--- title: Fireeye slug: connectors/fireeye docTags: createdAt: 2026-06-09T16:29:44.494Z --- FireEye is a cybersecurity platform that provides advanced threat protection and intelligence solutions. FireEye is a leading cybersecurity platform that provides advanced threat protection and intelligence. The FireEye connector for Swimlane Turbine enables seamless integration with FireEye's robust security operations, allowing users to automate alert management, email quarantine actions, and threat intelligence retrieval. By integrating FireEye with Swimlane Turbine, security teams can enhance their incident response capabilities, streamline threat analysis, and improve overall security posture through automated workflows. ## Prerequisites Before you can use the FireEye connector for Turbine, you'll need access to the FireEye API. This requires the following: - HTTP Basic authentication using the following parameters: - URL: The endpoint URL for accessing the FireEye API. - Username: Your FireEye account username. - Password: Your FireEye account password. ## Asset Configuration This connector requires a `Username` and a `Password` for secure communication with the FireEye appliances. It uses basic HTTP authentication, a widely-adopted method that ensures secure interactions with your FireEye systems. ## Functionalities The FireEye connector provides a comprehensive set of functionalities: - **Acknowledge Alert**: Allows for acknowledgment and recording of alerts for potential security threats. - **Delete Quarantined Email**: Enables safe removal of emails in quarantine, maintaining the integrity of your communication systems. - **Download Quarantined Email**: Provides the ability to retrieve quarantined emails for further review or analysis. - **Get Alert Details**: Grants access to detailed information about alerts, aiding effective response to security incidents. - **Get Alerts**: Facilitates monitoring and retrieval of alerts, keeping you updated on security issues. - **Get Artifact**: Permits access to specific artifacts, such as files or documents, pertaining to potential security issues. - **Get Artifact Metadata**: Allows retrieval of metadata about an artifact, providing more context about potential security incidents. - **Get Events**: Assists in tracking and obtaining event data for monitoring activities and potential security threats. - **Get Quarantined Emails**: Allows access to quarantined emails for review and threat analysis. - **Get Report by ID**: Enables retrieval of specific reports using their unique identifiers for easy access to pertinent information. - **Release Quarantined Email**: Facilitates the safe release of a quarantined email back into the communication system. By leveraging the FireEye's API capabilities, the FireEye connector offers a unified and efficient solution for managing FireEye appliances, thereby helping maintain a robust security posture. ## Notes - [Authentication documentation](https://docs.trellix.com/bundle/api_ref/page/UUID-4ff666e7-f5d9-0687-aaa0-f716792959d7.html) - [Api documentation](https://docs.trellix.com/bundle/api_ref/page/UUID-b24af738-b712-2712-0724-ee6e9430175f.html) ## Additional Documentation - [Fireeye Connector Documentation](https://docs.swimlane.com/connectors/fireeye) - [Fireeye API Documentation](https://docs.trellix.com/bundle/api_ref/page/UUID-4ff666e7-f5d9-0687-aaa0-f716792959d7.html) # Configurations ## HTTP Basic Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username | string | Required | | password | Password | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Acknowledge Alert Confirm review of an alert in FireEye to remove it from the Web UI. Requires UUID as a path parameter and annotation as a parameter. ### Endpoint - **URL:** `wsapis/v2.0.0/alerts/alert/{{uuid}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.uuid` | string | Required | Parameters for the Acknowledge Alert action | | `parameters.annotation` | string | Required | Parameters for the Acknowledge Alert action | | `parameters.alertType` | string | Optional | Parameters for the Acknowledge Alert action | | `headers` | object | Optional | HTTP headers for the request | | `headers.Accept` | string | Optional | HTTP headers for the request | ### Input Example `{"headers":{"Accept":"application/json"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` ## Delete Quarantined Email Delete an email from quarantine in FireEye using queue IDs provided in the JSON body. ### Endpoint - **URL:** `wsapis/v2.0.0/emailmgmt/quarantine/delete` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------- | | `headers` | object | Optional | HTTP headers for the request | | `headers.Accept` | string | Optional | HTTP headers for the request | | `queue_ids` | array | Optional | Unique identifier | ### Input Example `{"headers":{"Accept":"application/json"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` ## Download Quarantined Email Download a quarantined email from FireEye using the specified queue ID as a path parameter. ### Endpoint - **URL:** `wsapis/v2.0.0/emailmgmt/quarantine/{{queue_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------------------------------- | | `path_parameters.queue_id` | string | Required | Parameters for the Download Quarantined Email action | | `headers` | object | Optional | HTTP headers for the request | | `headers.Accept` | string | Optional | HTTP headers for the request | ### Input Example `{"headers":{"Accept":"application/octet-stream"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | ----------------------- | | `file` | object | File | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"file":{"file_name":"Example Name","file":"string"}}` ## Get Alert Details Retrieve detailed information for a specific alert in FireEye using the alert ID as a path parameter. ### Endpoint - **URL:** `wsapis/v2.0.0/alerts/alert/{{alert_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.alert_id` | string | Required | Parameters for the Get Alert Details action | | `headers` | object | Optional | HTTP headers for the request | | `headers.Accept` | string | Optional | HTTP headers for the request | ### Input Example `{"headers":{"Accept":"application/json"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` ## Get Alerts Retrieve alerts from FireEye to monitor and analyze potential security threats. ### Endpoint - **URL:** `wsapis/v2.0.0/alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------ | | `parameters.info_level` | string | Optional | Parameters for the Get Alerts action | | `parameters.malware_type` | string | Optional | Parameters for the Get Alerts action | | `parameters.file_type` | string | Optional | Parameters for the Get Alerts action | | `parameters.file_name` | string | Optional | Parameters for the Get Alerts action | | `parameters.start_time` | string | Optional | Parameters for the Get Alerts action | | `parameters.recipient_email` | string | Optional | Parameters for the Get Alerts action | | `parameters.src_ip` | string | Optional | Parameters for the Get Alerts action | | `parameters.url` | string | Optional | Parameters for the Get Alerts action | | `parameters.alert_id` | string | Optional | Parameters for the Get Alerts action | | `parameters.end_time` | string | Optional | Parameters for the Get Alerts action | | `parameters.sender_email` | string | Optional | Parameters for the Get Alerts action | | `parameters.callback_domain` | string | Optional | Parameters for the Get Alerts action | | `parameters.duration` | string | Optional | Parameters for the Get Alerts action | | `parameters.dst_ip` | string | Optional | Parameters for the Get Alerts action | | `parameters.malware_name` | string | Optional | Parameters for the Get Alerts action | | `parameters.md5` | string | Optional | Parameters for the Get Alerts action | | `headers` | object | Optional | HTTP headers for the request | | `headers.Accept` | string | Optional | HTTP headers for the request | ### Input Example `{"headers":{"Accept":"application/json"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` ## Get Artifact Retrieve an artifact from FireEye using the specified alert ID as a path parameter. ### Endpoint - **URL:** `wsapis/v2.0.0/artifacts/{{alert_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | -------------------------------------- | | `path_parameters.alert_id` | string | Required | Parameters for the Get Artifact action | | `headers` | object | Optional | HTTP headers for the request | | `headers.Accept` | string | Optional | HTTP headers for the request | ### Input Example `{"headers":{"Accept":"application/octet-stream"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | ----------------------- | | `file` | object | File | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"file":{"file_name":"Example Name","file":"string"}}` ## Get Artifacts Metadata Get metadata of malware artifacts from FireEye using the UUID as a path parameter. ### Endpoint - **URL:** `/wapis/v2.0.0/artifacts/{{uuid}}/meta` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ------------------------------------------------ | | `path_parameters.uuid` | string | Required | Parameters for the Get Artifacts Metadata action | | `headers` | object | Optional | HTTP headers for the request | | `headers.Accept` | string | Optional | HTTP headers for the request | ### Input Example `{"headers":{"Accept":"application/json"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` ## Get Events Retrieve events from FireEye to analyze security incidents and threats. ### Endpoint - **URL:** `wsapis/v2.0.0/events` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ------------------------------------ | | `parameters.duration` | string | Optional | Parameters for the Get Events action | | `parameters.end_time` | string | Optional | Parameters for the Get Events action | | `parameters.mvx_correlated_only` | string | Optional | Parameters for the Get Events action | | `headers` | object | Optional | HTTP headers for the request | | `headers.Accept` | string | Optional | HTTP headers for the request | ### Input Example `{"headers":{"Accept":"application/json"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` ## Get Quarantine Emails Retrieve emails that have been quarantined in FireEye for further analysis and action. ### Endpoint - **URL:** `wsapis/v2.0.0/emailmgmt/quarantine` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ----------------------------------------------- | | `parameters.appliance_id` | string | Optional | Parameters for the Get Quarantine Emails action | | `parameters.subject` | string | Optional | Parameters for the Get Quarantine Emails action | | `parameters.from` | string | Optional | Parameters for the Get Quarantine Emails action | | `parameters.limit` | string | Optional | Parameters for the Get Quarantine Emails action | | `parameters.start_time` | string | Optional | Parameters for the Get Quarantine Emails action | | `parameters.end_time` | string | Optional | Parameters for the Get Quarantine Emails action | | `headers` | object | Optional | HTTP headers for the request | | `headers.Accept` | string | Optional | HTTP headers for the request | ### Input Example `{"headers":{"Accept":"application/json"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` ## Get Report Retrieve a detailed report from FireEye using parameters such as report type, infection ID, and infection type. ### Endpoint - **URL:** `/wsapis/v1.2.0/reports/report` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------ | | `parameters.report_type` | string | Required | Parameters for the Get Report action | | `parameters.infection_id` | string | Required | Parameters for the Get Report action | | `parameters.infection_type` | string | Required | Parameters for the Get Report action | | `headers` | object | Optional | HTTP headers for the request | | `headers.Accept` | string | Optional | HTTP headers for the request | ### Input Example `{"headers":{"Accept":"application/json"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | ----------------------- | | `file` | object | File | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"file":{"file_name":"Example Name","file":"string"}}` ## Release Quarantined Email Release quarantined emails from specified queues in FireEye using sensor names and queue IDs. ### Endpoint - **URL:** `/wsapis/v2.0.0/emailmgmt/quarantine/release` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ---------------------------- | | `parameters.sensorName` | string | Required | The sensor display name. | | `headers` | object | Optional | HTTP headers for the request | | `headers.Accept` | string | Optional | HTTP headers for the request | | `queue_ids` | array | Optional | Unique identifier | ### Input Example `{"parameters":{"sensorName":"blade1-vex3"},"json_body":{"queue_ids":["463jzF5N0hzShwd"]},"headers":{"Accept":"application/json"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |