Guillaume BOURGEOIS
1c3936992b
Cybereason API, 7 commands: query Malops, list sensors, get machine details, isolate/un-isolate machine (containment), block file hash. Session (login) auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
96 lines
3.5 KiB
YAML
96 lines
3.5 KiB
YAML
id: cybereason
|
|
name: Cybereason
|
|
version: 1.0.0
|
|
description: "Cybereason EDR — endpoint containment and investigation: query Malops, list sensors, isolate/un-isolate a machine (containment), block a file hash, and read machine details. Session (login) authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: query Malops, list sensors, isolate/un-isolate machine, block file, get machine details."
|
|
category: endpoint
|
|
|
|
# Per-instance configuration. Each command logs in (form POST to /login.html,
|
|
# reusing the returned session cookie) then performs the action.
|
|
config_schema:
|
|
properties:
|
|
server_url:
|
|
type: string
|
|
description: "Cybereason server URL (e.g. https://your-tenant.cybereason.net:443)"
|
|
username:
|
|
type: string
|
|
description: "Cybereason username"
|
|
password:
|
|
type: string
|
|
description: "Cybereason password"
|
|
x-soar-sensitive: true
|
|
insecure:
|
|
type: boolean
|
|
description: "Trust any TLS certificate (not secure)"
|
|
default: false
|
|
required:
|
|
- server_url
|
|
- username
|
|
- password
|
|
|
|
commands:
|
|
- id: query_malops
|
|
name: cybereason-query-malops
|
|
description: "Query Malops (malicious operations) in a time window."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
start_time: { type: number, description: "Start time as Unix epoch milliseconds" }
|
|
end_time: { type: number, description: "End time as Unix epoch milliseconds" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: list_sensors
|
|
name: cybereason-list-sensors
|
|
description: "List sensors (endpoints)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
limit: { type: number, description: "Max sensors (default 100)" }
|
|
offset: { type: number, description: "Offset (default 0)" }
|
|
filter_field: { type: string, description: "Optional field to filter on (e.g. machineName)" }
|
|
filter_value: { type: string, description: "Value for the filter field (equals match)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_machine_details
|
|
name: cybereason-get-machine-details
|
|
description: "Get details for a sensor/machine by its sensor ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
sensor_id: { type: string, description: "Sensor ID" }
|
|
required: [sensor_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: isolate_machine
|
|
name: cybereason-isolate-machine
|
|
description: "Isolate one or more machines from the network (containment)."
|
|
inputs_schema:
|
|
properties:
|
|
sensor_ids: { type: string, description: "Comma-separated sensor IDs to isolate" }
|
|
required: [sensor_ids]
|
|
outputs_schema: { properties: {} }
|
|
- id: unisolate_machine
|
|
name: cybereason-unisolate-machine
|
|
description: "Remove one or more machines from isolation."
|
|
inputs_schema:
|
|
properties:
|
|
sensor_ids: { type: string, description: "Comma-separated sensor IDs to un-isolate" }
|
|
required: [sensor_ids]
|
|
outputs_schema: { properties: {} }
|
|
- id: block_file
|
|
name: cybereason-block-file
|
|
description: "Block a file by hash (add to the block list)."
|
|
inputs_schema:
|
|
properties:
|
|
md5: { type: string, description: "MD5 hash of the file to block" }
|
|
required: [md5]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: cybereason-test-connection
|
|
description: "Verify connectivity and credentials by logging in (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|