Cybereason

Adds one or more sensors to a sensor group in Cybereason. A given sensor can only be a member of one group at a time.

Target: Cybereason integration target or HTTP Endpoint for "your-tenant.cybereason.net" with a path of "/rest"

Account Key: None if using an integration-provided target, authorization cookie if using an HTTP Endpoint target

Steps:
[] Build the request payload
[] Request to add the sensors
[] Check if the request was successful:
[]> If it was, make sure the sensors were actually added
[]> If it wasn't, output an error

More information about this API: https://nest.cybereason.com/documentation/api-documentation/all-versions/add-sensor-group

Cybereason - Add Sensors to Group

prod-nam

prod-eu

prod-apjc

Retrieves an authorization cookie from Cybereason. Fetching an authorization cookie is not necessary if you use an integration-provided Cybereason target.

Target: HTTP Endpoint for "your-tenant.cybereason.net" with no path

Account Key: None (uses a username and password provided as input)

Steps:
[] Request the authorization cookie
[] Check if the request was successful:
[]> If it was, extract the authorization cookie and set the output variable
[]> If it wasn't, output an error

More information about this API: https://nest.cybereason.com/documentation/api-documentation/all-versions/log-api

Cybereason - Get Authorization Cookie

Fetches the results of a live file search from Cybereason.

Target: Cybereason integration target or HTTP Endpoint for "your-tenant.cybereason.net" with a path of "/rest"

Account Key: None if using an integration-provided target, authorization cookie if using an HTTP Endpoint target

Steps:
[] Fetch the file search results for the batch ID provided
[] Check if the API request was successful:
[]> If it was, extract the search results and set the output variables
[]> If it wasn't, output an error

More information about this API: https://nest.cybereason.com/documentation/api-documentation/all-versions/get-results-live-file-search

Cybereason - Get Live File Search Results

Fetches a list of sensor groups from Cybereason.

Target: Cybereason integration target or HTTP Endpoint for "your-tenant.cybereason.net" with a path of "/rest"

Account Key: None if using an integration-provided target, authorization cookie if using an HTTP Endpoint target

Steps:
[] Request list of sensor groups
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API: https://nest.cybereason.com/documentation/api-documentation/all-versions/retrieve-sensor-groups

Cybereason - Get Sensor Groups

Sends a request to Cybereason to isolate a host by its Pylum ID. The Pylum ID can be retrieved with the "Search Sensors" atomic.

Target: Cybereason integration target or HTTP Endpoint for "your-tenant.cybereason.net" with a path of "/rest"

Account Key: None if using an integration-provided target, authorization cookie if using an HTTP Endpoint target

Steps:
[] Request to isolate the host
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API: https://nest.cybereason.com/documentation/api-documentation/all-versions/isolate-malop-machine

Cybereason - Isolate Host

Performs a live file search in Cybereason.

Target: Cybereason integration target or HTTP Endpoint for "your-tenant.cybereason.net" with a path of "/rest"

Account Key: None if using an integration-provided target, authorization cookie if using an HTTP Endpoint target

Steps:
[] Build the request payload
[] Perform live file search
[] Check if the request was successful:
[]> If it was, extract the file search results and set the output variables
[]> If it wasn't, output an error

More information about this API: https://nest.cybereason.com/documentation/api-documentation/all-versions/perform-live-file-search-request

Cybereason - Perform Live File Search

Removes one or more sensors from the sensor group they belong to in Cybereason. A given sensor can only be a member of one group at a time.

Target: Cybereason integration target or HTTP Endpoint for "your-tenant.cybereason.net" with a path of "/rest"

Account Key: None if using an integration-provided target, authorization cookie if using an HTTP Endpoint target

Steps:
[] Build the request payload
[] Request to remove the sensors
[] Check if the request was successful:
[]> If it was, make sure the sensors were actually removed
[]> If it wasn't, output an error

More information about this API: https://nest.cybereason.com/documentation/api-documentation/all-versions/remove-sensor-group

Cybereason - Remove Sensors from Group

Searches for matching sensors in Cybereason.

Target: Cybereason integration target or HTTP Endpoint for "your-tenant.cybereason.net" with a path of "/rest"

Account Key: None if using an integration-provided target, authorization cookie if using an HTTP Endpoint target

Steps:
[] Build the request payload
[] Search for sensors
[] Check if the request was successful:
[]> If it was, extract the Pylum ID for the first result and set the output variable
[]> If it wasn't, output an error

More information about this API: https://nest.cybereason.com/documentation/api-documentation/all-versions/query-sensors

Cybereason - Search Sensors

Updates the reputation of the provided IOC in Cybereason.

Target: Cybereason integration target or HTTP Endpoint for "your-tenant.cybereason.net" with a path of "/rest"

Account Key: None if using an integration-provided target, authorization cookie if using an HTTP Endpoint target

Steps:
[] Verify reputation type
[] Build the request payload
[] Request the IOC reputation changes
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API: https://nest.cybereason.com/documentation/api-documentation/all-versions/set-reputation

Cybereason - Set IOC Reputation

Sends a request to Cybereason to remove a host from isolation by its Pylum ID. The Pylum ID can be retrieved with the "Search Sensors" atomic.

Target: Cybereason integration target or HTTP Endpoint for "your-tenant.cybereason.net" with a path of "/rest"

Account Key: None if using an integration-provided target, authorization cookie if using an HTTP Endpoint target

Steps:
[] Build the request payload
[] Request to remove the host from isolation
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API: https://nest.cybereason.com/documentation/api-documentation/all-versions/remove-machine-isolation