id: cybereason
name: Cybereason
version: 1.0.0
description: "Cybereason EDR — endpoint containment and investigation: query Malops, list sensors, isolate/un-isolate a machine (containment), block a file hash, and read machine details. Session (login) authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: query Malops, list sensors, isolate/un-isolate machine, block file, get machine details."
category: endpoint

# Per-instance configuration. Each command logs in (form POST to /login.html,
# reusing the returned session cookie) then performs the action.
config_schema:
  properties:
    server_url:
      type: string
      description: "Cybereason server URL (e.g. https://your-tenant.cybereason.net:443)"
    username:
      type: string
      description: "Cybereason username"
    password:
      type: string
      description: "Cybereason password"
      x-soar-sensitive: true
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - server_url
    - username
    - password

commands:
  - id: query_malops
    name: cybereason-query-malops
    description: "Query Malops (malicious operations) in a time window. Used for ingestion: results path = malops."
    risk: read
    inputs_schema:
      properties:
        start_time: { type: number, description: "Start time as Unix epoch milliseconds" }
        end_time: { type: number, description: "End time as Unix epoch milliseconds" }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: malops
      dedup_key: guid
      incremental_field: start_time
  - id: list_sensors
    name: cybereason-list-sensors
    description: "List sensors (endpoints)."
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max sensors (default 100)" }
        offset: { type: number, description: "Offset (default 0)" }
        filter_field: { type: string, description: "Optional field to filter on (e.g. machineName)" }
        filter_value: { type: string, description: "Value for the filter field (equals match)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_machine_details
    name: cybereason-get-machine-details
    description: "Get details for a sensor/machine by its sensor ID."
    risk: read
    inputs_schema:
      properties:
        sensor_id: { type: string, description: "Sensor ID" }
      required: [sensor_id]
    outputs_schema: { properties: {} }
  - id: isolate_machine
    name: cybereason-isolate-machine
    description: "Isolate one or more machines from the network (containment)."
    inputs_schema:
      properties:
        sensor_ids: { type: string, description: "Comma-separated sensor IDs to isolate" }
      required: [sensor_ids]
    outputs_schema: { properties: {} }
  - id: unisolate_machine
    name: cybereason-unisolate-machine
    description: "Remove one or more machines from isolation."
    inputs_schema:
      properties:
        sensor_ids: { type: string, description: "Comma-separated sensor IDs to un-isolate" }
      required: [sensor_ids]
    outputs_schema: { properties: {} }
  - id: block_file
    name: cybereason-block-file
    description: "Block a file by hash (add to the block list)."
    inputs_schema:
      properties:
        md5: { type: string, description: "MD5 hash of the file to block" }
      required: [md5]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: cybereason-test-connection
    description: "Verify connectivity and credentials by logging in (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

ingestion:
  command: query_malops
  mapper: query_malops
  default_incident_type: "Cybereason Malop"