--- title: Cybereason slug: connectors/cybereason docTags: createdAt: 2026-06-09T16:30:05.337Z --- Cybereason is a cybersecurity platform that provides advanced endpoint protection and threat intelligence. Cybereason is a leading cybersecurity platform that provides comprehensive endpoint protection and threat intelligence. This connector allows Swimlane Turbine users to seamlessly integrate with Cybereason, enabling automated threat detection, response, and management. By leveraging Cybereason's capabilities, users can efficiently manage isolation rules, retrieve malicious operation data, and configure security modes across environments. This integration enhances security operations by automating complex tasks, reducing response times, and improving overall threat management efficiency. ### Limitations None to date. ### Supported Versions This Cybereason connector uses the latest version API. ## Configuration ### Prerequisites Before you can use the Cybereason connector for Turbine, you'll need access to the Cybereason API. This requires the following: - Custom authentication using the following parameters: - URL: The endpoint URL for accessing the Cybereason API. - Username: Your Cybereason account username. - Password: The password associated with your Cybereason account. ## Authentication Methods ### Custom Authentication: - URL: The base URL for your server, including port 8443, should be in the format https\:// :::Iframe{code=""} ::: :8443. - Username: Your Cybereason username. - Password: The password for your Cybereason username. ## Capabilities This Cybereason Connector provides the following capabilities: - Create an Isolation Rule - Delete an Isolation Rule - Get AI Hunting MalOps Only - Get All MalOps - Get All MalOps for Environments - Query Sensors - Retrieve a List of Isolation Rules - Retrieve All Malops of All Types - Set Anti-Malware Mode - Set Anti-Ransomware Mode - Start or Stop a Full or Quick Scan - Update an Isolation Rule ### Create an Isolation Rule - Creates an isolation exception rule. - You must have the L3 analyst or System Admin role assigned to use this request. Cybereason documentation for this action can be found [here](https://nest.cybereason.com/documentation/api-documentation/all-versions/create-isolation-exception-rule). ### Delete an Isolation Rule - Deletes an isolation exception rule. - You must have the L3 analyst or System Admin role assigned to use this request. Cybereason documentation for this action can be found [here](https://nest.cybereason.com/documentation/api-documentation/all-versions/delete-isolation-exception-rule). ### Get AI Hunting MalOps Only - Retrieve only the MalOps results from Cybereason's AI Hunting engine, using specified criteria in the JSON body. - When you are monitoring security threats in your environment, it is important to regularly view and respond to new or existing MalOps. The Cybereason API enables you to obtain a list of MalOps and see details about these malicious operations. Cybereason documentation for this action can be found [here](https://developer.atlassian.com/cloud/jira/service-desk/rest/api-group-request/#api-rest-servicedeskapi-request-post). ### Get All MalOps - Retrieve all malicious operation data from Cybereason, including details and status for analysis and response. Cybereason documentation for this action can be found [here](https://developer.atlassian.com/cloud/jira/service-desk/rest/api-group-request/#api-rest-servicedeskapi-request-post). ### Get All MalOps for Environments - Retrieve all Malicious Operations (MalOps) for environments using Cybereason's new Data Platform infrastructure. Cybereason documentation for this action can be found [here](https://developer.atlassian.com/cloud/jira/service-desk/rest/api-group-request/#api-rest-servicedeskapi-request-post). ### Query Sensors - Sends a request to return details on all or a selected group of sensors. - You are limited to retrieving 30,000 sensors in a single request. - You must be assigned the System Admin role, System Viewer, Policy Admin, Sensor Admin L1, or Sensor Viewer role (if your Cybereason environment uses sensor grouping) to send requests to this endpoint URL. Cybereason documentation for this action can be found [here](https://nest.cybereason.com/documentation/api-documentation/all-versions/query-sensors). ### Retrieve a List of Isolation Rules - Retrieves a list of all rules for isolating specific machines. - You must have the L3 analyst, System Admin, System Viewer, or Sensor Admin L1 role assigned to use this request. Cybereason documentation for this action can be found [here](https://nest.cybereason.com/documentation/api-documentation/all-versions/retrieve-isolation-exeption-rules). ### Retrieve All Malops of All Types - Returns details about all AI Hunt MalOps and Endpoint Protection MalOps in your environment. Cybereason documentation for this action can be found [here](https://nest.cybereason.com/documentation/api-documentation/all-versions/retrieve-all-malops-all-types-legacy). ### Set Anti-Malware Mode - Sets the Anti-Ransomware mode for all sensors or a group of filtered sensors. - You must be assigned the System Admin role, Policy Admin, or Sensor Admin L1 role (if your Cybereason environment uses sensor grouping) to send requests to this endpoint URL. Cybereason documentation for this action can be found [here](https://nest.cybereason.com/documentation/api-documentation/all-versions/set-anti-malware-mode). ### Set Anti-Ransomware Mode - Sets the Anti-Malware mode for all sensors or a group of filtered sensors. - You must be assigned the System Admin role, Policy Admin, or Sensor Admin L1 role (if your Cybereason environment uses sensor grouping) to send requests to this endpoint URL. Cybereason documentation for this action can be found [here](https://nest.cybereason.com/documentation/api-documentation/all-versions/set-anti-ransomware-mode). ### Start or Stop a Full or Quick Scan - Retrieve only the MalOps results from Cybereason's AI Hunting engine, using specified criteria in the JSON body. - When you are monitoring security threats in your environment, it is important to regularly view and respond to new or existing MalOps. The Cybereason API enables you to obtain a list of MalOps and see details about these malicious operations. Cybereason documentation for this action can be found [here](https://nest.cybereason.com/documentation/api-documentation/all-versions/start-or-stop-full-or-quick-scan). ### Update an Isolation Rule - Updates an isolation exception rule. - You must have the L3 analyst or System Admin role assigned to use this request. Cybereason documentation for this action can be found [here](https://nest.cybereason.com/documentation/api-documentation/all-versions/update-isolation-exception-rule). ### Notes ### Filter Field Example - The filters field allows users to apply specific conditions when querying data. Each filter consists of the following attributes: - fieldName: The name of the field to filter on (e.g., "outdated"). - operator: The comparison operator used for filtering (e.g., "Equals"). - values: An array of values to compare against (e.g., \["true"]). - Example: ```javascript "filters":[ { "fieldName": "outdated", "operator": "Equals", "values": ["true"] } ] ``` - For additional filter options, please check the action documentation under the request parameters section. ## Additional Documentation - [Cybereason Connector Documentation](https://docs.swimlane.com/connectors/cybereason) - [Cybereason API Documentation](https://nest.cybereason.com/documentation/api-documentation/all-versions/log-api) # Configurations ## Cybereason Custom Authentication Cybereason Custom Authentication using Username and Password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | -------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------ | | url | The base URL for your server, including port 8443, should be in the format https\://
:::Iframe{code=""} :::
:8443. | string | Required | | username | Your Cybereason username. | string | Required | | password | The password for your Cybereason username. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Create an Isolation Rule Create an isolation exception rule in Cybereason for a specified IP address. Requires an IP address string in the JSON body. ### Endpoint - **URL:** `/rest/settings/isolation-rule` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------- | | `ipAddress` | string | Optional | The IP address of the machine to which the rule applies. | | `ipAddressString` | string | Optional | The IP address of the machine to which the rule applies. | | `domain` | string | Optional | Domain. | | `port` | number | Optional | Optional if the ipAddressString parameter exists. The port by which Cybereason communicates with an isolated machine, according to the rule. | | `direction` | string | Optional | The direction of the allowed communication. | | `lastUpdated` | number | Optional | The epoch timestamp for the last update time for the rule. | | `blocking` | boolean | Optional | States whether communication with the given IP or port is allowed. Set to true if communication is blocked. | ### Input Example `{"json_body":{"ipAddress":"AQEBAQ==","ipAddressString":"1.1.1.1","domain":"localhost","port":443,"direction":"INCOMING","lastUpdated":1523873848045,"blocking":false}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `ruleId` | string | Unique identifier | | `ipAddress` | string | Output field: ipAddress | | `ipAddressString` | string | Output field: ipAddressString | | `domain` | string | Output field: domain | | `ports` | string | Output field: ports | | `direction` | string | Output field: direction | | `lastUpdated` | number | Output field: lastUpdated | | `groupIds` | array | Unique identifier | | `description` | string | Output field: description | | `lastUpdatedBy` | string | Output field: lastUpdatedBy | | `blocking` | boolean | Output field: blocking | ### Output Example `{"status_code":200,"response_headers":{"Strict-Transport-Security":"max-age=31536000;includeSubDomains","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store, must-revalidate","Vary":"Accept-Encoding","Content-Encoding":"gzip","Content-Type":"application/json","Content-Length":"205","Date":"Mon, 03 Feb 2025 10:41:08 GMT","Keep-Alive":"timeout=60","Connection":"keep-alive"},"reason":"","json_body":{"ruleId":"67a09d441cefd54a538189be","ipAddress":"AQEBAg==...` ## Delete an Isolation Rule Remove a specific isolation exception rule in Cybereason using the provided ruleId and lastUpdated values. ### Endpoint - **URL:** `/rest/settings/isolation-rule/delete` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------- | | `ruleId` | string | Optional | ID of Isolation Exception rule. | | `port` | number | Optional | Optional if the ipAddressString parameter exists. The port by which Cybereason communicates with an isolated machine, according to the rule. | | `blocking` | boolean | Optional | States whether communication with the given IP or port is allowed. Set to true if communication is blocked. | | `direction` | string | Optional | The direction of the allowed communication. | | `lastUpdated` | number | Optional | The epoch timestamp for the last update time for the rule. | | `ipAddressString` | string | Optional | The IP address of the machine to which the rule applies. | ### Input Example `{"json_body":{"ruleId":"5859b3d0ae8eeb920e9d2f4e","port":8443,"blocking":true,"direction":"all","lastUpdated":1525594605852,"ipAddressString":"1.1.1.1"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"status_code":200,"response_headers":{"Strict-Transport-Security":"max-age=31536000;includeSubDomains","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store, must-revalidate","Content-Length":"0","Date":"Mon, 03 Feb 2025 10:27:10 GMT","Keep-Alive":"timeout=60","Connection":"keep-alive"},"reason":"","response_text":""}` ## Get AI Hunting MalOps Only Retrieve only the MalOps results from Cybereason's AI Hunting engine using specified criteria. ### Endpoint - **URL:** `/rest/crimes/unified` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `totalResultLimit` | number | Optional | This parameter limits the total number of MalOps returned in the response. If you want to speed up the response time and limit the stress on your Servers, set this limit appropriately. | | `perGroupLimit` | number | Optional | In some responses, if the response contains a large number of similar responses, these items are grouped accordingly to help you aggregate and view the results in a more efficient way. | | `perFeatureLimit` | number | Optional | This is the number of responses for a specific feature. | | `templateContext` | string | Optional | Parameter for Get AI Hunting MalOps Only | | `queryPath` | array | Optional | Parameter for Get AI Hunting MalOps Only | | `queryPath.requestedType` | string | Optional | Type of the resource | | `queryPath.isResult` | boolean | Optional | Result of the operation | | `queryPath.filters` | array | Optional | Parameter for Get AI Hunting MalOps Only | | `queryPath.filters.facetName` | string | Optional | Name of the resource | | `queryPath.filters.filterType` | string | Optional | Type of the resource | | `queryPath.filters.values` | array | Optional | Value for the parameter | ### Input Example `{"totalResultLimit":123,"perGroupLimit":123,"perFeatureLimit":123,"templateContext":"string","queryPath":[{"requestedType":"string","isResult":true,"filters":[{"facetName":"Example Name","filterType":"string","values":[123]}]}]}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.resultIdToElementDataMap` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.hasRansomwareSuspendedProcesses` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.decisionFeature` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.rootCauseElementCompanyProduct` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.malopStartTime` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.detectionType` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.malopActivityTypes` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.elementDisplayName` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.creationTime` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.isBlocked` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.rootCauseElementTypes` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.rootCauseElementNames` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.malopLastUpdateTime` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.allRansomwareProcessesSuspended` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.rootCauseElementHashes` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.managementStatus` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.closeTime` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.closerName` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.simpleValues.customClassification` | object | Response data | | `data.resultIdToElementDataMap.11.5133381726858807240.elementValues` | object | Response data | ### Output Example `{"data":{"resultIdToElementDataMap":{"11.5133381726858807240":{},"11.-3698575578138794465":{}},"suspicionsMap":{},"evidenceMap":{},"totalResults":123,"totalPossibleResults":123,"guessedPossibleResults":123,"queryLimits":{"totalResultLimit":123,"perGroupLimit":123,"perFeatureLimit":123,"groupingFeature":{},"sortInGroupFeature":{}},"queryTerminated":true,"pathResultCounts":[{}],"guids":["string"],"paginationToken":{},"executionUUID":"string","quapiMeasurementData":{"timeToGetGuids":[],"timeToGetDa...` ## Get All MalOps Gather comprehensive malicious operation data from Cybereason, providing essential details for analysis and incident response. ### Endpoint - **URL:** `/rest/detection/inbox` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `startTime` | number | Optional | Time value | | `endTime` | number | Optional | Time value | ### Input Example `{"json_body":{"startTime":1581621505486,"endTime":1582226305530}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | ----------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `malops` | array | Output field: malops | | `machineCounterModel` | object | Output field: machineCounterModel | | `machineCounterModel.totalMachines` | number | Output field: machineCounterModel.totalMachines | | `machineCounterModel.onlineInfectedCount` | number | Count value | | `machineCounterModel.onlineCleanCount` | number | Count value | | `machineCounterModel.offlineInfectedCount` | number | Count value | | `machineCounterModel.offlineCleanCount` | number | Count value | ### Output Example `{"status_code":200,"response_headers":{"Strict-Transport-Security":"max-age=31536000;includeSubDomains","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store, must-revalidate","Vary":"Accept-Encoding","Content-Encoding":"gzip","Content-Type":"application/json","Content-Length":"113","Date":"Mon, 03 Feb 2025 09:59:43 GMT","Keep-Alive":"timeout=60","Connection":"keep-alive"},"reason":"","json_body":{"malops":[],"machineCounterModel":{"totalMachines":475,"o...` ## Get All MalOps for Environments Retrieve all Malicious Operations (MalOps) across environments from Cybereason's Data Platform infrastructure. ### Endpoint - **URL:** `/rest/mmng/v2/malops` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | --------------------------------------------- | | `search` | object | Optional | Parameter for Get All MalOps for Environments | | `search.malop` | object | Optional | Parameter for Get All MalOps for Environments | | `search.malop.guid` | string | Optional | Unique identifier | | `range` | object | Optional | Parameter for Get All MalOps for Environments | | `range.from` | number | Optional | Parameter for Get All MalOps for Environments | | `range.to` | number | Optional | Parameter for Get All MalOps for Environments | | `pagination` | object | Optional | Parameter for Get All MalOps for Environments | | `pagination.pageSize` | number | Optional | Parameter for Get All MalOps for Environments | | `pagination.offset` | number | Optional | Parameter for Get All MalOps for Environments | | `federation` | object | Optional | Parameter for Get All MalOps for Environments | | `federation.groups` | array | Optional | Parameter for Get All MalOps for Environments | | `sort` | array | Optional | Parameter for Get All MalOps for Environments | | `sort.field` | string | Optional | Parameter for Get All MalOps for Environments | | `sort.order` | string | Optional | Parameter for Get All MalOps for Environments | ### Input Example `{"json_body":{"search":{"malop":{"guid":"TklJfBCi55eyTiwX"}},"range":{"from":0,"to":1687803548337},"pagination":{"pageSize":50,"offset":0},"federation":{"groups":[]},"sort":[{"field":"LastUpdateTime","order":"desc"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.pageSize` | number | Response data | | `data.pages` | number | Response data | | `data.offset` | number | Response data | | `data.totalHits` | number | Response data | | `data.token` | string | Response data | | `data.data` | array | Response data | | `data.data.guid` | string | Response data | | `data.data.displayName` | string | Response data | | `data.data.creationTime` | number | Response data | | `data.data.lastUpdateTime` | number | Response data | | `data.data.metadataUpdateTime` | number | Response data | | `data.data.decisionStatuses` | array | Response data | | `data.data.detectionEngines` | array | Response data | | `data.data.mitreTactics` | array | Response data | | `data.data.mitreTechniques` | array | Response data | | `data.data.mitreSubTechniques` | array | Response data | | `data.data.rootCauseElementHashes` | array | Response data | | `data.data.iocs` | array | Response data | | `data.data.detectionTypes` | array | Response data | | `data.data.labels` | array | Response data | | `data.data.investigationStatus` | string | Response data | | `data.data.closerName` | object | Response data | ### Output Example `{"data":{"pageSize":123,"pages":123,"offset":123,"totalHits":123,"token":"string","data":[{}]},"status":"active"}` ## Query Sensors Retrieve a specific subset of sensor details from Cybereason using limit and offset parameters, with a maximum of 30,000 sensors. ### Endpoint - **URL:** `/rest/sensors/query` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `limit` | number | Optional | The number of sensors to return in the list of sensors for the response. The maximum limit for this parameter is 30,000. | | `offset` | number | Optional | The position in the list of sensors on which to start retrieving sensors. For example, if you set the limit parameter to 100, if you set the offset parameter to 1, the list of sensors returned will begin with the sensor in the position 101 in the list. Set to 0 to receive the first limit set of sensors. | | `sortDirection` | string | Optional | The order in which to receive results. Valid values are ASC (ascending) or DESC (descending). | | `filters` | array | Optional | An object containing details on the filter to apply to return a select group of sensors. See Readme for more details. | | `filters.fieldName` | string | Optional | Name of the resource | | `filters.operator` | string | Optional | Use the following operators with the respective filters object, depending on the parameter you use in the filters object. | | `filters.values` | array | Optional | Value for the parameter | ### Input Example `{"json_body":{"limit":1000,"offset":0,"sortDirection":"ASC","filters":[{"fieldName":"osType","operator":"Equals","values":["WINDOWS","LINUX"]}]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | --------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `totalResults` | number | Result of the operation | | `sensorsStatus` | object | Status value | | `sensorsStatus.@class` | string | Status value | | `sensorsStatus.onlineCount` | number | Status value | | `sensorsStatus.offlineCount` | number | Status value | | `sensorsStatus.staleCount` | number | Status value | | `sensorsStatus.archivedCount` | number | Status value | | `sensorsStatus.turnedOnCount` | number | Status value | | `sensorsStatus.turnedOffCount` | number | Status value | | `sensorsStatus.suspendedCount` | number | Status value | | `sensorsStatus.advancedCount` | number | Status value | | `sensorsStatus.outdatedCount` | number | Status value | | `sensorsStatus.serviceErrorCount` | number | Status value | | `sensors` | array | Output field: sensors | | `sensors.sensorId` | string | Unique identifier | | `sensors.pylumId` | string | Unique identifier | | `sensors.guid` | string | Unique identifier | | `sensors.fqdn` | string | Output field: sensors.fqdn | | `sensors.machineName` | string | Name of the resource | | `sensors.internalIpAddress` | string | Output field: sensors.internalIpAddress | | `sensors.externalIpAddress` | string | Output field: sensors.externalIpAddress | | `sensors.siteName` | string | Name of the resource | | `sensors.siteId` | number | Unique identifier | ### Output Example `{"totalResults":123,"sensorsStatus":{"@class":"string","onlineCount":123,"offlineCount":123,"staleCount":123,"archivedCount":123,"turnedOnCount":123,"turnedOffCount":123,"suspendedCount":123,"advancedCount":123,"outdatedCount":123,"serviceErrorCount":123},"sensors":[{"sensorId":"string","pylumId":"string","guid":"string","fqdn":"string","machineName":"Example Name","internalIpAddress":"string","externalIpAddress":"string","siteName":"Example Name","siteId":123,"ransomwareStatus":"active","preven...` ## Retrieve a List of Isolation Rules Retrieve a comprehensive list of isolation rules configured within the Cybereason platform. ### Endpoint - **URL:** `/rest/settings/isolation-rule` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-cache, no-store, must-revalidate","Strict-Transport-Security":"max-age=31536000;includeSubDomains","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Vary":"Accept-Encoding","Content-Encoding":"gzip","Content-Type":"application/json","Content-Length":"1049","Date":"Mon, 03 Feb 2025 10:17:37 GMT","Keep-Alive":"timeout=60","Connection":"keep-alive"},"reason":"","json_body":[{"ruleId":"5e859886e4b0ce8c6bed5012","ipAddress":"NDvlyw...` ## Retrieve All Malops of All Types Retrieve all AI Hunt and Endpoint Protection MalOps from Cybereason within a specified time range using startTime and endTime parameters. ### Endpoint - **URL:** `/rest/detection/inbox` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | | `startTime` | number | Optional | The beginning time (in milliseconds) from which you want to retrieve MalOp that were active (both created and updated). | | `endTime` | number | Optional | The ending time (in milliseconds) to which you want to retrieve MalOps (both created and updated). | | `groupIds` | string | Optional | The group ID(s) if the sensors from which you want to retrieve MalOps. (From version 21.1.21 and later, for SOC Federation customers only). | ### Input Example `{"json_body":{"startTime":1581621505486,"endTime":1582226305530,"groupIds":"00000000-0000-0000-0000-000000000000"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `malops` | array | Output field: malops | | `malops.guid` | string | Unique identifier | | `malops.status` | string | Status value | | `malops.displayName` | string | Name of the resource | | `malops.rootCauseElementType` | string | Type of the resource | | `malops.rootCauseElementNamesCount` | number | Name of the resource | | `malops.detectionEngines` | array | Output field: malops.detectionEngines | | `malops.detectionTypes` | array | Type of the resource | | `malops.malopDetectionType` | string | Type of the resource | | `malops.machines` | array | Output field: malops.machines | | `malops.machines.guid` | string | Unique identifier | | `malops.machines.displayName` | string | Name of the resource | | `malops.machines.osType` | string | Type of the resource | | `malops.machines.connected` | boolean | Output field: malops.machines.connected | | `malops.machines.isolated` | boolean | Output field: malops.machines.isolated | | `malops.machines.lastConnected` | number | Output field: malops.machines.lastConnected | | `malops.users` | array | Output field: malops.users | | `malops.users.guid` | string | Unique identifier | | `malops.users.displayName` | string | Name of the resource | | `malops.users.admin` | boolean | Output field: malops.users.admin | | `malops.users.localSystem` | boolean | Output field: malops.users.localSystem | | `malops.users.domainUser` | boolean | Output field: malops.users.domainUser | | `malops.creationTime` | number | Time value | ### Output Example `{"status_code":200,"response_headers":{"Strict-Transport-Security":"max-age=31536000;includeSubDomains","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store, must-revalidate","Vary":"Accept-Encoding","Content-Encoding":"gzip","Content-Type":"application/json","Content-Length":"113","Date":"Mon, 03 Feb 2025 05:23:13 GMT","Keep-Alive":"timeout=60","Connection":"keep-alive"},"reason":"","json_body":{"malops":[{}],"machineCounterModel":{"totalMachines":104,...` ## Set Anti-Malware Mode Configure the Anti-Malware mode across Cybereason sensors using the 'argument' parameter for detailed settings. ### Endpoint - **URL:** `/rest/sensors/action/set-antimalware-status` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | | `sensorsIds` | array | Optional | Add the unique pylum ID string value used for the sensor in the sensors IDs. | | `filters` | array | Optional | An object containing details on the filter to apply to return a select group of sensors. See Readme for more details. | | `filters.fieldName` | string | Optional | Name of the resource | | `filters.operator` | string | Optional | Use the following operators with the respective filters object, depending on the parameter you use in the filters object. | | `filters.values` | array | Optional | Value for the parameter | | `argument` | object | Optional | Parameter for Set Anti-Malware Mode | | `argument.amMode` | string | Required | Setting for the general Anti-Malware mode. Possible values include DISABLED, ENABLED, SET\_BY\_POLICY. | | `argument.avMode` | string | Required | The setting for the Anti-Malware Signatures mode. Possible values include DISABLED, DETECT, DISINFECT, SET\_BY\_POLICY. | | `argument.aiDetectMode` | string | Required | The setting for the AI (Artificial Intelligence) Detect mode. Possible values include DISABLED, CAUTIOUS, MODERATE, AGGRESSIVE, SET\_BY\_POLICY. | | `argument.aiPreventMode` | string | Required | The setting for the AI Prevent mode. Possible values include DISABLED, CAUTIOUS, MODERATE, AGGRESSIVE. | ### Input Example `{"json_body":{"sensorsIds":["58ae74fae4b06dca39c1d4bc:PYLUMCLIENT_INTERNAL_CYBERDEMO7X64_005056A13A24"],"filters":[{"fieldName":"osType","operator":"Equals","values":["WINDOWS","LINUX"]}],"argument":{"amMode":"DISABLED","avMode":"DISABLED","aiDetectMode":"DISABLED","aiPreventMode":"DISABLED"}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `batchId` | number | Unique identifier | | `actionType` | string | Type of the resource | | `actionArguments` | object | Output field: actionArguments | | `actionArguments.@class` | string | Output field: actionArguments.\@class | | `actionArguments.configurationItemList` | array | Output field: actionArguments.configurationItemList | | `actionArguments.configurationItemList.type` | string | Type of the resource | | `actionArguments.configurationItemList.name` | string | Name of the resource | | `actionArguments.configurationItemList.lastUpdated` | number | Output field: actionArguments.configurationItemList.lastUpdated | | `actionArguments.configurationItemList.modelsConfiguration` | array | Output field: actionArguments.configurationItemList.modelsConfiguration | | `actionArguments.configurationItemList.modelsConfiguration.detectThresholdsMap` | object | Output field: actionArguments.configurationItemList.modelsConfiguration.detectThresholdsMap | | `actionArguments.configurationItemList.modelsConfiguration.detectThresholdsMap.DISABLED` | number | Output field: actionArguments.configurationItemList.modelsConfiguration.detectThresholdsMap.DISABLED | | `actionArguments.configurationItemList.modelsConfiguration.detectThresholdsMap.CAUTIOUS` | number | Output field: actionArguments.configurationItemList.modelsConfiguration.detectThresholdsMap.CAUTIOUS | | `actionArguments.configurationItemList.modelsConfiguration.detectThresholdsMap.MODERATE` | number | Output field: actionArguments.configurationItemList.modelsConfiguration.detectThresholdsMap.MODERATE | | `actionArguments.configurationItemList.modelsConfiguration.detectThresholdsMap.AGGRESSIVE` | number | Output field: actionArguments.configurationItemList.modelsConfiguration.detectThresholdsMap.AGGRESSIVE | | `actionArguments.configurationItemList.modelsConfiguration.preventThresholdsMap` | object | Output field: actionArguments.configurationItemList.modelsConfiguration.preventThresholdsMap | | `actionArguments.configurationItemList.modelsConfiguration.preventThresholdsMap.DISABLED` | number | Output field: actionArguments.configurationItemList.modelsConfiguration.preventThresholdsMap.DISABLED | | `actionArguments.configurationItemList.modelsConfiguration.preventThresholdsMap.CAUTIOUS` | number | Output field: actionArguments.configurationItemList.modelsConfiguration.preventThresholdsMap.CAUTIOUS | | `actionArguments.configurationItemList.modelsConfiguration.preventThresholdsMap.MODERATE` | number | Output field: actionArguments.configurationItemList.modelsConfiguration.preventThresholdsMap.MODERATE | | `actionArguments.configurationItemList.modelsConfiguration.preventThresholdsMap.AGGRESSIVE` | number | Output field: actionArguments.configurationItemList.modelsConfiguration.preventThresholdsMap.AGGRESSIVE | | `actionArguments.configurationItemList.modelsConfiguration.modelId` | string | Unique identifier | | `actionArguments.configurationItemList.modelsConfiguration.reportThreshold` | number | Output field: actionArguments.configurationItemList.modelsConfiguration.reportThreshold | | `actionArguments.configurationItemList.detectSensitivityLevel` | string | Output field: actionArguments.configurationItemList.detectSensitivityLevel | | `actionArguments.configurationItemList.preventSensitivityLevel` | string | Output field: actionArguments.configurationItemList.preventSensitivityLevel | ### Output Example `{"batchId":123,"actionType":"string","actionArguments":{"@class":"string","configurationItemList":[{}]},"globalStats":{"stats":{"Started":123,"Primed":123,"EndedWithInvalidParam":123,"Timeout":123,"Disconnected":123,"TimeoutSending":123,"Succeeded":123,"NotSupported":123,"ChunksRequired":123,"Pending":123,"GettingChunks":123,"None":123,"AbortTimeout":123,"UnknownProbe":123,"FailedSending":123}},"finalState":true,"totalNumberOfProbes":123,"initiatorUser":"string","startTime":123,"aborterUser":"st...` ## Set Anti-Ransomware Mode Configure the Anti-Ransomware mode on Cybereason sensors or a specific group using the provided argument. ### Endpoint - **URL:** `/rest/sensors/action/setRansomwareMode` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- | | `sensorsIds` | array | Optional | Add the unique pylum ID string value used for the sensor in the sensors IDs. | | `filters` | array | Optional | An object containing details on the filter to apply to return a select group of sensors. See Readme for more details. | | `filters.fieldName` | string | Optional | Name of the resource | | `filters.operator` | string | Optional | Use the following operators with the respective filters object, depending on the parameter you use in the filters object. | | `filters.values` | array | Optional | Value for the parameter | | `argument` | string | Optional | Possible values include DISABLE, DETECTION\_ONLY, SUSPEND, REMEDIATE and DEFAULT. The DEFAULT value is supported only for versions 17.5 and later. | ### Input Example `{"json_body":{"sensorsIds":["58ae74fae4b06dca39c1d4bc:PYLUMCLIENT_INTERNAL_CYBERSETUP7X64_005056A13A24"],"filters":[{"fieldName":"osType","operator":"Equals","values":["WINDOWS","LINUX"]}],"argument":"SUSPEND"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | ------------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `batchId` | number | Unique identifier | | `actionType` | string | Type of the resource | | `actionArguments` | array | Output field: actionArguments | | `globalStats` | object | Output field: globalStats | | `globalStats.stats` | object | Output field: globalStats.stats | | `globalStats.stats.FailedSending` | number | Output field: globalStats.stats.FailedSending | | `globalStats.stats.InvalidState` | number | Unique identifier | | `globalStats.stats.ProbeRemoved` | number | Output field: globalStats.stats.ProbeRemoved | | `globalStats.stats.TimeoutSending` | number | Output field: globalStats.stats.TimeoutSending | | `globalStats.stats.Pending` | number | Output field: globalStats.stats.Pending | | `globalStats.stats.ChunksRequired` | number | Output field: globalStats.stats.ChunksRequired | | `globalStats.stats.MsiFileCorrupted` | number | Output field: globalStats.stats.MsiFileCorrupted | | `globalStats.stats.SendingMsi` | number | Output field: globalStats.stats.SendingMsi | | `globalStats.stats.NewerInstalled` | number | Output field: globalStats.stats.NewerInstalled | | `globalStats.stats.MsiSendFail` | number | Output field: globalStats.stats.MsiSendFail | | `globalStats.stats.partialResponse` | number | Output field: globalStats.stats.partialResponse | | `globalStats.stats.EndedWithSensorTimeout` | number | Output field: globalStats.stats.EndedWithSensorTimeout | | `globalStats.stats.FailedSendingToServer` | number | Output field: globalStats.stats.FailedSendingToServer | | `globalStats.stats.GettingChunks` | number | Output field: globalStats.stats.GettingChunks | | `globalStats.stats.Aborted` | number | Output field: globalStats.stats.Aborted | | `globalStats.stats.Started` | number | Output field: globalStats.stats.Started | | `globalStats.stats.InProgress` | number | Output field: globalStats.stats.InProgress | | `globalStats.stats.Disconnected` | number | Output field: globalStats.stats.Disconnected | ### Output Example `{"status_code":200,"response_headers":{"Strict-Transport-Security":"max-age=31536000;includeSubDomains","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store, must-revalidate","Vary":"Accept-Encoding","Content-Encoding":"gzip","Content-Type":"application/json","Content-Length":"2371","Date":"Mon, 03 Feb 2025 07:16:22 GMT","Keep-Alive":"timeout=60","Connection":"keep-alive"},"reason":"","json_body":{"batchId":1305541032,"actionType":"SetRansomewareMode","...` ## Start or Stop a Full or Quick Scan Initiate or halt a full or quick scan on Cybereason sensors for all, groups, or specific targets. Requires JSON body with argument. ### Endpoint - **URL:** `/rest/sensors/action/schedulerScan` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------- | | `sensorsIds` | array | Optional | Add the unique pylum ID string value used for the sensor in the sensors IDs. | | `filters` | array | Optional | An object containing details on the filter to apply to return a select group of sensors. See Readme for more details. | | `filters.fieldName` | string | Optional | Name of the resource | | `filters.operator` | string | Optional | Use the following operators with the respective filters object, depending on the parameter you use in the filters object. | | `filters.values` | array | Optional | Value for the parameter | | `argument` | string | Optional | Possible values include FULL, QUICK, STOP. | ### Input Example `{"json_body":{"sensorsIds":["611cb44ee4b0ad9947dd34fd:PYLUMCLIENT_INTERNAL_BB-W10-19H2_005056A63271"],"filters":[{"fieldName":"osType","operator":"Equals","values":["WINDOWS","LINUX"]}],"argument":"QUICK"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------- | -------- | --------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `batchId` | number | Unique identifier | | `actionType` | string | Type of the resource | | `actionArguments` | array | Output field: actionArguments | | `globalStats` | object | Output field: globalStats | | `globalStats.stats` | object | Output field: globalStats.stats | | `globalStats.stats.ChunksRequired` | number | Output field: globalStats.stats.ChunksRequired | | `globalStats.stats.Succeeded` | number | Output field: globalStats.stats.Succeeded | | `globalStats.stats.ProbeRemoved` | number | Output field: globalStats.stats.ProbeRemoved | | `globalStats.stats.EndedWithTooManyResults` | number | Result of the operation | | `globalStats.stats.FailedSending` | number | Output field: globalStats.stats.FailedSending | | `globalStats.stats.TimeoutSending` | number | Output field: globalStats.stats.TimeoutSending | | `globalStats.stats.UnknownProbe` | number | Output field: globalStats.stats.UnknownProbe | | `globalStats.stats.FailedSendingToServer` | number | Output field: globalStats.stats.FailedSendingToServer | | `globalStats.stats.SendingPlatform` | number | Output field: globalStats.stats.SendingPlatform | | `globalStats.stats.BadArgument` | number | Output field: globalStats.stats.BadArgument | | `globalStats.stats.EndedWithSensorTimeout` | number | Output field: globalStats.stats.EndedWithSensorTimeout | | `globalStats.stats.UninstallerLaunchFailure` | number | Output field: globalStats.stats.UninstallerLaunchFailure | | `globalStats.stats.Aborting` | number | Output field: globalStats.stats.Aborting | | `globalStats.stats.OsNotSupportedForUninstallation` | number | Output field: globalStats.stats.OsNotSupportedForUninstallation | | `globalStats.stats.MsiFileCorrupted` | number | Output field: globalStats.stats.MsiFileCorrupted | | `globalStats.stats.UpgradePackageDownloaded` | number | Output field: globalStats.stats.UpgradePackageDownloaded | | `globalStats.stats.None` | number | Output field: globalStats.stats.None | | `globalStats.stats.MissingPackageFromFileSystem` | number | Output field: globalStats.stats.MissingPackageFromFileSystem | ### Output Example `{"status_code":200,"response_headers":{"Strict-Transport-Security":"max-age=31536000;includeSubDomains","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store, must-revalidate","Vary":"Accept-Encoding","Content-Encoding":"gzip","Content-Type":"application/json","Content-Length":"660","Date":"Mon, 03 Feb 2025 09:44:40 GMT","Keep-Alive":"timeout=60","Connection":"keep-alive"},"reason":"","json_body":{"batchId":458665084,"actionType":"SchedulerScan","actionA...` ## Update an Isolation Rule Update an existing isolation exception rule in Cybereason using the specified rule ID, IP address, and timestamp. ### Endpoint - **URL:** `/rest/settings/isolation-rule` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------- | | `ruleId` | string | Optional | A unique identifier for the rule. | | `ipAddressString` | string | Optional | The IP address of the machine to which the rule applies. | | `port` | number | Optional | Optional if the ipAddressString parameter exists. The port by which Cybereason communicates with an isolated machine, according to the rule. | | `direction` | string | Optional | The direction of the allowed communication. | | `lastUpdated` | number | Optional | The epoch timestamp for the last update time for the rule. | | `blocking` | boolean | Optional | States whether communication with the given IP or port is allowed. Set to true if communication is blocked. | ### Input Example `{"json_body":{"ruleId":"5859b3d0ae8eeb920e9d2f4e","ipAddressString":"1.1.1.1","port":443,"direction":"INCOMING","lastUpdated":1523873848045,"blocking":false}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `ruleId` | string | Unique identifier | | `ipAddress` | string | Output field: ipAddress | | `ipAddressString` | string | Output field: ipAddressString | | `domain` | string | Output field: domain | | `ports` | string | Output field: ports | | `direction` | string | Output field: direction | | `lastUpdated` | number | Output field: lastUpdated | | `groupIds` | array | Unique identifier | | `description` | string | Output field: description | | `lastUpdatedBy` | string | Output field: lastUpdatedBy | | `blocking` | boolean | Output field: blocking | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-cache, no-store, must-revalidate","Strict-Transport-Security":"max-age=31536000;includeSubDomains","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff","Vary":"Accept-Encoding","Content-Encoding":"gzip","Content-Type":"application/json","Content-Length":"203","Date":"Mon, 03 Feb 2025 11:23:59 GMT","Keep-Alive":"timeout=60","Connection":"keep-alive"},"reason":"","json_body":{"ruleId":"67a09d441cefd54a538189be","ipAddress":"AQEBAg==...` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ----------------------------------------------------- | ----------------------------------- | | Cache-Control | Directives for caching mechanisms | no-cache, no-store, must-revalidate | | Connection | HTTP response header: Connection | keep-alive | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Length | The length of the response body in bytes | 660 | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Mon, 03 Feb 2025 10:41:08 GMT | | duration | HTTP response header: duration | 198 | | Keep-Alive | HTTP response header: Keep-Alive | timeout=60 | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000;includeSubDomains | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | Vary | HTTP response header: Vary | Accept-Encoding | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Frame-Options | HTTP response header: X-Frame-Options | DENY |