--- title: Fireeye Detection On Demand slug: connectors/fireeye-detection-on-demand docTags: createdAt: 2026-06-09T16:29:40.850Z --- FireEye Detection On Demand is a cloud-based service that provides advanced threat detection and malware analysis. FireEye Detection On Demand is a cloud-based threat detection service that provides advanced malware analysis capabilities. This connector allows Swimlane Turbine users to automate the submission and retrieval of file analysis reports, enhancing threat detection and response workflows. By integrating with FireEye Detection On Demand, users can efficiently manage malware analysis tasks, retrieve detailed reports using various identifiers, and upload files for comprehensive threat assessment. This integration empowers security teams to streamline their operations, reduce manual effort, and improve response times to potential threats. ## Prerequisites Before you can use the FireEye Detection On Demand connector for Turbine, you'll need access to the FireEye API. This requires the following: - an API key authentication using the following parameters: - URL: The endpoint URL for accessing FireEye Detection On Demand services. - Fireeye Auth Key: A unique key provided by FireEye for authenticating API requests. ## Capabilities This connector provides the following capabilities: - Upload Files to Detection on Demand - Get single report by connector and file ID - Get single Report - Get single report by MD5 or SHA256 ## Action Limitations: For the upload file action, your file must be less than 20 MB. Files greater than 20 MB will receive a playbook error. ## Notes For more information [click here](https://fireeye.dev/apis/detection-on-demand/). ## Additional Documentation - [Fireeye Detection On Demand Connector Documentation](https://docs.swimlane.com/connectors/fireeye-detection-on-demand) - [Fireeye Detection On Demand API Documentation](https://fireeye.dev/apis/detection-on-demand/) # Configurations ## API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | feye-auth-key | Auth key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Single Report Retrieve the results of a single file submission report in FireEye Detection On Demand using the report ID as a path parameter. ### Endpoint - **URL:** `/reports/{{report_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------------------------------------------------------- | | `path_parameters.report_id` | string | Required | The report ID returned after successfully submitting a file. | | `parameters.extended` | boolean | Optional | Setting extended to true will allow you to see all malware engine reports. | ### Input Example `{"parameters":{"extended":true},"path_parameters":{"report_id":"992694b3-20ab-4245-9b4c-8f3a1b7ec3b6"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | ---------------------------------------- | | `report_id` | string | Unique identifier | | `overall_status` | string | Status value | | `is_malicious` | boolean | Output field: is\_malicious | | `started_at` | string | Output field: started\_at | | `completed_at` | string | Output field: completed\_at | | `duration` | number | Output field: duration | | `file_name` | string | Name of the resource | | `file_size` | number | Output field: file\_size | | `file_extension` | string | Output field: file\_extension | | `name` | string | Name of the resource | | `type` | string | Type of the resource | | `size` | number | Output field: size | | `md5` | string | Output field: md5 | | `sha256` | string | Output field: sha256 | | `sha1` | string | Output field: sha1 | | `magic` | string | Output field: magic | | `extracted_objects` | array | Output field: extracted\_objects | | `extracted_objects.submission_uuid` | string | Unique identifier | | `extracted_objects.object_uuid` | string | Unique identifier | | `extracted_objects.name` | string | Name of the resource | | `extracted_objects.type` | string | Type of the resource | | `extracted_objects.complete_time` | string | Time value | | `extracted_objects.analyses_start_time` | string | Time value | | `extracted_objects.verdict` | string | Output field: extracted\_objects.verdict | | `extracted_objects.md5` | string | Output field: extracted\_objects.md5 | ### Output Example `{"report_id":"4dfa1e0b-0e33-4ac7-ac24-e2680a0bcdbe","overall_status":"DONE","is_malicious":true,"started_at":"2020-07-06 18:15:13","completed_at":"2020-07-06 18:17:54","duration":161,"file_name":"payment_2019.exe","file_size":17920,"file_extension":"exe","name":"payment_2019.exe","type":"exe","size":17920,"md5":"968a89bf69338b6e0332a9d5d300cd5a","sha256":"105f7022adcfeec2cc698f500c2a83c3436822f7372177ffa2ed3d3ae7b3a80b","sha1":"a68621e31c08a4fff8d4c4a49364b386acd769fa"}` ## Get Single Report By Connector And File ID Retrieve a single report from FireEye Detection On Demand using the connector type and file ID. This is an alternative method to locate reports submitted via configured connectors like Box or Microsoft Teams. ### Endpoint - **URL:** `/reports/search` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------------------------------------------------- | | `parameters.extended` | boolean | Optional | Parameters for the Get Single Report By Connector And File ID action | | `parameters.connector_type` | string | Required | Parameters for the Get Single Report By Connector And File ID action | | `parameters.file_id` | string | Required | Parameters for the Get Single Report By Connector And File ID action | ### Input Example `{"parameters":{"extended":true,"connector_type":"box","file_id":"12345678"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | ---------------------------------------- | | `report_id` | string | Unique identifier | | `overall_status` | string | Status value | | `is_malicious` | boolean | Output field: is\_malicious | | `started_at` | string | Output field: started\_at | | `completed_at` | string | Output field: completed\_at | | `duration` | number | Output field: duration | | `file_name` | string | Name of the resource | | `file_size` | number | Output field: file\_size | | `file_extension` | string | Output field: file\_extension | | `name` | string | Name of the resource | | `type` | string | Type of the resource | | `size` | number | Output field: size | | `md5` | string | Output field: md5 | | `sha256` | string | Output field: sha256 | | `sha1` | string | Output field: sha1 | | `magic` | string | Output field: magic | | `extracted_objects` | array | Output field: extracted\_objects | | `extracted_objects.submission_uuid` | string | Unique identifier | | `extracted_objects.object_uuid` | string | Unique identifier | | `extracted_objects.name` | string | Name of the resource | | `extracted_objects.type` | string | Type of the resource | | `extracted_objects.complete_time` | string | Time value | | `extracted_objects.analyses_start_time` | string | Time value | | `extracted_objects.verdict` | string | Output field: extracted\_objects.verdict | | `extracted_objects.md5` | string | Output field: extracted\_objects.md5 | ### Output Example `{"report_id":"4dfa1e0b-0e33-4ac7-ac24-e2680a0bcdbe","overall_status":"DONE","is_malicious":true,"started_at":"2020-07-06 18:15:13","completed_at":"2020-07-06 18:17:54","duration":161,"file_name":"payment_2019.exe","file_size":17920,"file_extension":"exe","name":"payment_2019.exe","type":"exe","size":17920,"md5":"968a89bf69338b6e0332a9d5d300cd5a","sha256":"105f7022adcfeec2cc698f500c2a83c3436822f7372177ffa2ed3d3ae7b3a80b","sha1":"a68621e31c08a4fff8d4c4a49364b386acd769fa"}` ## Get Single Repory By Hash Retrieve the latest report for a file submission using its MD5 or SHA256 hash in FireEye Detection On Demand. ### Endpoint - **URL:** `/reports/{{hash}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | -------------------------------------------------------------------------- | | `path_parameters.hash` | string | Required | MD5 or SHA256 hash of a submitted file | | `parameters.extended` | boolean | Optional | Setting extended to true will allow you to see all malware engine reports. | ### Input Example `{"parameters":{"extended":true},"path_parameters":{"hash":"a32a382b8a5a906e03a83b4f3e5b7a9b"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | ---------------------------------------- | | `report_id` | string | Unique identifier | | `overall_status` | string | Status value | | `is_malicious` | boolean | Output field: is\_malicious | | `started_at` | string | Output field: started\_at | | `completed_at` | string | Output field: completed\_at | | `duration` | number | Output field: duration | | `file_name` | string | Name of the resource | | `file_size` | number | Output field: file\_size | | `file_extension` | string | Output field: file\_extension | | `name` | string | Name of the resource | | `type` | string | Type of the resource | | `size` | number | Output field: size | | `md5` | string | Output field: md5 | | `sha256` | string | Output field: sha256 | | `sha1` | string | Output field: sha1 | | `magic` | string | Output field: magic | | `extracted_objects` | array | Output field: extracted\_objects | | `extracted_objects.submission_uuid` | string | Unique identifier | | `extracted_objects.object_uuid` | string | Unique identifier | | `extracted_objects.name` | string | Name of the resource | | `extracted_objects.type` | string | Type of the resource | | `extracted_objects.complete_time` | string | Time value | | `extracted_objects.analyses_start_time` | string | Time value | | `extracted_objects.verdict` | string | Output field: extracted\_objects.verdict | | `extracted_objects.md5` | string | Output field: extracted\_objects.md5 | ### Output Example `{"report_id":"1737d302-600e-431c-96eb-9c688ee0af98","overall_status":"DONE","is_malicious":true,"started_at":"2020-07-06 18:15:13","completed_at":"2020-07-06 18:17:54","duration":161,"file_name":"payment_2019.exe","file_size":17920,"file_extension":"exe","name":"payment_2019.exe","type":"exe","size":17920,"md5":"a32a382b8a5a906e03a83b4f3e5b7a9b","sha256":"105f7022adcfeec2cc698f500c2a83c3436822f7372177ffa2ed3d3ae7b3a80b","sha1":"a68621e31c08a4fff8d4c4a49364b386acd769fa"}` ## Upload Files Upload files to FireEye Detection On Demand for analysis. This action requires a binary file in the form body. ### Endpoint - **URL:** `/files` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `form_data` | object | Optional | Response data | | `form_data.file` | object | Required | This is the binary file that you want to submit for malware analysis | | `form_data.file.file` | string | Required | Response data | | `form_data.file.file_name` | string | Required | Response data | | `form_data.file_name` | string | Optional | Custom name for the submitted file to be used in the report | | `form_data.password` | string | Optional | Password to be used by the detection engine to decrypt a password protected file | | `form_data.param` | string | Optional | Command line parameter(s) to be used by detection engine when running the file. Mainly applicable to .exe files. For example, setting param to "start -h localhost -p 5555" will make the detection engine run a file named "malicious.exe" as "malicious.exe start -h localhost -p 5555" | | `form_data.screenshot` | boolean | Optional | Extract screenshot of screen activity during dynamic analysis if true, which later can be downloaded with artifacts api | | `form_data.video` | boolean | Optional | Extract video activity during dynamic analysis if true, which later can be downloaded with artifacts api | | `form_data.file_extraction` | boolean | Optional | Extract dropped files from vm during dynamic analysis if true, which later can be downloaded with artifacts api | | `form_data.memory_dump` | boolean | Optional | Extract memory dump files from vm during dynamic analysis if true, which later can be downloaded with artifacts api | | `form_data.pcap` | boolean | Optional | Extract pcap files from vm during dynamic analysis if true, which later can be downloaded with artifacts api | | `form_data.analysis_mode` | string | Optional | Analysis mode for submission (sandbox or live) | | `form_data.profiles` | string | Optional | Profiles to be used for dynamic analysis. \["win7x64-sp1m", "win7-sp1m"] | | `form_data.force_analyze` | boolean | Optional | Force submission for this file even if found as duplicate | ### Input Example `{"form_data":{"file":[{"file":"","file_name":"sample.txt"}],"password":"sample123","param":"start -h localhost -p 5555","screenshot":true,"video":true,"file_extraction":true,"memory_dump":true,"pcap":true,"analysis_mode":"sandbox","profiles":"win7x64-sp1m","force_analyze":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ----------------- | | `status` | string | Status value | | `report_id` | string | Unique identifier | | `md5` | string | Output field: md5 | ### Output Example `{"status":"success","report_id":"992694b3-20ab-4245-9b4c-8f3a1b7ec3b6","md5":"4ba739fd8c216809e485e7972597c995"}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |