cybereason-malops

Get a list of MalOps from the Cybereason server.

cybereason-malops [profile=VALUE] [duration=VALUE] [from=VALUE] [to=VALUE]

profile=VALUE: Optional. Cybereason connect profile identifier
duration=VALUE: Optional. Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=VALUE: Optional. Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=VALUE: Optional. End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.

Output Fields

Field	Type	Name	Description
profile	String	Connect profile	Cybereason connect profile identifier
malware_guid	String	Malware GUID	Unique identifier of the malware
file_name	String	File name	Display name of the malware file
created	Date	Creation time	MalOp creation time
updated	Date	Last update time	MalOp last update time
meta_updated	Date	Metadata update time	Metadata last update time
decision_statuses	String	Decision statuses	List of decision statuses
investigation_status	String	Investigation status	Current investigation status
status	String	Status	MalOp status
priority	String	Priority	MalOp priority level
risk	String	Risk	Severity level of the MalOp
detection_engines	String	Detection engines	List of detection engines
signatures	String	Signatures	List of detection signatures
signature	String	Signature	Primary detection signature
activity_type	String	Activity type	Type of detected activity
malop_type	String	MalOp type	List of IOCs (Indicators of Compromise)
mitre_tactics	String	MITRE tactics	List of MITRE ATT&CK tactics
mitre_techniques	String	MITRE techniques	List of MITRE ATT&CK techniques
mitre_sub_techniques	String	MITRE sub-techniques	List of MITRE ATT&CK sub-techniques
root_cause_hash	String	Root cause hash	Hash values of root cause elements
root_cause_type	String	Root cause type	Type of root cause element
affected_machines	String	Affected machines	List of affected machines
affected_users	String	Affected users	List of affected users
labels	String	Labels	List of labels assigned to MalOp
close_admin	String	Closer name	Name of the administrator who closed the MalOp
group_id	String	Group ID	List of group identifiers
is_escalated	Boolean	Escalated	Whether the MalOp is escalated
is_edr	Boolean	Is EDR	Whether the MalOp is from EDR
icon_base64	String	Icon Base64	Base64 encoded icon image