cybereason-reputations
Get a list of reputations from the Cybereason server.
cybereason-reputations [profile=VALUE] [order-by=VALUE] [order=VALUE] [malicious-type=VALUE] [reputation-type=VALUE] [key=VALUE] [extend=VALUE]
- profile=VALUE
- Optional. Cybereason connect profile identifier
- order-by=VALUE
- Optional. Column to sort by (key, first_seen, last_update, expiration, action, reputation_type, comment, owning_user)
- order=VALUE
- Optional. Sort order (asc, desc)
- malicious-type=VALUE
- Optional. Type of reputation (whitelist, blacklist)
- reputation-type=VALUE
- Optional. Type of item (file, domain, ip)
- key=VALUE
- Optional. The item key by which to search. You can enter a file hash value, IP address, or domain name.
- extend=VALUE
- Optional. Whether to use extended search. If true (or t), searches for keys containing the search term. If false (or f), only returns exact matches. You can use t/f or true/false. (default: false)
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Connect profile | Cybereason connect profile identifier |
| key | String | Key | Item key (file hash, IP address, or domain name) |
| reputation_type | String | Reputation Type | Type of reputation (FILE, DOMAIN, IP) |
| is_blocking | Boolean | Is Blocking | Whether the item is marked for blocking |
| malicious_type | String | Malicious Type | Reputation type (whitelist or blacklist) |
| comment | String | Comment | Comment added when the reputation was added |
| expiry | Date | Expiry | Expiration date for the reputation |
| user | String | User | Username who added the reputation |
| first_seen | Date | First Seen | Timestamp when the reputation was first added |
| updated | Date | Updated | Timestamp when the reputation was last updated |