Cynet
Cynet provides an all-in-one cybersecurity platform that automates threat detection, prevention, and response.
Cynet is a comprehensive security platform that provides advanced threat detection and response capabilities. The Cynet connector for Swimlane Turbine enables seamless integration with Cynet's security features, allowing users to automate critical security tasks such as file and user remediation, host isolation, and alert management. By leveraging this integration, Swimlane Turbine users can enhance their security operations with real-time threat containment and streamlined incident response, reducing manual intervention and improving overall security posture.
Prerequisites
Before you can use the Cynet connector for Turbine, you'll need access to the Cynet API. This requires the following:
- Authentication using Cynet New Asset:
- URL: The endpoint for accessing Cynet services.
- Access Key: A key provided by Cynet for API access.
- Secret Key: A secret associated with the access key for secure authentication.
- Client ID: An identifier for the client application.
- Authentication using Asset:
- URL: The endpoint for accessing Cynet services.
- Username: The username for logging into Cynet.
- Password: The password associated with the username.
- Client ID: An identifier for the client application.
Capabilities
The Cynet Connector has the following capabilities:
- Delete File by SHA256
- Get File Properties
- Get File Remediation Status
- Get Host Remediation Status
- Get Latest Alerts
- Get Latest Files
- Isolate Host
- Kill Process by File SHA256
- Quarantine File By Path
- Unisolate Host
- Update Alert Status
API Documentation Link
Additional Documentation
Configurations
Cynet Asset
Authenticates using username and password.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
username | User email. | string | Required |
password | Password | string | Required |
client_id | Client ID | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Cynet Access Token
Authenticates a user and generates an access token
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
accessKey | The Access-Key generated for your API user in the Cynet console. | string | Required |
secretKey | The Secret-Key generated for your API user in the Cynet console. | string | Required |
client_id | Client ID. | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Delete File by SHA256
Removes a file from an endpoint in Cynet using its SHA256 hash and provides a remediation ID for tracking.
Endpoint
- URL: /api/file/remediation/delete
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
sha256 | string | Optional | Gets or sets the SHA256. |
host | string | Optional | Gets or sets the host. |
Input Example
{"sha256":"string","host":"string"}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
remediation_items | array | Output field: remediation_items |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 27 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"remediation_items":[-9007199254740991]}}
Disable User
Disable a user account in Cynet using the provided JSON body.
Endpoint
- URL: /api/users/remediation/disable
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
host_or_domain | string | Optional | The host or domain to disable. |
username | string | Optional | The username to disable. |
Input Example
{"host_or_domain":"string","username":"Example Name"}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
remediation_items | array | It s a list of remediation items. |
Output Example
{"remediation_items":[123]}
Enable User
Enables a user in Cynet.
Endpoint
- URL: /api/users/remediation/enable
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
host_or_domain | string | Optional | The host or domain to enable. |
username | string | Optional | The username to enable. |
Input Example
{"host_or_domain":"string","username":"Example Name"}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
remediation_items | array | It s a list of remediation items. |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"remediation_items":[-9007199254740991]}}
Get File Properties
Retrieves a file's properties using its SHA256 hash, detailing its presence and related data on the endpoint.
Endpoint
- URL: /api/file
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.sha256 | string | Optional | File SHA256. |
Input Example
{"parameters":{"sha256":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
sha256 | string | Output field: sha256 |
md5 | string | Output field: md5 |
sha1 | string | Output field: sha1 |
ssdeep | string | Output field: ssdeep |
common_filename | string | Name of the resource |
common_path | string | Output field: common_path |
is_whitelisted | boolean | Output field: is_whitelisted |
av_detections | number | Output field: av_detections |
risk_level | number | Output field: risk_level |
alert_product_name | string | Name of the resource |
alert_severity_level | string | Output field: alert_severity_level |
imports_ntdll | boolean | Output field: imports_ntdll |
imports_winsock | boolean | Output field: imports_winsock |
imports_wininet | boolean | Output field: imports_wininet |
has_sockets | boolean | Output field: has_sockets |
has_autorun_occurances | boolean | Output field: has_autorun_occurances |
has_hidden_window_occurrences | boolean | Unique identifier |
has_program_files_folder_occurrences | boolean | Output field: has_program_files_folder_occurrences |
certificate_name | string | Name of the resource |
certificate_root_name | string | Name of the resource |
certificate_thumbprint | string | Output field: certificate_thumbprint |
first_seen | string | Output field: first_seen |
last_seen | string | Output field: last_seen |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 27 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"sha256":"string","md5":"string","sha1":"string","ssdeep":"string","common_filename":"string","common_path":"string","is_whitelisted":true,"av_detections":-2147483648,"risk_level":-2147483648,"alert_product_name":"string","alert_severity_level":"string","imports_ntdll":true,"imports_winsock":true,"imports_wininet":true,"has_sockets":tr...
Get File Remediation Status
Retrieve the current status of a file remediation action in Cynet using the unique 'id' parameter.
Endpoint
- URL: /api/file/remediation/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | number | Required | Remediation action ID. |
Input Example
{"path_parameters":{"id":-9007199254740991}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | number | Unique identifier |
status | number | Status value |
statusInfo | string | Status value |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 27 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"id":-9007199254740991,"status":0,"statusInfo":"string"}}
Get Host Details
Retrieves a host's details using its name.
Endpoint
- URL: /api/full/host
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.name | string | Optional | The name of the host to get properties for. |
Input Example
{"parameters":{"name":"Example Name"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
hostname | string | Name of the resource |
risk_level | number | Output field: risk_level |
operating_system | string | Output field: operating_system |
last_ms_update | string | Date value |
hd_serial | number | Output field: hd_serial |
last_scan | string | Output field: last_scan |
last_ip | string | Output field: last_ip |
last_mask | string | Output field: last_mask |
number_of_processes | number | Output field: number_of_processes |
number_of_logged_users | number | Output field: number_of_logged_users |
total_cpu_percentage | number | Output field: total_cpu_percentage |
system_partition_size | number | Output field: system_partition_size |
system_partition_free_space | number | Output field: system_partition_free_space |
total_memory | number | Output field: total_memory |
total_free_memory | number | Output field: total_free_memory |
memory_percentage | number | Output field: memory_percentage |
scanGroup | object | Output field: scanGroup |
scanGroup.ScanGroupName | string | Name of the resource |
scanGroup.DistributionType | string | Type of the resource |
scanGroup.PlatformType | string | Type of the resource |
Antivirus | object | Output field: Antivirus |
Antivirus.Status | string | Status value |
Antivirus.DatabaseDate | string | Response data |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 27 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"hostname":"string","risk_level":0,"operating_system":"string","last_ms_update":"2019-08-24T14:15:22Z","hd_serial":0,"last_scan":"2019-08-24T14:15:22Z","last_ip":"string","last_mask":"string","number_of_processes":0,"number_of_logged_users":0,"total_cpu_percentage":0,"system_partition_size":0,"system_partition_free_space":0,"total_memo...
Get Host Properties
Retrieves a host's properties using its name.
Endpoint
- URL: /api/host
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.name | string | Optional | The name of the host to get properties for. |
Input Example
{"parameters":{"name":"Example Name"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
hostname | string | Name of the resource |
risk_level | number | Output field: risk_level |
operating_system | string | Output field: operating_system |
last_ms_update | string | Date value |
hd_serial | number | Output field: hd_serial |
last_scan | string | Output field: last_scan |
last_ip | string | Output field: last_ip |
last_mask | string | Output field: last_mask |
number_of_processes | number | Output field: number_of_processes |
number_of_logged_users | number | Output field: number_of_logged_users |
total_cpu_percentage | number | Output field: total_cpu_percentage |
system_partition_size | number | Output field: system_partition_size |
system_partition_free_space | number | Output field: system_partition_free_space |
total_memory | number | Output field: total_memory |
total_free_memory | number | Output field: total_free_memory |
memory_percentage | number | Output field: memory_percentage |
scanGroup | object | Output field: scanGroup |
scanGroup.ScanGroupName | string | Name of the resource |
scanGroup.DistributionType | string | Type of the resource |
scanGroup.PlatformType | string | Type of the resource |
Antivirus | object | Output field: Antivirus |
Antivirus.Status | string | Status value |
Antivirus.DatabaseDate | string | Response data |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 27 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"hostname":"string","risk_level":-2147483648,"operating_system":"string","last_ms_update":"2019-08-24T14:15:22Z","hd_serial":-9007199254740991,"last_scan":"2019-08-24T14:15:22Z","last_ip":"string","last_mask":"string","number_of_processes":-2147483648,"number_of_logged_users":-2147483648,"total_cpu_percentage":-2147483648,"system_parti...
Get Host Remediation Status
Retrieve the current status of a remediation action for an endpoint in Cynet using the provided remediation action ID.
Endpoint
- URL: api/host/remediation/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | number | Required | Remediation action ID. |
Input Example
{"path_parameters":{"id":9007199254740991}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | number | Unique identifier |
status | number | Status value |
statusInfo | string | Status value |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":-9007199254740991,"status":0,"statusInfo":"string"}}
Get Latest Alerts
Retrieve the most recent alerts from Cynet with all associated properties, filtered by a specified time frame.
Endpoint
- URL: /api/alerts
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.LastSeen | string | Optional | Required format is YYYY-MM-DD hh:mm:ss. |
Input Example
{"parameters":{"LastSeen":"2024-01-25T10:03:02.684Z"}}
Output
Parameter | Type | Description |
|---|---|---|
SyncTimeUtc | string | Output field: SyncTimeUtc |
Entities | array | Output field: Entities |
Entities.ClientDbId | number | Unique identifier |
Entities.Uniqueness | string | Output field: Entities.Uniqueness |
Entities.IncidentName | string | Unique identifier |
Entities.IncidentDescription | string | Unique identifier |
Entities.IncidentJsonDescription | string | Unique identifier |
Entities.IncidentRecomendation | string | Unique identifier |
Entities.HostId | number | Unique identifier |
Entities.HostIp | string | Output field: Entities.HostIp |
Entities.HostName | string | Name of the resource |
Entities.ProductId | number | Unique identifier |
Entities.Sha256 | string | Output field: Entities.Sha256 |
Entities.Sha256Hex | string | Output field: Entities.Sha256Hex |
Entities.Path | string | Output field: Entities.Path |
Entities.CommandLine | string | Output field: Entities.CommandLine |
Entities.AlertIp | number | Output field: Entities.AlertIp |
Entities.AlertDomain | string | Output field: Entities.AlertDomain |
Entities.DomainId | number | Unique identifier |
Entities.AlertUrl | string | URL endpoint for the request |
Entities.UserId | number | Unique identifier |
Entities.UserName | string | Name of the resource |
Entities.Severity | number | Output field: Entities.Severity |
Entities.Status | number | Status value |
Entities.AlertType | number | Type of the resource |
Output Example
{"SyncTimeUtc":"2024-01-25T10:03:02.684Z","Entities":[{"ClientDbId":0,"Uniqueness":"","IncidentName":"","IncidentDescription":"","IncidentJsonDescription":"","IncidentRecomendation":"","HostId":0,"HostIp":"192.168.1.100","HostName":"","ProductId":0,"Sha256":"","Sha256Hex":"","Path":"","CommandLine":"","AlertIp":0}]}
Get Latest Files
Retrieve the most recently discovered files in the environment from a specified time.
Endpoint
- URL: /api/files
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.LastSeen | string | Optional | Required format is YYYY-MM-DD hh:mm:ss |
Input Example
{"parameters":{"LastSeen":"2019-08-24T14:15:22Z"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
SyncTimeUtc | string | Output field: SyncTimeUtc |
Entities | array | Output field: Entities |
Entities.ClientDbId | number | Unique identifier |
Entities.Sha256 | string | Output field: Entities.Sha256 |
Entities.CommonFileName | string | Name of the resource |
Entities.MetaProductName | string | Name of the resource |
Entities.Company | string | Output field: Entities.Company |
Entities.RiskLevel | number | Output field: Entities.RiskLevel |
Entities.EndPoints | number | Output field: Entities.EndPoints |
Entities.Antivirus | number | Output field: Entities.Antivirus |
Entities.VtRiskLevel | number | Output field: Entities.VtRiskLevel |
Entities.LastSeen | string | Output field: Entities.LastSeen |
Entities.DateIn | string | Output field: Entities.DateIn |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 27 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"SyncTimeUtc":"2019-08-24T14:15:22Z","Entities":[{}]}}
Get User Remediation Status
Retrieves the current status of a remediation action for an endpoint in Cynet using the provided remediation action ID.
Endpoint
- URL: api/user/remediation/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | number | Required | Remediation action ID. |
Input Example
{"path_parameters":{"id":9007199254740991}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | number | Unique identifier |
status | number | Status value |
statusInfo | string | Status value |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":-9007199254740991,"status":0,"statusInfo":"string"}}
Isolate Host
Isolate a specified host within the Cynet platform to contain threats and prevent lateral movement. Requires headers for authentication.
Endpoint
- URL: api/host/remediation/isolate
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
host | string | Optional | The name of the host to isolate. |
Input Example
{"json_body":{"host":"host_name"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Kill Process by File SHA256
Terminates a process on the host identified by its SHA-256 hash using Cynet.
Endpoint
- URL: /api/file/remediation/kill
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
sha256 | string | Optional | Gets or sets the SHA256. |
host | string | Optional | Gets or sets the host. |
Input Example
{"sha256":"string","host":"string"}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
remediation_items | array | Output field: remediation_items |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 27 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"remediation_items":[-9007199254740991]}}
Quarantine File By Path
Isolates a file on an endpoint by path and SHA256, returning a remediation ID for tracking.
Endpoint
- URL: /api/file/remediation/quarantine
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
sha256 | string | Optional | Gets or sets the SHA256. |
host | string | Optional | Gets or sets the host. |
Input Example
{"sha256":"string","host":"string"}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
remediation_items | array | Output field: remediation_items |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 27 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"remediation_items":[-9007199254740991]}}
Run Command On Host
Runs a command on a host in Cynet.
Endpoint
- URL: /api/host/remediation/runCommand
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
host | string | Optional | The host to run the command on. |
command | string | Optional | The command to run on the host. |
Input Example
{"host":"string","command":"string"}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
remediation_items | array | It's a list of remediation items. |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"remediation_items":[-9007199254740991]}}
Unisolate Host
Reconnects a previously isolated host to the network using Cynet.
Endpoint
- URL: api/host/remediation/unisolate
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
host | string | Optional | The name of the host to unisolate. |
Input Example
{"json_body":{"host":"host_name"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Update Alert Status
Updates an alert's status in Cynet for efficient incident management and response workflows, requiring a JSON body input.
Endpoint
- URL: /api/alerts/updateStatus
- Method: PUT
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
AlertDbId | number | Optional | It s a unique identifier assigned to an alert within a database. |
Status | number | Optional | 0=open, 1=pending, 2=ignored, 3=closed. |
Input Example
{"json_body":{"AlertDbId":0,"Status":0}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":true}
Response Headers
Header | Description | Example |
|---|---|---|
content-length | The length of the response body in bytes | 140 |
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 27 Jun 2024 20:37:23 GMT |