-
Notifications
You must be signed in to change notification settings - Fork 1.6k
/
BinalyzeAIR.yml
104 lines (104 loc) · 2.93 KB
/
BinalyzeAIR.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
commonfields:
id: Binalyze AIR
version: -1
name: Binalyze AIR
display: Binalyze AIR
category: Forensics & Malware Analysis
description: Collect your forensics data under 10 minutes.
configuration:
- display: Binalyze AIR Server URL
name: server
type: 0
required: true
additionalinfo: Binalyze AIR Server URL
- display: API Key
name: api_key
type: 4
required: true
additionalinfo: 'e.g.: api_1234567890abcdef1234567890abcdef'
- display: Trust any certificate (not secure)
name: insecure
type: 8
required: false
- display: Use system proxy settings
name: proxy
type: 8
required: false
script:
script: ''
type: python
commands:
- name: binalyze-air-isolate
arguments:
- name: hostname
required: true
description: Hostname of endpoint.
- name: organization_id
required: true
auto: PREDEFINED
predefined:
- '0'
- '1'
- '2'
description: Organization ID of the endpoint. For a custom organization ID, you can specify a custom value outside the predefined set.
- name: isolation
required: true
auto: PREDEFINED
predefined:
- enable
- disable
description: To isolate use enable.
outputs:
- contextPath: BinalyzeAIR.Isolate.result._id
description: Isolation unique task ID.
type: string
- contextPath: BinalyzeAIR.Isolate.result.name
description: Isolation task name.
type: string
- contextPath: BinalyzeAIR.Isolate.result.organizationId
description: Organization Id of endpoint.
type: number
description: Isolate an endpoint.
- name: binalyze-air-acquire
arguments:
- name: hostname
required: true
description: Hostname of endpoint.
- name: profile
required: true
auto: PREDEFINED
predefined:
- compromise-assessment
- browsing-history
- event-logs
- memory-ram-pagefile
- quick
- full
description: Acquisition profile. To use a custom acquisition profile, you can specify a custom profile outside the predefined set.
- name: case_id
required: true
description: ID for the case,e.g. C-2022-0001.
- name: organization_id
required: true
auto: PREDEFINED
predefined:
- '0'
- '1'
- '2'
description: Organization ID of the endpoint. For a custom organization ID, you can specify a custom value outside the predefined set.
outputs:
- contextPath: BinalyzeAIR.Acquire.result._id
description: Acquisition unique task ID.
type: string
- contextPath: BinalyzeAIR.Acquire.result.name
description: Acquisition task name.
type: string
- contextPath: BinalyzeAIR.Acquire.result.organizationId
description: Organization Id of endpoint.
type: number
description: Acquire evidence from an endpoint.
dockerimage: demisto/python3:3.10.13.80014
subtype: python3
fromversion: 6.2.0
tests:
- No tests (auto formatted)