.Indicator
      description: The indicator we tested.
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
    - contextPath: File.MD5
      description: Bad hash found.
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
    description: Results of the URL submission.
tests:
- No test - no instance