commonfields: id: McAfee Active Response version: -1 name: McAfee Active Response display: McAfee Active Response category: Endpoint provider: Trellix description: Connect to MAR using its DXL client. configuration: - display: Broker CA certificates content (see `brokercerts.crt` in instructions) name: broker_ca_bundle defaultvalue: "" type: 12 required: true - display: Client certificates content (see `client.crt` in instructions) name: cert_file defaultvalue: "" type: 12 required: true - display: Client private key content (see `client.key` in instructions) name: private_key defaultvalue: "" type: 14 required: true - display: Brokers urls (comma separated list in the form of - [ssl://][:port]) - get hostname & port from `brokerlist.properties` file in instructions. Note that the broker should be reachable from demisto server name: broker_urls defaultvalue: "" type: 0 required: true script: script: '' type: python subtype: python3 commands: - name: mar-search arguments: - name: collector required: true auto: PREDEFINED predefined: - CommandLineHistory - CurrentFlow - DNSCache - EnvironmentVariables - Files - HostEntries - HostInfo - InstalledCertificates - InstalledDrivers - InstalledUpdates - InteractiveSessions - LocalGroups - LoggedInUsers - NetworkFlow - NetworkInterfaces - NetworkSessions - NetworkShares - Processes - ScheduledTasks - Services - Software - Startup - UsbConnectedStorageDevices - UserProfiles - WinRegistry description: The collector to query. - name: prejection-collector auto: PREDEFINED predefined: - CommandLineHistory - CurrentFlow - DNSCache - EnvironmentVariables - Files - HostEntries - HostInfo - InstalledCertificates - InstalledDrivers - InstalledUpdates - InteractiveSessions - LocalGroups - LoggedInUsers - NetworkFlow - NetworkInterfaces - NetworkSessions - NetworkShares - Processes - ScheduledTasks - Services - Software - Startup - UsbConnectedStorageDevices - UserProfiles - WinRegistry description: Projection collector that we want to return. By default prejection collector will be equal to the collector. - name: outputs description: Comma separated fields (outputs). Run `mar-collectors-list` to view all collectors & fields command for all collectors outputs, shows all outputs if not supplied. - name: filter-by description: Field name (output) to filter by (e.g. ip_address). Run `mar-collectors-list` to view all collectors & fields command for all collectors outputs. - name: filter-operator auto: PREDEFINED predefined: - GreaterEqualThan - GreaterThan - LessEqualThan - LessThan - Equals - Contains - StartsWith - EndsWith - Before - After description: Filtering operator. - name: filter-value description: Filtering value of the `filter-by` field. outputs: - contextPath: MAR description: "MAR Results in given collector(e.g. 'MAR.HostInfo`, For information about possible output paths, run the command: 'mar-collectors-list'." - contextPath: MAR description: "MAR Results in given collector(e.g. 'MAR.HostInfo`, For information about possible output paths, run the command: 'mar-collectors-list'." description: Search endpoint data - name: mar-collectors-list arguments: [] description: Returns a list of all collectors and their outputs - name: mar-search-multiple arguments: - name: collectors required: true default: true auto: PREDEFINED predefined: - CommandLineHistory - CurrentFlow - DNSCache - EnvironmentVariables - Files - HostEntries - HostInfo - InstalledCertificates - InstalledDrivers - InstalledUpdates - InteractiveSessions - LocalGroups - LoggedInUsers - NetworkFlow - NetworkInterfaces - NetworkSessions - NetworkShares - Processes - ScheduledTasks - Services - Software - Startup - UsbConnectedStorageDevices - UserProfiles - WinRegistry description: The collectors to query. isArray: true - name: filter_collector auto: PREDEFINED predefined: - CommandLineHistory - CurrentFlow - DNSCache - EnvironmentVariables - Files - HostEntries - HostInfo - InstalledCertificates - InstalledDrivers - InstalledUpdates - InteractiveSessions - LocalGroups - LoggedInUsers - NetworkFlow - NetworkInterfaces - NetworkSessions - NetworkShares - Processes - ScheduledTasks - Services - Software - Startup - UsbConnectedStorageDevices - UserProfiles - WinRegistry description: The collector to filter by (e.g. HostInfo). - name: filter-by description: Field name (output) of `filter_collector` to filter by (e.g. ip_address) . Run `mar-collectors-list` to view all collectors & fields. - name: filter-operator auto: PREDEFINED predefined: - GreaterEqualThan - GreaterThan - LessEqualThan - LessThan - Equals - Contains - StartsWith - EndsWith - Before - After description: Filtering operatior. - name: filter-value description: Filtering value of the `filter-by` field. outputs: - contextPath: Mar.SearchMultiple description: "The result of the search query, For information about possible output paths, run the command: 'mar-collectors-list'." description: Search endpoint data crossed by multiple collectors - name: mar-search-services arguments: - name: filter-by description: Field name (output) to filter by (e.g. ip_address). Run `mar-collectors-list` to view all collectors & fields command for all collectors outputs. - name: filter-operator auto: PREDEFINED predefined: - GreaterEqualThan - GreaterThan - LessEqualThan - LessThan - Equals - Contains - StartsWith - EndsWith - Before - After description: Filtering operator. - name: filter-value description: Filtering value of the `filter-by` field. outputs: - contextPath: MAR.Services.Name description: Service name. - contextPath: MAR.Services.Description description: Service description. - contextPath: MAR.Services.Status description: Service status. - contextPath: MAR.Services.Startuptype description: Service startup type. - contextPath: MAR.Services.User description: Service user. description: Gets services information from McAfee Active Response - name: mar-search-processes arguments: - name: filter-by description: Field name (output) to filter by (e.g. ip_address). Run `mar-collectors-list` to view all collectors & fields command for all collectors outputs. - name: filter-operator auto: PREDEFINED predefined: - GreaterEqualThan - GreaterThan - LessEqualThan - LessThan - Equals - Contains - StartsWith - EndsWith - Before - After description: Filtering operator. - name: filter-value description: Filtering value of the `filter-by` field. outputs: - contextPath: MAR.Processes.Name description: Process name. - contextPath: MAR.Processes.Id description: Process id. - contextPath: MAR.Processes.Parentname description: Process parent name. - contextPath: MAR.Processes.Size description: Process size. - contextPath: MAR.Processes.Md5 description: Process md5. - contextPath: MAR.Processes.Sha1 description: Process sha1. - contextPath: MAR.Processes.Cmdline description: Process command line. - contextPath: MAR.Processes.Imagepath description: Process image path. - contextPath: MAR.Processes.Kerneltime description: Process kernel time. - contextPath: MAR.Processes.Usertime description: Process user time. - contextPath: MAR.Processes.Uptime description: Process up time. - contextPath: MAR.Processes.User description: Process user. - contextPath: MAR.Processes.User_id description: Process user id. description: Gets processes information from McAfee Active Response - name: mar-search-win-registry arguments: - name: filter-by description: Field name (output) to filter by (e.g. ip_address). Run `mar-collectors-list` to view all collectors & fields command for all collectors outputs. - name: filter-operator auto: PREDEFINED predefined: - GreaterEqualThan - GreaterThan - LessEqualThan - LessThan - Equals - Contains - StartsWith - EndsWith - Before - After description: Filtering operator. - name: filter-value description: Filtering value of the `filter-by` field. outputs: - contextPath: MAR.WinRegistry.Keypath description: WinRegistry key path. - contextPath: MAR.WinRegistry.Keyvalue description: WinRegistry key value. - contextPath: MAR.WinRegistry.Valuedata description: WinRegistry value data. - contextPath: MAR.WinRegistry.Valuetype description: WinRegistry value type. description: Gets WinRegistry information from McAfee Active Response - name: mar-search-files arguments: - name: filter-by description: Field name (output) to filter by (e.g. ip_address). Run `mar-collectors-list` to view all collectors & fields command for all collectors outputs. - name: filter-operator auto: PREDEFINED predefined: - GreaterEqualThan - GreaterThan - LessEqualThan - LessThan - Equals - Contains - StartsWith - EndsWith - Before - After description: Filtering operator. - name: filter-value description: Filtering value of the `filter-by` field. outputs: - contextPath: MAR.Files.Name description: File name. - contextPath: MAR.Files.Dir description: File directory. - contextPath: MAR.Files.Full_name description: File full name. - contextPath: MAR.Files.Size description: File size. - contextPath: MAR.Files.Last_write description: File last write. - contextPath: MAR.Files.Md5 description: File md5. - contextPath: MAR.Files.Sha1 description: File sha1. - contextPath: MAR.Files.Created_at description: File created at. - contextPath: MAR.Files.Deleted_at description: File deleted at. description: Gets files information from McAfee Active Response - name: mar-search-usb-connected-storage-devices arguments: - name: filter-by description: Field name (output) to filter by (e.g. ip_address). Run `mar-collectors-list` to view all collectors & fields command for all collectors outputs. - name: filter-operator auto: PREDEFINED predefined: - GreaterEqualThan - GreaterThan - LessEqualThan - LessThan - Equals - Contains - StartsWith - EndsWith - Before - After description: Filtering operator. - name: filter-value description: Filtering value of the `filter-by` field. outputs: - contextPath: MAR.UsbConnectedStorageDevices.Vendor_id description: Usb connected storage devices vendor id. - contextPath: MAR.UsbConnectedStorageDevices.Product_id description: Usb connected storage devices product id. - contextPath: MAR.UsbConnectedStorageDevices.Serial_number description: Usb connected storage devices serial number. - contextPath: MAR.UsbConnectedStorageDevices.Device_type description: Usb connected storage devices type. - contextPath: MAR.UsbConnectedStorageDevices.Guid description: Usb connected storage devices guid. - contextPath: MAR.UsbConnectedStorageDevices.Last_connection_time description: Usb connected storage devices last connection time. - contextPath: MAR.UsbConnectedStorageDevices.User_name description: Usb connected storage devices user name. - contextPath: MAR.UsbConnectedStorageDevices.Last_time_used_by_user description: Usb connected storage devices last time used by user. description: Gets Usb connected devices information from McAfee Active Response - name: mar-search-user-profiles arguments: - name: filter-by description: Field name (output) to filter by (e.g. ip_address). Run `mar-collectors-list` to view all collectors & fields command for all collectors outputs. - name: filter-operator auto: PREDEFINED predefined: - GreaterEqualThan - GreaterThan - LessEqualThan - LessThan - Equals - Contains - StartsWith - EndsWith - Before - After description: Filtering operator. - name: filter-value description: Filtering value of the `filter-by` field. outputs: - contextPath: MAR.UserProfiles.Accountdisabled description: User profile account disabled. - contextPath: MAR.UserProfiles.Domain description: User profile domain. - contextPath: MAR.UserProfiles.Fullname description: User profile full name. - contextPath: MAR.UserProfiles.Installdate description: User profile install date. - contextPath: MAR.UserProfiles.Localaccount description: User profile local account. - contextPath: MAR.UserProfiles.Lockedout description: User profile lockedout. - contextPath: MAR.UserProfiles.Accountname description: User profile account name. - contextPath: MAR.UserProfiles.Sid description: User profile sid. - contextPath: MAR.UserProfiles.Passwordexpires description: User profile password expired. description: Gets user profiles information from McAfee Active Response - name: mar-search-scheduled-tasks arguments: - name: filter-by description: Field name (output) to filter by (e.g. ip_address). Run `mar-collectors-list` to view all collectors & fields command for all collectors outputs. - name: filter-operator auto: PREDEFINED predefined: - GreaterEqualThan - GreaterThan - LessEqualThan - LessThan - Equals - Contains - StartsWith - EndsWith - Before - After description: Filtering operator. - name: filter-value description: Filtering value of the `filter-by` field. outputs: - contextPath: MAR.ScheduledTasks.Folder description: Scheduled tasks folder. - contextPath: MAR.ScheduledTasks.Taskname description: Scheduled tasks name. - contextPath: MAR.ScheduledTasks.Status description: Scheduled tasks status. - contextPath: MAR.ScheduledTasks.Last_run description: Scheduled tasks last run. - contextPath: MAR.ScheduledTasks.Username description: Scheduled tasks user name. - contextPath: MAR.ScheduledTasks.Schedule_on description: Scheduled tasks schedule on. description: Gets scheduled tasks information from McAfee Active Response - name: mar-search-host-info arguments: - name: filter-by description: Field name (output) to filter by (e.g. ip_address). Run `mar-collectors-list` to view all collectors & fields command for all collectors outputs. - name: filter-operator auto: PREDEFINED predefined: - GreaterEqualThan - GreaterThan - LessEqualThan - LessThan - Equals - Contains - StartsWith - EndsWith - Before - After description: Filtering operator. - name: filter-value description: Filtering value of the `filter-by` field. outputs: - contextPath: MAR.HostInfo.Hostname description: Host name. - contextPath: MAR.HostInfo.Ip_address description: Host Ip address. - contextPath: MAR.HostInfo.Os description: Host operation system. description: Gets host information from McAfee Active Response dockerimage: demisto/dxl:1.0.0.10133006 fromversion: 5.0.0 tests: - No tests (auto formatted)