Fireeye

FireEye is a cybersecurity platform that provides advanced threat protection and intelligence solutions.

FireEye is a leading cybersecurity platform that provides advanced threat protection and intelligence. The FireEye connector for Swimlane Turbine enables seamless integration with FireEye's robust security operations, allowing users to automate alert management, email quarantine actions, and threat intelligence retrieval. By integrating FireEye with Swimlane Turbine, security teams can enhance their incident response capabilities, streamline threat analysis, and improve overall security posture through automated workflows.

Prerequisites

Before you can use the FireEye connector for Turbine, you'll need access to the FireEye API. This requires the following:

HTTP Basic authentication using the following parameters:

URL: The endpoint URL for accessing the FireEye API.

Username: Your FireEye account username.

Password: Your FireEye account password.

Asset Configuration

This connector requires a Username and a Password for secure communication with the FireEye appliances. It uses basic HTTP authentication, a widely-adopted method that ensures secure interactions with your FireEye systems.

Functionalities

The FireEye connector provides a comprehensive set of functionalities:

Acknowledge Alert: Allows for acknowledgment and recording of alerts for potential security threats.

Delete Quarantined Email: Enables safe removal of emails in quarantine, maintaining the integrity of your communication systems.

Download Quarantined Email: Provides the ability to retrieve quarantined emails for further review or analysis.

Get Alert Details: Grants access to detailed information about alerts, aiding effective response to security incidents.

Get Alerts: Facilitates monitoring and retrieval of alerts, keeping you updated on security issues.

Get Artifact: Permits access to specific artifacts, such as files or documents, pertaining to potential security issues.

Get Artifact Metadata: Allows retrieval of metadata about an artifact, providing more context about potential security incidents.

Get Events: Assists in tracking and obtaining event data for monitoring activities and potential security threats.

Get Quarantined Emails: Allows access to quarantined emails for review and threat analysis.

Get Report by ID: Enables retrieval of specific reports using their unique identifiers for easy access to pertinent information.

Release Quarantined Email: Facilitates the safe release of a quarantined email back into the communication system.

By leveraging the FireEye's API capabilities, the FireEye connector offers a unified and efficient solution for managing FireEye appliances, thereby helping maintain a robust security posture.

Notes

Authentication documentation

Api documentation

Additional Documentation

Fireeye Connector Documentation

Fireeye API Documentation

Configurations

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Acknowledge Alert

Confirm review of an alert in FireEye to remove it from the Web UI. Requires UUID as a path parameter and annotation as a parameter.

Endpoint

URL: wsapis/v2.0.0/alerts/alert/{{uuid}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.uuid	string	Required	Parameters for the Acknowledge Alert action
parameters.annotation	string	Required	Parameters for the Acknowledge Alert action
parameters.alertType	string	Optional	Parameters for the Acknowledge Alert action
headers	object	Optional	HTTP headers for the request
headers.Accept	string	Optional	HTTP headers for the request

Input Example

{"headers":{"Accept":"application/json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{}

Delete Quarantined Email

Delete an email from quarantine in FireEye using queue IDs provided in the JSON body.

Endpoint

URL: wsapis/v2.0.0/emailmgmt/quarantine/delete

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.Accept	string	Optional	HTTP headers for the request
queue_ids	array	Optional	Unique identifier

Input Example

{"headers":{"Accept":"application/json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{}

Download Quarantined Email

Download a quarantined email from FireEye using the specified queue ID as a path parameter.

Endpoint

URL: wsapis/v2.0.0/emailmgmt/quarantine/{{queue_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.queue_id	string	Required	Parameters for the Download Quarantined Email action
headers	object	Optional	HTTP headers for the request
headers.Accept	string	Optional	HTTP headers for the request

Input Example

{"headers":{"Accept":"application/octet-stream"}}

Output

Parameter	Type	Description
file	object	File
file.file_name	string	Name of the resource
file.file	string	Output field: file.file

Output Example

{"file":{"file_name":"Example Name","file":"string"}}

Get Alert Details

Retrieve detailed information for a specific alert in FireEye using the alert ID as a path parameter.

Endpoint

URL: wsapis/v2.0.0/alerts/alert/{{alert_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alert_id	string	Required	Parameters for the Get Alert Details action
headers	object	Optional	HTTP headers for the request
headers.Accept	string	Optional	HTTP headers for the request

Input Example

{"headers":{"Accept":"application/json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{}

Get Alerts

Retrieve alerts from FireEye to monitor and analyze potential security threats.

Endpoint

URL: wsapis/v2.0.0/alerts

Method: GET

Input

Argument Name	Type	Required	Description
parameters.info_level	string	Optional	Parameters for the Get Alerts action
parameters.malware_type	string	Optional	Parameters for the Get Alerts action
parameters.file_type	string	Optional	Parameters for the Get Alerts action
parameters.file_name	string	Optional	Parameters for the Get Alerts action
parameters.start_time	string	Optional	Parameters for the Get Alerts action
parameters.recipient_email	string	Optional	Parameters for the Get Alerts action
parameters.src_ip	string	Optional	Parameters for the Get Alerts action
parameters.url	string	Optional	Parameters for the Get Alerts action
parameters.alert_id	string	Optional	Parameters for the Get Alerts action
parameters.end_time	string	Optional	Parameters for the Get Alerts action
parameters.sender_email	string	Optional	Parameters for the Get Alerts action
parameters.callback_domain	string	Optional	Parameters for the Get Alerts action
parameters.duration	string	Optional	Parameters for the Get Alerts action
parameters.dst_ip	string	Optional	Parameters for the Get Alerts action
parameters.malware_name	string	Optional	Parameters for the Get Alerts action
parameters.md5	string	Optional	Parameters for the Get Alerts action
headers	object	Optional	HTTP headers for the request
headers.Accept	string	Optional	HTTP headers for the request

Input Example

{"headers":{"Accept":"application/json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{}

Get Artifact

Retrieve an artifact from FireEye using the specified alert ID as a path parameter.

Endpoint

URL: wsapis/v2.0.0/artifacts/{{alert_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alert_id	string	Required	Parameters for the Get Artifact action
headers	object	Optional	HTTP headers for the request
headers.Accept	string	Optional	HTTP headers for the request

Input Example

{"headers":{"Accept":"application/octet-stream"}}

Output

Parameter	Type	Description
file	object	File
file.file_name	string	Name of the resource
file.file	string	Output field: file.file

Output Example

{"file":{"file_name":"Example Name","file":"string"}}

Get Artifacts Metadata

Get metadata of malware artifacts from FireEye using the UUID as a path parameter.

Endpoint

URL: /wapis/v2.0.0/artifacts/{{uuid}}/meta

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.uuid	string	Required	Parameters for the Get Artifacts Metadata action
headers	object	Optional	HTTP headers for the request
headers.Accept	string	Optional	HTTP headers for the request

Input Example

{"headers":{"Accept":"application/json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{}

Get Events

Retrieve events from FireEye to analyze security incidents and threats.

Endpoint

URL: wsapis/v2.0.0/events

Method: GET

Input

Argument Name	Type	Required	Description
parameters.duration	string	Optional	Parameters for the Get Events action
parameters.end_time	string	Optional	Parameters for the Get Events action
parameters.mvx_correlated_only	string	Optional	Parameters for the Get Events action
headers	object	Optional	HTTP headers for the request
headers.Accept	string	Optional	HTTP headers for the request

Input Example

{"headers":{"Accept":"application/json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{}

Get Quarantine Emails

Retrieve emails that have been quarantined in FireEye for further analysis and action.

Endpoint

URL: wsapis/v2.0.0/emailmgmt/quarantine

Method: GET

Input

Argument Name	Type	Required	Description
parameters.appliance_id	string	Optional	Parameters for the Get Quarantine Emails action
parameters.subject	string	Optional	Parameters for the Get Quarantine Emails action
parameters.from	string	Optional	Parameters for the Get Quarantine Emails action
parameters.limit	string	Optional	Parameters for the Get Quarantine Emails action
parameters.start_time	string	Optional	Parameters for the Get Quarantine Emails action
parameters.end_time	string	Optional	Parameters for the Get Quarantine Emails action
headers	object	Optional	HTTP headers for the request
headers.Accept	string	Optional	HTTP headers for the request

Input Example

{"headers":{"Accept":"application/json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{}

Get Report

Retrieve a detailed report from FireEye using parameters such as report type, infection ID, and infection type.

Endpoint

URL: /wsapis/v1.2.0/reports/report

Method: GET

Input

Argument Name	Type	Required	Description
parameters.report_type	string	Required	Parameters for the Get Report action
parameters.infection_id	string	Required	Parameters for the Get Report action
parameters.infection_type	string	Required	Parameters for the Get Report action
headers	object	Optional	HTTP headers for the request
headers.Accept	string	Optional	HTTP headers for the request

Input Example

{"headers":{"Accept":"application/json"}}

Output

Parameter	Type	Description
file	object	File
file.file_name	string	Name of the resource
file.file	string	Output field: file.file

Output Example

{"file":{"file_name":"Example Name","file":"string"}}

Release Quarantined Email

Release quarantined emails from specified queues in FireEye using sensor names and queue IDs.

Endpoint

URL: /wsapis/v2.0.0/emailmgmt/quarantine/release

Method: POST

Input

Argument Name	Type	Required	Description
parameters.sensorName	string	Required	The sensor display name.
headers	object	Optional	HTTP headers for the request
headers.Accept	string	Optional	HTTP headers for the request
queue_ids	array	Optional	Unique identifier

Input Example

{"parameters":{"sensorName":"blade1-vex3"},"json_body":{"queue_ids":["463jzF5N0hzShwd"]},"headers":{"Accept":"application/json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT