Contents x
      Cybereason 2.6.0
      • 22 May 2022
      • 9 Minutes to read
      • Dark
        Light
      • PDF
      Contents

      Cybereason 2.6.0

      • Updated on 22 May 2022
      • 9 Minutes to read
      • Dark
        Light
      • PDF
      Article summary

      tags: Python | EDR | Automation | Prevention

      Description

      Integration with Cybereason is created to support CDC users by providing enrichment that consists of the details of specific domains, machines, processes, Malops (malicious operations), users, files, etc. – that are connected to Cybereason. These enable CDC users to make informed decisions regarding incident response.

      Cybereason EDR consolidates intelligence about each attack into a single visual representation called a Malop. Each Malop organizes the relevant attack data into an easy-to-read, interactive graphical interface, providing a complete timeline of the attack, the flow of malware across processes and users, and all incoming and outgoing communications for affected machines. This gives security professionals unparalleled visibility into IT environments.

      CyberProof uses generic adaptive cards to display host-related information in a meaningful intuitive GUI. This helps facilitate easy understanding of host data as well as the status of the host on Cybereason. CyberProof also ensures that preventive capabilities of the pack can be enabled/disabled - based on customer requirements.

      We do so by providing CLI commands to prevent/un-prevent a file, enrich data about a specific connection/domain/ machine/process or processes by machine/Malop/ user/file/connection by IP/connection by machine, isolate/un-isolate a machine, add a comment to a Malop, update the malop status command. etc.

      Integration Type:Enrichment
      Information read:Domain, process, user, file, etc.
      API Supported:
      Input:Domain name/Machine Name/Hash (MD5/SHA1/SHA256)/GUID of malops/Username/Process Name/Threat Name/File Name/Malware Name
      Output:Detailed enrichment consisting of relevant information.
      Classification:Public

      CDC Command Lines

      • add_comment_cli
        As per the requirement of SoC, we have created a new CLI that adds comments to the Malop from the CDC. comment and malop_guid are mandatory fields in the CLI. One important point is that you can get all available malop guids by running the query_malops_cli command, with the respective company name from the CDC.
      OptionTypeDescriptionRequired
      company_namestringCompany name configured in configuration.False
      malop_guidstringGlobally unique identifier of malop (malware).True
      commentstringThe name of the machine.True
      • check_cli_action_availability_and_remove_disabled
        Check if the CLI action is enabled, and remove CLIs that are disabled.
      OptionTypeDescriptionRequired
      pack_namestringName of the pack.True
      cli_action_namestringName of the CLI action to be checked.True
      • get_disabled_cli_action_list
        Get the disabled CLI action list of the pack.
      OptionTypeDescriptionRequired
      disabled_cli_action_listarrayList of CLI action names that are disabled for the pack.True
      • isolate_machine_cli
        CLI of the CDC, of the isolate-machine in the CDC message thread. This CLI is used to isolate a machine using Cybereason.
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      machinestringThe name of the machine.True
      • is_probe_connected_cli
        CLI of the CDC, of is-probe-connected in the CDC message thread. This CLI enables checking whether the machine is connected.
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      machinestringThe name of the machine.True
      • prevent_file_cli
        CLI of the CDC, of prevent-file in the CDC message thread. This CLI is used to perform the file prevention task using Cybereason.
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      file_MD5_hashstringThe MD5 hash of the relevant file.True
      • query_connection_by_ip_cli
        CLI of the CDC, of query-connection-by-ip in the CDC message thread. This CLI returns the connection information based on the given IP and applied filters.
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      ipstringIP address in IPv4/v6 format.True
      has_suspicionsbooleanTrue to set only has suspicions.False
      used_by_malwarebooleanTrue to set only used by malware.False
      country_namestringThe country name for the filter.False
      • query_connection_by_machine_cli
        CLI of the CDC, of query-connection-by-machine in the CDC message thread. This gives details of the connection, based on the given machine and applied filters.
      OptionTypeDescriptionRequired
      machinestringThe name of the machine.True
      company_namestringThe company name configured in the configuration.False
      has_suspicionsbooleanTrue to set only has any suspicions.False
      has_malopsbooleanTrue to set only has any malops.False
      has_suspicious_processesbooleanTrue to set only has suspicions processes.False
      os_typestringFilter to search os_type.False
      • query_connection_cli
        CLI of the CDC, of query-connection in the CDC message thread. This CLI gives details of the connections configuration available, based on the given connection_name or server port.
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      connection_namestringFilter for the connection name to search.False
      server_portintegerFilter for server port type to search.False
      • query_domain_cli
        CLI of the CDC, of query-domain in the CDC message thread. This CLI gives details about the domain configuration information available, based on the domain name and filters applied.
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      domain_namestringDomain_name.True
      reputationstringReputation filter to search.False
      is_internal_domainbooleanIs it an internal domain?False
      was_ever_resolvedbooleanWas it ever resolved?False
      was_ever_resolved_as_second_domainbooleanWas it ever resolved as a second level domain?False
      • query_file_by_machine_cli
        CLI of the CDC, of search-file-by-machine in the CDC message thread. This CLI gives information about the file based on the machine and other filters applied.
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      machinestringThe name of the machine.False
      has_suspicionsbooleanTrue to set only has any suspicions.False
      has_malopsbooleanTrue to set only has any malops.False
      has_suspicious_processesbooleanTrue to set only has suspicious processes.False
      os_typestringFilter to search the OS type of machineFalse
      • query_file_by_process_cli
        CLI of the CDC, of search-file-by-process in the CDC message thread. This CLI helps in getting the information about the file based on filters.
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      is_downloaded_from_internetbooleanThe process downloaded from the internet or not.False
      has_malopsbooleanThe has malop filter.False
      has_suspicionsbooleanThe has suspicions filter.False
      command_linestringThe command line filter.False
      has_listening_connectionbooleanThe filter for listening connection status.False
      has_external_connectionbooleanThe filter for has external connection status.False
      • query_file_cli
        CLI of the CDC, of search-file in the CDC message thread. This CLI gives details about the file based on the filters provided.
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      hash_valuestringThe hash value of the file to filter.False
      namestringThe name of the file to filter.False
      file_is_signedbooleanThe signed file filter.False
      signature_verifiedbooleanThe signature verified file filter.False
      pathstringThe path of the file to filter.False
      • query_malops_cli
        CLI of the CDC, of query-malops in the CDC message thread. This CLI provides details about the available malops based on the guide provided. Note: guid needs to be in array format; e.g., ['dummy_guid']
      OptionTypeDescriptionRequired
      guid_listarrayGlobally Unique Identifier of malops.False
      company_namestringThe company name configured in the configuration.False
      • query_process_cli
        CLI of the CDC, of query-search-process in the CDC message thread. This CLI provides information about available processes, based on the process name and other filters.
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      process_namestringThe malop process name to filter.True
      is_downloaded_from_internetbooleanThe process downloaded from the internet or not.False
      has_malopsbooleanThe has malop filter.False
      has_suspicionsbooleanThe has suspicions filter.False
      command_linestringThe command line is filter.False
      has_incoming_connectionbooleanThe has incoming connection as filter.False
      has_outgoing_connectionbooleanThe has outgoing connection as filter.False
      • query_process_on_machine_cli
        CLI of the CDC, of query-process-on-machine in the CDC message thread. This CLI provides information about the processes, based on the machine name other applied filters.
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      machine_namestringSearch process by machine name.True
      has_malopbooleanThe has malop filter.False
      has_suspicionsbooleanThe has suspicions filter.False
      has_suspicions_processbooleanThe has suspicions process filter.False
      os_typestringThe OS type to filter.False
      • query_user_cli
        CLI of the CDC, of query-user in the CDC message thread. This CLI gives information about user configuration, based on the available filters.
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      domain_user_namestringDomain/user name of the configuration.False
      domainstringDomain name of the configuration.False
      has_suspiciousbooleanIs suspicious.False
      local_systembooleanLocal_systemFalse
      • unisolate_machine_cli
        CLI of the CDC, of unisolate-machine in the CDC message thread. This CLI helps in getting a machine un-isolated with the help of Cybereason.
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      machinestringThe name of the machine.True
      • unprevent_file_cli
        CLI of the CDC, of unprevent-file in the CDC message thread. This CLI helps in unpreventing the file with the help of Cybereason.
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      file_MD5_hashstringThe MD5 hash of the relevant file.True
      • update_malop_status_cli
        As per the requirement of SoC, we have created a new CLI that updates the Malop status from the CDC. company_name, malop_guid, and status are mandatory fields in CLI. Available options for status are translated to Cybereason UI status. For example, "todo" translates to "To review", "closed"-->"Remediated", "unread" -->"Unread", "fp" --> "Not relevant" and "open" -->"Under investigation".
      OptionTypeDescriptionRequired
      company_namestringThe company name configured in the configuration.False
      malop_guidstringGlobally Unique Identifier of malop (malware).True
      statusstringThe new status.True

      Workflows

      • check_single_tenant
        Check that the installation type is of single tenant type.

      • get_single_tenant_company_name
        Get the single tenant company name.

      • is_probe_connected_sub_workflow
        CLI of the CDC, of is-probe-connected in the CDC the message thread.

      • prevent_file_sub_workflow
        Sub-workflow to prevent a file.

      • query_connection_by_ip_sub_workflow
        CLI of the CDC, of query-connection-by-ip in the CDC message thread.

      • query_connection_by_machine_sub_workflow
        CLI of the CDC, of query-connection-by-machine in the CDC message thread.

      • query_connection_sub_workflow
        CLI of the CDC, of query-connection in the CDC message thread.

      • query_domain_sub_workflow
        CLI of the CDC, of query-domain in the CDC message thread.

      • query_file_by_machine_sub_workflow
        Sub-workflow to run a search file by machine.

      • query_file_by_process_sub_workflow
        Sub-workflow for search-file-by-process. Thread.

      • query_file_sub_workflow
        Sub-workflow to run a file search query.

      • query_malops_sub_workflow
        CLI of the CDC, of query-malops in the CDC message thread.

      • query_process_on_machine_sub_workflow
        CLI of the CDC, of query-process-on-machine in the CDC message thread.

      • query_process_sub_workflow
        CLI of the CDC, of query-search-process in the CDC message thread.

      • query_user_sub_workflow
        CLI of the CDC, of query-user in the CDC message thread.

      • tenant_check_sub_workflow
        Check the type of tenant if a single tenant is activated, and then fetch the company name if not provided.

      • unprevent_file_sub_workflow
        Sub-workflow for unprevent file.

      Rules

      No rules

      Sensors

      • MalopsSensor
        Sensor that pulls malops (malwares) from Cybereason.

      Poll interval - 30s

      Triggers

      No triggers

      Known Issues

      • Cybereason API for add comment to malop does not validate if the provided malop guid is valid or invalid, so add_comment to malop will always return a success message even if the malop guid is invalid/does not exist in the system.
      • Cybereason API for update malop status does not validate if the provided malop guid is valid or invalid, so update_malop_status will always return a success message even if the malop guid is invalid/does not exist in the system.
      Was this article helpful?
      What's Next