f3nris
f6b8c84285
Every EDR (category: endpoint) integration is now audited for an OCSF mapper. Six had a fetch command but no mapper — add a bundled OCSF mapper for each, wire the fetch command as an ingestion source (ingest: results_path/dedup_key [/incremental_field]) and add the top-level ingestion block. Field mappings were derived from each vendor's fetch output and cross-referenced against the demisto/content reference for that vendor. - carbon-black-cloud: search_alerts (results_path results, dedup id) — 35 fields - cisco-secure-endpoint: list_events (data, id) — 21 fields - cybereason: query_malops (malops, guid, incr start_time) — 6 fields - sophos-central: list_alerts (items, id) — 14 fields - trend-vision-one: list_alerts (items, id, incr start_datetime) — 19 fields - withsecure: list_incidents (items, incidentId) — 7 fields Validated: every manifest passes ParseManifest+ValidateManifest and every mapper passes ParseMapperFile with all JSONata source_path/field expressions compiling. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
105 lines
3.8 KiB
YAML
105 lines
3.8 KiB
YAML
id: cybereason
|
|
name: Cybereason
|
|
version: 1.0.0
|
|
description: "Cybereason EDR — endpoint containment and investigation: query Malops, list sensors, isolate/un-isolate a machine (containment), block a file hash, and read machine details. Session (login) authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: query Malops, list sensors, isolate/un-isolate machine, block file, get machine details."
|
|
category: endpoint
|
|
|
|
# Per-instance configuration. Each command logs in (form POST to /login.html,
|
|
# reusing the returned session cookie) then performs the action.
|
|
config_schema:
|
|
properties:
|
|
server_url:
|
|
type: string
|
|
description: "Cybereason server URL (e.g. https://your-tenant.cybereason.net:443)"
|
|
username:
|
|
type: string
|
|
description: "Cybereason username"
|
|
password:
|
|
type: string
|
|
description: "Cybereason password"
|
|
x-soar-sensitive: true
|
|
insecure:
|
|
type: boolean
|
|
description: "Trust any TLS certificate (not secure)"
|
|
default: false
|
|
required:
|
|
- server_url
|
|
- username
|
|
- password
|
|
|
|
commands:
|
|
- id: query_malops
|
|
name: cybereason-query-malops
|
|
description: "Query Malops (malicious operations) in a time window. Used for ingestion: results path = malops."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
start_time: { type: number, description: "Start time as Unix epoch milliseconds" }
|
|
end_time: { type: number, description: "End time as Unix epoch milliseconds" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
ingest:
|
|
results_path: malops
|
|
dedup_key: guid
|
|
incremental_field: start_time
|
|
- id: list_sensors
|
|
name: cybereason-list-sensors
|
|
description: "List sensors (endpoints)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
limit: { type: number, description: "Max sensors (default 100)" }
|
|
offset: { type: number, description: "Offset (default 0)" }
|
|
filter_field: { type: string, description: "Optional field to filter on (e.g. machineName)" }
|
|
filter_value: { type: string, description: "Value for the filter field (equals match)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_machine_details
|
|
name: cybereason-get-machine-details
|
|
description: "Get details for a sensor/machine by its sensor ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
sensor_id: { type: string, description: "Sensor ID" }
|
|
required: [sensor_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: isolate_machine
|
|
name: cybereason-isolate-machine
|
|
description: "Isolate one or more machines from the network (containment)."
|
|
inputs_schema:
|
|
properties:
|
|
sensor_ids: { type: string, description: "Comma-separated sensor IDs to isolate" }
|
|
required: [sensor_ids]
|
|
outputs_schema: { properties: {} }
|
|
- id: unisolate_machine
|
|
name: cybereason-unisolate-machine
|
|
description: "Remove one or more machines from isolation."
|
|
inputs_schema:
|
|
properties:
|
|
sensor_ids: { type: string, description: "Comma-separated sensor IDs to un-isolate" }
|
|
required: [sensor_ids]
|
|
outputs_schema: { properties: {} }
|
|
- id: block_file
|
|
name: cybereason-block-file
|
|
description: "Block a file by hash (add to the block list)."
|
|
inputs_schema:
|
|
properties:
|
|
md5: { type: string, description: "MD5 hash of the file to block" }
|
|
required: [md5]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: cybereason-test-connection
|
|
description: "Verify connectivity and credentials by logging in (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
ingestion:
|
|
command: query_malops
|
|
mapper: query_malops
|
|
default_incident_type: "Cybereason Malop"
|