cybereason-suspicions
Get a list of suspicions from the Cybereason server.
cybereason-suspicions [profile=VALUE] [duration=VALUE] [from=VALUE] [to=VALUE]
- profile=VALUE
- Optional. Cybereason connect profile identifier
- duration=VALUE
- Optional. Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10smeans data from 10 seconds earlier. - from=VALUE
- Optional. Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=VALUE
- Optional. End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Connect profile | Cybereason connect profile identifier |
| event_time | Date | Event time | Creation time of the suspicious event |
| end_time | Date | End time | End time of the suspicious event |
| process_name | String | Process name | Display name of the process |
| process_info | String | Process info | Detailed information about the process element |
| suspicions | String | Suspicions | Suspicion details and indicators |
| guid | String | GUID | Unique identifier of the suspicious element |
| is_malicious | Boolean | Is malicious | Whether the element is marked as malicious |
| is_suspect | Boolean | Is suspect | Whether the element is marked as suspect |
| is_malicious_verdict | Boolean | Is malicious verdict | Final verdict on whether the element is malicious |