Fireeye Detection On Demand

FireEye Detection On Demand is a cloud-based service that provides advanced threat detection and malware analysis.

FireEye Detection On Demand is a cloud-based threat detection service that provides advanced malware analysis capabilities. This connector allows Swimlane Turbine users to automate the submission and retrieval of file analysis reports, enhancing threat detection and response workflows. By integrating with FireEye Detection On Demand, users can efficiently manage malware analysis tasks, retrieve detailed reports using various identifiers, and upload files for comprehensive threat assessment. This integration empowers security teams to streamline their operations, reduce manual effort, and improve response times to potential threats.

Prerequisites

Before you can use the FireEye Detection On Demand connector for Turbine, you'll need access to the FireEye API. This requires the following:

an API key authentication using the following parameters:

URL: The endpoint URL for accessing FireEye Detection On Demand services.

Fireeye Auth Key: A unique key provided by FireEye for authenticating API requests.

Capabilities

This connector provides the following capabilities:

Upload Files to Detection on Demand

Get single report by connector and file ID

Get single Report

Get single report by MD5 or SHA256

Action Limitations:

For the upload file action, your file must be less than 20 MB. Files greater than 20 MB will receive a playbook error.

Notes

For more information click here.

Additional Documentation

Fireeye Detection On Demand Connector Documentation

Fireeye Detection On Demand API Documentation

Configurations

API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
feye-auth-key	Auth key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Single Report

Retrieve the results of a single file submission report in FireEye Detection On Demand using the report ID as a path parameter.

Endpoint

URL: /reports/{{report_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.report_id	string	Required	The report ID returned after successfully submitting a file.
parameters.extended	boolean	Optional	Setting extended to true will allow you to see all malware engine reports.

Input Example

{"parameters":{"extended":true},"path_parameters":{"report_id":"992694b3-20ab-4245-9b4c-8f3a1b7ec3b6"}}

Output

Parameter	Type	Description
report_id	string	Unique identifier
overall_status	string	Status value
is_malicious	boolean	Output field: is_malicious
started_at	string	Output field: started_at
completed_at	string	Output field: completed_at
duration	number	Output field: duration
file_name	string	Name of the resource
file_size	number	Output field: file_size
file_extension	string	Output field: file_extension
name	string	Name of the resource
type	string	Type of the resource
size	number	Output field: size
md5	string	Output field: md5
sha256	string	Output field: sha256
sha1	string	Output field: sha1
magic	string	Output field: magic
extracted_objects	array	Output field: extracted_objects
extracted_objects.submission_uuid	string	Unique identifier
extracted_objects.object_uuid	string	Unique identifier
extracted_objects.name	string	Name of the resource
extracted_objects.type	string	Type of the resource
extracted_objects.complete_time	string	Time value
extracted_objects.analyses_start_time	string	Time value
extracted_objects.verdict	string	Output field: extracted_objects.verdict
extracted_objects.md5	string	Output field: extracted_objects.md5

Output Example

{"report_id":"4dfa1e0b-0e33-4ac7-ac24-e2680a0bcdbe","overall_status":"DONE","is_malicious":true,"started_at":"2020-07-06 18:15:13","completed_at":"2020-07-06 18:17:54","duration":161,"file_name":"payment_2019.exe","file_size":17920,"file_extension":"exe","name":"payment_2019.exe","type":"exe","size":17920,"md5":"968a89bf69338b6e0332a9d5d300cd5a","sha256":"105f7022adcfeec2cc698f500c2a83c3436822f7372177ffa2ed3d3ae7b3a80b","sha1":"a68621e31c08a4fff8d4c4a49364b386acd769fa"}

Get Single Report By Connector And File ID

Retrieve a single report from FireEye Detection On Demand using the connector type and file ID. This is an alternative method to locate reports submitted via configured connectors like Box or Microsoft Teams.

Endpoint

URL: /reports/search

Method: GET

Input

Argument Name	Type	Required	Description
parameters.extended	boolean	Optional	Parameters for the Get Single Report By Connector And File ID action
parameters.connector_type	string	Required	Parameters for the Get Single Report By Connector And File ID action
parameters.file_id	string	Required	Parameters for the Get Single Report By Connector And File ID action

Input Example

{"parameters":{"extended":true,"connector_type":"box","file_id":"12345678"}}

Output

Parameter	Type	Description
report_id	string	Unique identifier
overall_status	string	Status value
is_malicious	boolean	Output field: is_malicious
started_at	string	Output field: started_at
completed_at	string	Output field: completed_at
duration	number	Output field: duration
file_name	string	Name of the resource
file_size	number	Output field: file_size
file_extension	string	Output field: file_extension
name	string	Name of the resource
type	string	Type of the resource
size	number	Output field: size
md5	string	Output field: md5
sha256	string	Output field: sha256
sha1	string	Output field: sha1
magic	string	Output field: magic
extracted_objects	array	Output field: extracted_objects
extracted_objects.submission_uuid	string	Unique identifier
extracted_objects.object_uuid	string	Unique identifier
extracted_objects.name	string	Name of the resource
extracted_objects.type	string	Type of the resource
extracted_objects.complete_time	string	Time value
extracted_objects.analyses_start_time	string	Time value
extracted_objects.verdict	string	Output field: extracted_objects.verdict
extracted_objects.md5	string	Output field: extracted_objects.md5

Output Example

Get Single Repory By Hash

Retrieve the latest report for a file submission using its MD5 or SHA256 hash in FireEye Detection On Demand.

Endpoint

URL: /reports/{{hash}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.hash	string	Required	MD5 or SHA256 hash of a submitted file
parameters.extended	boolean	Optional	Setting extended to true will allow you to see all malware engine reports.

Input Example

{"parameters":{"extended":true},"path_parameters":{"hash":"a32a382b8a5a906e03a83b4f3e5b7a9b"}}

Output

Parameter	Type	Description
report_id	string	Unique identifier
overall_status	string	Status value
is_malicious	boolean	Output field: is_malicious
started_at	string	Output field: started_at
completed_at	string	Output field: completed_at
duration	number	Output field: duration
file_name	string	Name of the resource
file_size	number	Output field: file_size
file_extension	string	Output field: file_extension
name	string	Name of the resource
type	string	Type of the resource
size	number	Output field: size
md5	string	Output field: md5
sha256	string	Output field: sha256
sha1	string	Output field: sha1
magic	string	Output field: magic
extracted_objects	array	Output field: extracted_objects
extracted_objects.submission_uuid	string	Unique identifier
extracted_objects.object_uuid	string	Unique identifier
extracted_objects.name	string	Name of the resource
extracted_objects.type	string	Type of the resource
extracted_objects.complete_time	string	Time value
extracted_objects.analyses_start_time	string	Time value
extracted_objects.verdict	string	Output field: extracted_objects.verdict
extracted_objects.md5	string	Output field: extracted_objects.md5

Output Example

{"report_id":"1737d302-600e-431c-96eb-9c688ee0af98","overall_status":"DONE","is_malicious":true,"started_at":"2020-07-06 18:15:13","completed_at":"2020-07-06 18:17:54","duration":161,"file_name":"payment_2019.exe","file_size":17920,"file_extension":"exe","name":"payment_2019.exe","type":"exe","size":17920,"md5":"a32a382b8a5a906e03a83b4f3e5b7a9b","sha256":"105f7022adcfeec2cc698f500c2a83c3436822f7372177ffa2ed3d3ae7b3a80b","sha1":"a68621e31c08a4fff8d4c4a49364b386acd769fa"}

Upload Files

Upload files to FireEye Detection On Demand for analysis. This action requires a binary file in the form body.

Endpoint

URL: /files

Method: POST

Input

Argument Name	Type	Required	Description
form_data	object	Optional	Response data
form_data.file	object	Required	This is the binary file that you want to submit for malware analysis
form_data.file.file	string	Required	Response data
form_data.file.file_name	string	Required	Response data
form_data.file_name	string	Optional	Custom name for the submitted file to be used in the report
form_data.password	string	Optional	Password to be used by the detection engine to decrypt a password protected file
form_data.param	string	Optional	Command line parameter(s) to be used by detection engine when running the file. Mainly applicable to .exe files. For example, setting param to "start -h localhost -p 5555" will make the detection engine run a file named "malicious.exe" as "malicious.exe start -h localhost -p 5555"
form_data.screenshot	boolean	Optional	Extract screenshot of screen activity during dynamic analysis if true, which later can be downloaded with artifacts api
form_data.video	boolean	Optional	Extract video activity during dynamic analysis if true, which later can be downloaded with artifacts api
form_data.file_extraction	boolean	Optional	Extract dropped files from vm during dynamic analysis if true, which later can be downloaded with artifacts api
form_data.memory_dump	boolean	Optional	Extract memory dump files from vm during dynamic analysis if true, which later can be downloaded with artifacts api
form_data.pcap	boolean	Optional	Extract pcap files from vm during dynamic analysis if true, which later can be downloaded with artifacts api
form_data.analysis_mode	string	Optional	Analysis mode for submission (sandbox or live)
form_data.profiles	string	Optional	Profiles to be used for dynamic analysis. ["win7x64-sp1m", "win7-sp1m"]
form_data.force_analyze	boolean	Optional	Force submission for this file even if found as duplicate

Input Example

{"form_data":{"file":[{"file":"","file_name":"sample.txt"}],"password":"sample123","param":"start -h localhost -p 5555","screenshot":true,"video":true,"file_extraction":true,"memory_dump":true,"pcap":true,"analysis_mode":"sandbox","profiles":"win7x64-sp1m","force_analyze":true}}

Output

Parameter	Type	Description
status	string	Status value
report_id	string	Unique identifier
md5	string	Output field: md5

Output Example

{"status":"success","report_id":"992694b3-20ab-4245-9b4c-8f3a1b7ec3b6","md5":"4ba739fd8c216809e485e7972597c995"}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT