cybereason-malops-legacy

Get a list of MalOps using the legacy API from the Cybereason server.

cybereason-malops-legacy [profile=VALUE] [duration=VALUE] [from=VALUE] [to=VALUE]

profile=VALUE: Optional. Cybereason connect profile identifier
duration=VALUE: Optional. Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=VALUE: Optional. Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=VALUE: Optional. End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.

Output Fields

Field	Type	Name	Description
profile	String	Connect profile	Cybereason connect profile identifier
malop_guid	String	MalOp GUID	Unique identifier of the MalOp
status	String	Status	MalOp status (Active, Remediated, Closed, Excluded)
display_name	String	Display name	Display name of the root cause element
created	Date	Creation time	MalOp creation time
updated	Date	Last update time	MalOp last update time
decision_statuses	String	Decision statuses	List of decision statuses
priority	String	Priority	MalOp priority level
risk	String	Risk	Severity level of the MalOp
detection_engines	String	Detection engines	List of detection engines
signatures	String	Signatures	List of detection signatures
signature	String	Signature	Primary detection signature
activity_type	String	Activity type	Type of detected activity
malop_type	String	MalOp type	List of IOCs (Indicators of Compromise)
root_cause_hash	String	Root cause hash	Hash values of root cause elements
root_cause_type	String	Root cause type	Type of root cause element
affected_machines	String	Affected machines	List of affected machines
affected_users	String	Affected users	List of affected users
labels	String	Labels	List of labels assigned to MalOp
close_admin	String	Closer name	Name of the administrator who closed the MalOp
group_id	String	Group ID	List of group identifiers
is_escalated	Boolean	Escalated	Whether the MalOp is escalated
is_edr	Boolean	Is EDR	Whether the MalOp is from EDR
icon_base64	String	Icon Base64	Base64 encoded icon image