cybereason-search-file
Search for files across sensors in the Cybereason server.
cybereason-search-file profile=VALUE [sensor-id=VALUE] [machine-name=VALUE] [file-name=VALUE] [path=VALUE] [min-size=VALUE] [max-size=VALUE] [created-after=VALUE] [created-before=VALUE] [modified-after=VALUE] [modified-before=VALUE] [poll-interval=VALUE] [poll-timeout=VALUE]
- profile=VALUE
- Required. Cybereason connect profile identifier
- sensor-id=VALUE
- Optional. Sensor ID (serverId:pylumId) to limit the search
- machine-name=VALUE
- Optional. Machine name (ContainsIgnoreCase) to limit the search
- file-name=VALUE
- Optional. File name to find (ContainsIgnoreCase)
- path=VALUE
- Optional. Folder path to search (StartsWith)
- min-size=VALUE
- Optional. Minimum file size in bytes
- max-size=VALUE
- Optional. Maximum file size in bytes
- created-after=VALUE
- Optional. File creation time lower bound (yyyyMMddHHmmss)
- created-before=VALUE
- Optional. File creation time upper bound (yyyyMMddHHmmss)
- modified-after=VALUE
- Optional. File modification time lower bound (yyyyMMddHHmmss)
- modified-before=VALUE
- Optional. File modification time upper bound (yyyyMMddHHmmss)
- poll-interval=VALUE
- Optional. Result poll interval in seconds (default 3)
- poll-timeout=VALUE
- Optional. Result poll timeout in seconds (default 300)
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Connect profile | Cybereason connect profile identifier |
| machine_name | String | Machine name | Machine name |
| machine_guid | String | Machine GUID | Machine GUID |
| pylum_id | String | Pylum ID | Pylum ID of the sensor |
| path | String | Path | Folder path of the file |
| file_name | String | File name | File name |
| created | Date | Created | File creation time |
| modified | Date | Modified | File modification time |
| size | Long | Size | File size in bytes |
| matched_yara_rules | String | Matched YARA rules | Names of matched YARA rules |