FireEye Helix

Use the FireEye Helix integration to integrate security tools and arguments with next-generation SIEM, orchestration and threat intelligence tools such as alert management, search, analysis, investigations and reporting.

In order to configure this integration you must have a FireEye customer ID. Your customer ID will placed in the FireEye Helix URL of your FireEye Helix app after /helix/id/. e.g. for the following URL https://apps.fireeye.com/helix/id/"helixid" the customer ID is "helixid".

The API key can be found and generated in the API KEYS section. You can navigate to it from your FireEye Helix app home page by clicking on the user icon on the top right, and choosing HELIX Settings. You'll be redirected to the HELIX Settings page, where API KEYS can be found.

Configure FireEyeHelix on Demisto

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for FireEyeHelix.

  3. Click Add instance to create and configure a new integration instance.

    ParameterDescriptionExample
    NameA meaningful name for the integration instance.FireEyeHelix_instance_1
    Server URLThe URL to the FireEye server, including the scheme.https://apps.fireeye.com
    Customer IDThe ID used by the customer to gain access to the integration.N/A
    API TokenThe private token granting access to the integration.N/A
    First Fetch TimestampThe time period for which to fetch incidents in \<number> \<time unit> format.12 hours, 7 days, 3 months, 1 year
    Fetch Incident QueryWhether to fetch the incidents or not.N/A
    Incident TypeThe type of incident to select.Phishing
    Trust any certificate (not secure)When selected, certificates are not checked.N/A
    Use System Proxy SettingsRuns the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration.https://proxyserver.com
  1. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Demisto CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get all alerts


Returns all alerts.

Base Command

fireeye-helix-list-alerts

Input
Argument NameDescriptionRequired
page_sizeThe maximum number of results to return per page.Optional
offsetThe initial index from which to return the results.Optional
headersThe Output values to display in the command result (comma-separated values with no spaces) as they appear in the context. For example, "ID" , "Name", or "Hostname".Optional
Context Output
PathTypeDescription
FireEyeHelix.Alert.IDNumberThe primary ID of the alert.
FireEyeHelix.Alert.AlertTypeIDNumberThe ID of the alert type.
FireEyeHelix.Alert.AlertTypeNameStringThe name of the alert type.
FireEyeHelix.Alert.AssigneeIDStringThe ID of the assignee.
FireEyeHelix.Alert.AssigneeNameStringThe display name of the assignee.
FireEyeHelix.Alert.CreatorIDStringThe ID of the user who created the alert.
FireEyeHelix.Alert.CreatorNameStringThe name of the user who created the alert.
FireEyeHelix.Alert.UpdaterIDStringThe ID of the user who updated the alert.
FireEyeHelix.Alert.UpdaterNameStringThe Name of the user who updated the alert.
FireEyeHelix.Alert.CreatedTimeDateThe time the alert was created.
FireEyeHelix.Alert.ModifiedTimeDateThe time the alert was modified.
FireEyeHelix.Alert.ProcessPathStringThe path of the process.
FireEyeHelix.Alert.ConfidenceStringThe FireEye Helix confidence with the result.
FireEyeHelix.Alert.SHA1StringThe SHA1 hash of the file.
FireEyeHelix.Alert.MD5StringThe MD5 hash of the file.
FireEyeHelix.Alert.HostnameStringThe hostname of the alert.
FireEyeHelix.Alert.PIDNumberThe process ID.
FireEyeHelix.Alert.SizeNumberThe size of the process in bytes.
FireEyeHelix.Alert.ViruesStringTHe virus name.
FireEyeHelix.Alert.ResultStringThe result of the alert.
FireEyeHelix.Alert.MalwareTypeStringThe malware type.
FireEyeHelix.Alert.FilenameStringThe name of the file that contains the virus.
FireEyeHelix.Alert.RegPathStringThe registry key path.
FireEyeHelix.Alert.EventTimeDateThe time of the event.
FireEyeHelix.Alert.IOCNamesStringThe indicator of the compromise names.
FireEyeHelix.Alert.ProcessStringThe name of the process that created the event.
FireEyeHelix.Alert.ParentProcessStringThe name of the parent process of the process that created the event.
FireEyeHelix.Alert.SourceIPv4StringThe source IP address of the event (IPv4).
FireEyeHelix.Alert.SourceIPv6StringThe source IP address of the event (IPv6).
FireEyeHelix.Alert.DestinationIPv4StringThe destination IP address of the event (IPv4).
FireEyeHelix.Alert.DestinationIPv6StringThe destination IP address of the event (IPv6).
FireEyeHelix.Alert.DestinationPortStringThe destination port of the event.
FireEyeHelix.Alert.URIStringThe URI address that created the event.
FireEyeHelix.Alert.HttpMethodStringThe HTTP method of the request that was called.
FireEyeHelix.Alert.DomainStringThe domain of the URI that created the event.
FireEyeHelix.Alert.UserAgentStringThe user agent related to the event.
FireEyeHelix.Alert.EventsCountNumberThe number of events in the alert.
FireEyeHelix.Alert.NotesCountNumberThe number of notes in the alert.
FireEyeHelix.Alert.ClosedStateStringThe status of the alert in regards to it being closed.
FireEyeHelix.Alert.ClosedReasonStringThe reason the alert was closed.
FireEyeHelix.Alert.ConfidenceStringThe Helix confidence level of the alert.
FireEyeHelix.Alert.DescriptionStringThe description of the alert.
FireEyeHelix.Alert.FirstEventTimeDateThe time that the first event occurred.
FireEyeHelix.Alert.LastEventTimeDateThe time that the last event occurred.
FireEyeHelix.Alert.ExternalIPStringThe external IP addresses for the alert.
FireEyeHelix.Alert.InternalIPStringThe internal IP addresses for the alert.
FireEyeHelix.Alert.MessageStringThe message of the alert.
FireEyeHelix.Alert.ProductsStringThe source of the alert.
FireEyeHelix.Alert.RiskStringThe risk of the events in the alert.
FireEyeHelix.Alert.SeverityStringThe severity of the events in the alert.
FireEyeHelix.Alert.StateStringThe state of the alert. Can be "Open", "Suppressed", "Closed", or "Reopened".
FireEyeHelix.Alert.TagStringThe tag of the alert.
FireEyeHelix.Alert.TypeStringThe alert type.
FireEyeHelix.Alert.CountStringThe number of alerts.
Command Example
!fireeye-helix-list-alerts page_size=2
Human Readable Output
FireEye Helix - List alerts:
Page 1/58
IDNameDescriptionStateSeverity
123HXFireEye HX detected and quarantined malware on this system.OpenMedium
32HXThis rule alerts on IOC.OpenMedium

Get alert details by ID


Returns alert details, by alert ID.

Base Command

fireeye-helix-get-alert-by-id

Input
Argument NameDescriptionRequired
idThe ID of the alert.Required
headersA comma-separated list (no spaces) of output values to display in the command result. For example, "ID", "Name" ,or "Hostname".Optional
Context Output
PathTypeDescription
FireEyeHelix.Alert.IDNumberThe primary ID of the alert.
FireEyeHelix.Alert.AlertTypeIDNumberThe ID of the alert type.
FireEyeHelix.Alert.AlertTypeNameStringThe name of the alert type.
FireEyeHelix.Alert.AssigneeIDStringThe ID of the alert assignee.
FireEyeHelix.Alert.AssigneeNameStringThe Assignee display name.
FireEyeHelix.Alert.CreatorIDStringThe ID of the user who created the alert.
FireEyeHelix.Alert.CreatorNameStringThe name of the user who created the alert.
FireEyeHelix.Alert.UpdaterIDStringThe name of the user who updated the alert.
FireEyeHelix.Alert.UpdaterNameStringThe name of the user who updated the alert.
FireEyeHelix.Alert.CreatedTimeDateThe time the alert was created.
FireEyeHelix.Alert.ModifiedTimeDateThe time the alert was last modified.
FireEyeHelix.Alert.ProcessPathStringThe path of the process.
FireEyeHelix.Alert.ConfidenceStringThe Helix confidence level of the alert.
FireEyeHelix.Alert.SHA1StringThe SHA1 hash of the file.
FireEyeHelix.Alert.MD5StringThe MD5 hash of the file.
FireEyeHelix.Alert.HostnameStringThe hostname of the alert.
FireEyeHelix.Alert.PIDNumberThe process ID.
FireEyeHelix.Alert.SizeNumberThe size of the process in bytes.
FireEyeHelix.Alert.VirusStringThe virus name.
FireEyeHelix.Alert.ResultStringThe result of the alert.
FireEyeHelix.Alert.MalwareTypeStringTHe malware type.
FireEyeHelix.Alert.FilenameStringThe name of the file that contains the virus.
FireEyeHelix.Alert.RegPathStringThe registry key path.
FireEyeHelix.Alert.EventTimeDateThe time that the event occurred.
FireEyeHelix.Alert.IOCNamesStringThe Indicator of Compromise names.
FireEyeHelix.Alert.ProcessStringThe name of the process that created the event.
FireEyeHelix.Alert.ParentProcessStringThe name of the parent process to the process that created the event.
FireEyeHelix.Alert.SourceIPv4StringThe source IP address of the event (IPv4).
FireEyeHelix.Alert.SourceIPv6StringTHe source IP address of the event (IPv6).
FireEyeHelix.Alert.DestinationIPv4StringThe destination IP address of the event (IPv4).
FireEyeHelix.Alert.DestinationIPv6StringThe destination IP address of the event (IPv6).
FireEyeHelix.Alert.DestinationPortStringThe destination port of the event.
FireEyeHelix.Alert.URIStringThe URI address that created the event.
FireEyeHelix.Alert.HttpMethodStringThe HTTP method of the request that was called.
FireEyeHelix.Alert.DomainStringThe domain of the URI that created the event.
FireEyeHelix.Alert.UserAgentStringThe user agent related to the event.
FireEyeHelix.Alert.EventsCountNumberThe number of events in the alert.
FireEyeHelix.Alert.NotesCountNumberThe number of notes in the alert.
FireEyeHelix.Alert.ClosedStateStringThe state the alert is in regards to it being closed.
FireEyeHelix.Alert.ClosedReasonStringThe reason the alert was closed.
FireEyeHelix.Alert.ConfidenceStringThe Helix confidence level of the alert.
FireEyeHelix.Alert.DescriptionStringThe description of the alert.
FireEyeHelix.Alert.FirstEventTimeDateThe time that the first event occurred.
FireEyeHelix.Alert.LastEventTimeDateThe time that the last event occurred.
FireEyeHelix.Alert.ExternalIPStringThe external IP addresses for the alert.
FireEyeHelix.Alert.InternalIPStringThe internal IP addresses for the alert.
FireEyeHelix.Alert.MessageStringThe message of the alert.
FireEyeHelix.Alert.ProductsStringThe source of the alert.
FireEyeHelix.Alert.RiskStringThe risk of the events in the alert.
FireEyeHelix.Alert.SeverityStringThe severity of the events in the alert.
FireEyeHelix.Alert.StateStringThe state of the alert. Can be "Open", "Suppressed", "Closed", or "Reopened".
FireEyeHelix.Alert.TagStringThe tag of the alert.
FireEyeHelix.Alert.TypeStringThe alert type.
FireEyeHelix.Alert.CountStringThe number of alerts.
Command Example
!fireeye-helix-get-alert-by-id id=3232
Human Readable Output
FireEye Helix - Alert 3232:
AlertTypeIDClosedStateConfidenceCreatedTimeCreatorIDCreatorNameDescriptionEventsCountFileNameFirstEventTimeHostnameIDLastEventTimeMD5MalwareTypeMessageModifiedTimeNameNotesCountPIDProcessPathProductsResultRiskSHA1SeverityStateTagsTypeUpdaterIDUpdaterNameVirus
1793Unknownhigh2019-03-30T19:40:16.132456ZidSystem UserFireEye HX detected and quarantined malware on this system.2c:\users\demon\appdata\local\temp2019-03-30T14:07:34.132456ZZhelix.apps.fireeye.com1232019-03-31T14:08:07.132456ZZmd5malwareFIREEYE H2019-10-20T12:35:02.132456ZHX011c:\windows\microsoft.net\framework\v7.0.30319\csc.exehx: 2quarantinedMediumsha1MediumOpenfireeyefireeye_ruleidGeorgegen:variant.ursu

Create an alert note


Creates an alert note.

Base Command

fireeye-helix-alert-create-note

Input
Argument NameDescriptionRequired
alert_idThe ID of the alert for which the note is being created.Required
noteThe note to add to the alert.Required
Context Output
PathTypeDescription
FireEyeHelix.Note.IDNumberThe ID of the note.
FireEyeHelix.Note.CreatedTimeDateThe time the note was created.
FireEyeHelix.Note.UpdatedTimeDateThe time the note was updated.
FireEyeHelix.Note.MessageStringThe message of the note.
FireEyeHelix.Note.CreatorIDStringThe ID of the note creator.
FireEyeHelix.Note.CreatorNameStringThe name of the note creator.
FireEyeHelix.Note.AlertIDNumberThe ID of the related alert.
Command Example
!fireeye-helix-alert-create-note note=This is a note test alert_id=3232
Human Readable Output
FireEye Helix - Created Note for Alert 3232:
IDCreator NameMessageCreated Time
9GeorgeThis is a note test2019-10-28T07:41:30.396000Z

List event alerts


Lists events alerts for a specific alert.

Base Command

fireeye-helix-get-events-by-alert

Input
Argument NameDescriptionRequired
alert_idThe alert ID for which to get events.Required
headersA comma-separated list (no spaces) of output values to display in the command result. For example, "ID", "Type" , "SourceIPv4".Optional
Context Output
PathTypeDescription
FireEyeHelix.Event.IDStringThe ID of the event.
FireEyeHelix.Event.TypeStringThe event type.
FireEyeHelix.Event.ResultStringThe result of the event.
FireEyeHelix.Event.MatchedAtDateThe time that the event was matched.
FireEyeHelix.Event.ConfidenceStringThe confidence of the event. Can be "low", "medium", or "high".
FireEyeHelix.Event.StatusStringThe status of the event.
FireEyeHelix.Event.EventTimeDateThe time that the event occurred.
FireEyeHelix.Event.DetectedRuleIDStringThe ID of the detected rule.
FireEyeHelix.Event.PIDStringThe ID of the process.
FireEyeHelix.Event.ProcessStringThe process details.
FireEyeHelix.Event.ProcessPathStringThe process path.
FireEyeHelix.Event.FileNameStringThe name of the file affected by the event.
FireEyeHelix.Event.FilePathStringThe path of the the file affected by the event.
FireEyeHelix.Event.DeviceNameStringThe name of the device.
FireEyeHelix.Event.SizeStringThe size of the file (in bytes) that created the event.
FireEyeHelix.Event.VirusStringThe virus that was detected in the event.
FireEyeHelix.Event.MalwareTypeStringThe malware type of the virus that was detected.
FireEyeHelix.Event.CreatedTimeDateThe time that the event was created.
FireEyeHelix.Event.ClassStringThe event class.
FireEyeHelix.Event.MD5StringThe MD5 hash of the affected file.
FireEyeHelix.Event.SHA1StringThe SHA1 hash of the affected file.
FireEyeHelix.Event.ProtocolStringThe protocol used in the event.
FireEyeHelix.Event.SourceIPv4StringThe IPv4 address of the event source.
FireEyeHelix.Event.SourceIPv6StringThe IPv6 address of the event source.
FireEyeHelix.Event.SourcePortStringThe port of the event source address.
FireEyeHelix.Event.SourceLongitudeStringThe longitude of the event source address.
FireEyeHelix.Event.SourceLatitudeStringThe latitude of the event source address.
FireEyeHelix.Event.DestinationIPv4StringThe IPv4 address of the event destination.
FireEyeHelix.Event.DestinationIPv6StringThe IPv6 address of the event destination.
FireEyeHelix.Event.DestinationPortStringThe port of the event destination address.
FireEyeHelix.Event.ReportTimeDateThe time that the event was reported.
FireEyeHelix.Event.FalsePositiveStringWhether the event is a false positive.
FireEyeHelix.Event.DomainStringThe domain of the recipient.
FireEyeHelix.Event.FromStringThe source email address.
FireEyeHelix.Event.SourceDomainStringThe domain of the host that created the event.
FireEyeHelix.Event.SourceISPStringThe ISP of the source of the event.
FireEyeHelix.Event.DestinationISPStringThe ISP of the destination of the event.
FireEyeHelix.Event.ToStringThe destination email address.
FireEyeHelix.Event.AttachmentUnknownThe email attachment.
FireEyeHelix.Event.CountNumberThe total number of events.
Command Example
!fireeye-helix-get-events-by-alert alert_id=3232
Human Readable Output
FireEye Helix - Events for alert 3232:
ClassDetected Rule IDEvent TimeFalse PositiveIDMD5Matched AtPIDProcessProcess PathReport TimeResultType
fireeye_hx_alert992019-09-13T06:51:59.000Zfalse101md52019-08-11t06:51:40.000z404net1c:\windows\system32\et1.exe2019-09-13t06:53:08.000alertprocessevent

Get a specific alert


Retrieves a specific alert from an helix endpoint.

Base Command

fireeye-helix-get-endpoints-by-alert

Input
Argument NameDescriptionRequired
alert_idThe ID of an alert.Required
offsetThe offset to the result. The default is 0.Optional
Context Output
PathTypeDescription
FireEyeHelix.Endpoint.IDNumberThe ID of the endpoint.
FireEyeHelix.Endpoint.CustomerIDStringThe ID of the customer.
FireEyeHelix.Endpoint.DeviceIDStringThe ID of the device.
FireEyeHelix.Endpoint.DomainStringThe domain of the endpoint.
FireEyeHelix.Endpoint.HostnameStringThe hostname of the endpoint.
FireEyeHelix.Endpoint.MACAddressStringThe MAC address of the endpoint.
FireEyeHelix.Endpoint.OSStringThe operating system of the endpoint.
FireEyeHelix.Endpoint.IPStringThe IP address of the endpoint.
FireEyeHelix.Endpoint.UpdatedTimeDateThe time the endpoint was last updated.
FireEyeHelix.Endpoint.ContainmentStateStringThe containment state of the endpoint.
FireEyeHelix.Endpoint.CountNumberThe total number of endpoints.
Command Example
!fireeye-helix-get-endpoints-by-alert alert_id=3232 offset=0
Human Readable Output
FireEye Helix - Endpoints for alert 3232:
IDDevice IDHostnameIPMAC AddressUpdated Time
191device_idDemistoprimary_ip_addressmac_addressupdated_at

Get alert cases


Returns cases of an alert.

Base Command

fireeye-helix-get-cases-by-alert

Input
Argument NameDescriptionRequired
alert_idThe ID of an alert.Required
page_sizeThe number of results to return per page.Optional
offsetThe initial index from which to return the results.Optional
order_byThe field by which to order the results.Optional
Context Output
PathTypeDescription
FireEyeHelix.Case.AlertsCountNumberThe number of alerts related to the case.
FireEyeHelix.Case.AssigneeIDStringThe ID of the assignee.
FireEyeHelix.Case.AssigneeNameStringThe name of the assignee.
FireEyeHelix.Case.CreatorIDStringThe ID of the case creator.
FireEyeHelix.Case.CreatorNameStringThe name of the case creator.
FireEyeHelix.Case.UpdaterIDStringThe ID of the user who last updated the case.
FireEyeHelix.Case.UpdaterNameStringThe name of the user who last updated the case.
FireEyeHelix.Case.CreatedTimeDateThe time that the case was created.
FireEyeHelix.Case.ModifiedTimeDateThe time that the case was last modified.
FireEyeHelix.Case.DescriptionStringThe case description.
FireEyeHelix.Case.EventsCountNumberThe number of events in the case.
FireEyeHelix.Case.IDNumberThe ID of the case.
FireEyeHelix.Case.InfoLinksUnknownThe informational or reference links.
FireEyeHelix.Case.NameStringThe name of the case.
FireEyeHelix.Case.NotesCountNumberThe number of notes in the case.
FireEyeHelix.Case.PriorityStringProvides an indication of the order in which the case should be examined as compared to other cases. Can be, "Critical", "High", "Medium", or "Low".
FireEyeHelix.Case.PriorityOrderNumberProvides an indication of the order in which the case should be examined as compared to other cases. Can be "4", "3", "2", or "1".
FireEyeHelix.Case.SeverityNumberThe potential impact that the case could have on the organization if it is a true positive. This is calculated based on the risk of the alert.
FireEyeHelix.Case.StateStringThe state of the case.
FireEyeHelix.Case.StatusStringThe cases with the following statuses are considered open, "Declared", "Scoped", or "Contained".
Cases with the following statuses are considered closed, "Recovered", or "Improved".
FireEyeHelix.Case.TagsUnknownThe tags of the case.
FireEyeHelix.Case.TotalDaysUnresolvedNumberThe number of days the case has been unresolved.
FireEyeHelix.Case.CountNumberThe total number of cases.
Command Example
!fireeye-helix-get-cases-by-alert alert_id=3232 offset=0 page_size=1
Human Readable Output
FireEye Helix - Cases for alert 3232:
IDNamePrioritySeverityStateStatusModifiedTime
35demisto test caseCritical10TestingDeclaredupdated_at

Get lists


Returns lists.

Base Command

fireeye-helix-get-lists

Input
Argument NameDescriptionRequired
page_sizeThe number of results to return per page.Optional
offsetThe initial index from which to return the results.Optional
usageThe multiple values. May be separated by commas.Optional
created_atThe date that the list was created.Optional
descriptionThe description of the list.Optional
is_activeWhether the list is active. Can be, "true" or "false".Optional
is_internalWhether the list is internal. Can be, "true" or "false".Optional
is_protectedWhether the list is protected. Can be, "true" or "false".Optional
nameThe name of the list.Optional
short_nameThe short name of the list.Optional
typeThe list type.Optional
updated_atThe time the list was last updated.Optional
order_byThe field by which to order the results.Optional
Context Output
PathTypeDescription
FireEyeHelix.List.IDNumberThe list of IDs.
FireEyeHelix.List.DescriptionNumberThe list's description.
FireEyeHelix.List.ShortNameStringThe short name of the list.
FireEyeHelix.List.NameStringThe name of the list.
FireEyeHelix.List.ContentTypesStringThe content types of the list. Can be, "Email", "FQDN", "IPv4", "Ipv6", "SHA1", "MD5", or "Misc".
FireEyeHelix.List.CreatorIDStringThe ID of the creator.
FireEyeHelix.List.CreatorNameStringThe name of the creator.
FireEyeHelix.List.UpdatedByIDStringThe ID of the user who last updated the list.
FireEyeHelix.List.CreatedTimeDateThe time that the rule was created.
FireEyeHelix.List.UpdatedTimeDateThe time that the rule was last updated.
FireEyeHelix.List.TypeStringThe list type. Can be "Default", "Analytics Whitelist", or "Intel Matching".
FireEyeHelix.List.UpdatedByNameStringThe user who last updated the list.
FireEyeHelix.List.InternalBooleanWhether the list is internal. Can be "true" or "false".
FireEyeHelix.List.ProtectedBooleanWhether the list is protected. Can be "true" or "false".
FireEyeHelix.List.ActiveUnknownWhether the list is active. Can be "true" or "false".
FireEyeHelix.List.CountNumberThe total number of lists.

Get a specific list by ID


Returns a specific list by list ID.

Base Command

fireeye-helix-get-list-by-id

Input
Argument NameDescriptionRequired
idThe ID of the list.Required
Context Output
PathTypeDescription
FireEyeHelix.List.IDNumberThe ID of the list.
FireEyeHelix.List.DescriptionNumberThe list description.
FireEyeHelix.List.ShortNameStringThe short name of the list.
FireEyeHelix.List.NameStringThe name of the list.
FireEyeHelix.List.ContentTypesStringThe content types of the list. Can be "Email", "FQDN", "IPv4", "Ipv6", "SHA1", "MD5", or "Misc".
FireEyeHelix.List.CreatorIDStringThe ID of the creator.
FireEyeHelix.List.CreatorNameStringThe name of the creator.
FireEyeHelix.List.UpdatedByIDStringThe ID of the user who last updated the list.
FireEyeHelix.List.CreatedTimeDateThe time that the rule was created.
FireEyeHelix.List.UpdatedTimeDateThe time that the rule was last updated.
FireEyeHelix.List.TypeStringThe list type. Can be "Default", "Analytics Whitelist", or "Intel Matching".
FireEyeHelix.List.UpdatedByNameStringThe name of the user who last updated the list.
FireEyeHelix.List.InternalBooleanWhether the list is internal. Can be "true" or "false".
FireEyeHelix.List.ProtectedBooleanWhether the list is protected. Can be "true" or "false".
FireEyeHelix.List.ActiveUnknownWhether the list is active. Can be "true" or "false".

Create a list


Creates a list.

Base Command

fireeye-helix-create-list

Input
Argument NameDescriptionRequired
nameThe name of the list.Required
short_nameThe short name of the list.Optional
is_internalWhether the list is internal. Can be "true" or "false".Optional
is_activeWhether the list is active. Can be "true" or "false".Optional
is_protectedWhether the list is protected. Can be "true" or "false".Optional
usageA comma-separated list of list uses.Optional
is_hiddenWhether the list is hidden. Can be "true" or "false".Optional
typeThe list type.Optional
descriptionThe description of the list.Optional
Context Output
PathTypeDescription
FireEyeHelix.List.IDNumberThe list ID.
FireEyeHelix.List.DescriptionNumberThe list description.
FireEyeHelix.List.ShortNameStringThe sShort name of the list.
FireEyeHelix.List.NameStringThe name of the list.
FireEyeHelix.List.ContentTypesStringThe content types of the list. Can be "Email", "FQDN", "IPv4", "IPv6", "SHA1", "MD5", or "Misc".
FireEyeHelix.List.CreatorIDStringThe ID of the list creator.
FireEyeHelix.List.CreatorNameStringThe name of the list creator.
FireEyeHelix.List.UpdatedByIDStringThe ID of the user who last updated the list.
FireEyeHelix.List.CreatedTimeDateThe time that the rule was created.
FireEyeHelix.List.UpdatedTimeDateThe time that the rule was last updated.
FireEyeHelix.List.TypeStringThe list type. Can be "Default", "Analytics Whitelist", or "Intel Matching".
FireEyeHelix.List.UpdatedByNameUnknownThe name of the user who last updated the list.
FireEyeHelix.List.InternalBooleanWhether the list is internal. Can be "true" or "false".
FireEyeHelix.List.ProtectedBooleanWhether the list is protected. Can be "true" or "false".
FireEyeHelix.List.ActiveUnknownWhether the list is active. Can be "true" or "false".

Update a list


Updates an existing list.

Base Command

fireeye-helix-update-list

Input
Argument NameDescriptionRequired
nameThe name of the list to update.Optional
short_nameThe short name of the list.Optional
is_internalWhether the list is internal. Can be "true" or "false".Optional
is_activeWhether the list is active. Can be "true" or "false".Optional
is_protectedWhether the list is protected. Can be "true" or "false".Optional
usageA comma-separated list of list uses.Optional
is_hiddenWhether the list is hidden. Can be "true" or "false".Optional
typeThe list type.Optional
descriptionThe description of the list.Optional
list_idThe ID of the list.Required
Context Output
PathTypeDescription
FireEyeHelix.List.IDNumberThe ID of the list.
FireEyeHelix.List.DescriptionNumberThe list description.
FireEyeHelix.List.ShortNameStringThe short name of the list.
FireEyeHelix.List.NameStringThe name of the list.
FireEyeHelix.List.ContentTypesStringThe content types of the list. Can be "Email", "FQDN", "IPv4", "IPv6", "SHA1", "MD5", or "Misc".
FireEyeHelix.List.CreatorIDStringThe ID of the creator.
FireEyeHelix.List.CreatorNameStringThe name of the creator.
FireEyeHelix.List.UpdatedByIDStringThe ID of the user who last updated the list.
FireEyeHelix.List.CreatedTimeDateThe time that the rule was created.
FireEyeHelix.List.UpdatedTimeDateThe time that the rule was last updated.
FireEyeHelix.List.TypeStringThe list type. Can be "Default", "Analytics Whitelist", or "Intel Matching".
FireEyeHelix.List.UpdatedByNameUnknownThe name of the user who last updated the list.
FireEyeHelix.List.InternalBooleanWhether the list is internal. Can be "true" or "false".
FireEyeHelix.List.ProtectedBooleanWhether the list is protected. Can be "true" or "false".
FireEyeHelix.List.ActiveUnknownWhether the list is active. Can be "true" or "false".

Delete a list


Deletes a single list by list ID.

Base Command

fireeye-helix-delete-list

Input
Argument NameDescriptionRequired
list_idThe ID of the list to delete.Required
Context Output

There is no context output for this command.

Fetch all sensors


Fetches all sensors.

Base Command

fireeye-helix-list-sensors

Input
Argument NameDescriptionRequired
page_sizeThe maximum number of results to return per page.Optional
offsetThe initial index from which to return the results.Optional
hostnameThe host name of the sensor.Optional
statusThe status of the sensor.Optional
Context Output

There is no context output for this command.

Get all rules


Returns all rules.

Base Command

fireeye-helix-list-rules

Input
Argument NameDescriptionRequired
page_sizeThe maximum number of results to return per page.Optional
offsetThe initial index from which to return the results.Optional
sortA comma-separated list of field names by which to sort the results. For example, “createDate” or "-updateDate,riskOrder"Optional
Context Output
PathTypeDescription
FireEyeHelix.Rule.IDStringThe rule ID.
FireEyeHelix.Rule.RulePackStringThe rule package version.
FireEyeHelix.Rule.DescriptionStringThe rule description.
FireEyeHelix.Rule.InternalBooleanWhether the rule is internal. Can be "true" or "false".
FireEyeHelix.Rule.DeletedBooleanWhether the rule was deleted. Can be "true" or "false".
FireEyeHelix.Rule.EnabledBooleanWhether the rule is enabled. Can be "true" or "false".
FireEyeHelix.Rule.SupportedBooleanWhether the rule is supported. Can be "true" or "false".
FireEyeHelix.Rule.CreatorIDStringThe ID of the rule creator.
FireEyeHelix.Rule.CreatorNameStringThe name of the rule creator.
FireEyeHelix.Rule.UpdatedByIDStringThe ID of the user who updated the rule.
FireEyeHelix.Rule.UpdatedByNameStringThe name of the user who updated the rule.
FireEyeHelix.Rule.RiskStringThe risk to your environment when an event matches this rule. Can be "low", "medium", "high", or "critical".
FireEyeHelix.Rule.ConfidenceStringThe confidence that indicates how likely it is that the rule will detect events that correspond to the type of activity anticipated. (The likelihood that the rule will produce true positives). Confidence and Severity combine to form the risk attribute of the alert. Can be "low", "medium", or "high".
FireEyeHelix.Rule.SeverityStringThe severity that indicates how much of an impact a hit with this rule could have on an organization if
verified to be a true positive. Confidence and Severity combine to form the risk attribute of the alert. Can be "low", "medium", or "high".
FireEyeHelix.Rule.TagsStringThe tags of the rule.
FireEyeHelix.Rule.TypeStringThe type of the rule.
Command Example
!fireeye-helix-list-rules offset=1
Human Readable Output
FireEye Helix - List rules:
IDTypeDescriptionRiskConfidenceSeverityEnabled
1.1.1alertdemistoMediumMediumMediumtrue

Edit an existing rule


Modifies an existing rule.

Base Command

fireeye-helix-edit-rule

Input
Argument NameDescriptionRequired
enabledWhether the rule is enabled. Can be "true" or "false".Optional
rule_idThe ID of the rule.Required
Context Output

There is no context output for this command.

Command Example
!fireeye-helix-edit-rule rule_id=1.1.1 enabled=true
Human Readable Output
FireEye Helix - Successfully updated rule 1.1.1:
IDTypeDescriptionRiskConfidenceSeverity
1.1.1alertdemistoMediumMediumMedium

Get all notes related to an alert


Returns all notes related to an alert.

Base Command

fireeye-helix-alert-get-notes

Input
Argument NameDescriptionRequired
alert_idThe ID of the alert.Required
Context Output
PathTypeDescription
FireEyeHelix.Note.IDNumberThe ID of the note.
FireEyeHelix.Note.CreatedTimeDateThe time that the note was created.
FireEyeHelix.Note.UpdatedTimeDateThe time that the note was updated.
FireEyeHelix.Note.MessageStringThe message of the note.
FireEyeHelix.Note.CreatorIDStringThe ID of the note creator.
FireEyeHelix.Note.CreatorNameStringThe name of the note creator.
FireEyeHelix.Note.AlertIDNumberThe ID of the related alert.
FireEyeHelix.Note.CountNumberThe total number of notes for the alert.
Command Example
!fireeye-helix-alert-get-notes id=3232
Human Readable Output
FireEye Helix - Notes for Alert None:
IDCreator NameMessageCreated Time
9GeorgeThis is a note test2019-10-28T07:41:30.396000Z
91GeorgeWhat a great note this is2019-10-24T13:52:19.021299Z

Delete a note's alert


Deletes a note's alert.

Base Command

fireeye-helix-alert-delete-note

Input
Argument NameDescriptionRequired
alert_idThe ID of the alert to delete.Required
note_idThe ID of the note.Required
Context Output

There is no context output for this command.

Preform a search


Executes a search in FireEye Helix using MQL.

Base Command

fireeye-helix-search

Input
Argument NameDescriptionRequired
startThe start time of the event in the format yyyy-mm-dd or yyyy-mm.Optional
endThe end time of the event in the format yyyy-mm-dd or yyyy-mm.Optional
page_sizeThe maximum number of results to return.Optional
offsetThe offset of the result.Optional
groupbyReturns the unique values for the specified field and groups them based on the specified frequency. For example, groupby="srcipv4 5 100" will group the top five srcipv4 addresses that have at least 100 occurrences. Supports comma-separated values.Optional
sort_byThe field by which to sort the results.Optional
sort_orderThe order of the results sorted by the sort_by argument. Can be "asc" for ascending, or "desc" for descending. The default is "desc".Optional
queryThe query to execute. This is the search clause in an MQL.Required
limitThe number of events to search.Optional
headersA comma-separated list (no spaces) of output values to display in the command result. For example, "ID", "Type", or "SourceIPv4".Optional
Context Output
PathTypeDescription
FireEyeHelixSearch.Result.IDStringThe ID of the event.
FireEyeHelixSearch.Result.TypeStringThe event type.
FireEyeHelixSearch.Result.ResultStringThe event result.
FireEyeHelixSearch.Result.MatchedAtDateThe time that the event was matched.
FireEyeHelixSearch.Result.ConfidenceStringThe confidence of the event. Can be "low", "medium", or "high".
FireEyeHelixSearch.Result.StatusStringThe status of the event.
FireEyeHelixSearch.Result.EventTimeDateThe time that the event occurred.
FireEyeHelixSearch.Result.DetectedRuleIDStringThe ID of the detected rule.
FireEyeHelixSearch.Result.PIDStringThe process ID.
FireEyeHelixSearch.Result.ProcessStringThe process details.
FireEyeHelixSearch.Result.ProcessPathStringThe process path.
FireEyeHelixSearch.Result.FileNameStringThe name of the file affected by the event.
FireEyeHelixSearch.Result.FilePathStringThe path of the the file affected by the event.
FireEyeHelixSearch.Result.DeviceNameStringThe device name.
FireEyeHelixSearch.Result.SizeStringThe size of the file (in bytes) that created the event.
FireEyeHelixSearch.Result.VirusStringThe virus that was detected in the event.
FireEyeHelixSearch.Result.MalwareTypeStringThe malware type of the virus that was detected.
FireEyeHelixSearch.Result.CreatedTimeDateThe time that the event was created.
FireEyeHelixSearch.Result.ClassStringThe event class.
FireEyeHelixSearch.Result.MD5StringThe MD5 hash of the affected file.
FireEyeHelixSearch.Result.SHA1StringThe SHA1 hash of the affected file.
FireEyeHelixSearch.Result.ProtocolStringThe protocol used in the event.
FireEyeHelixSearch.Result.SourceIPv4StringThe IPv4 address of the event source.
FireEyeHelixSearch.Result.SourceIPv6StringThe IPv6 address of the event source.
FireEyeHelixSearch.Result.SourcePortStringThe port of the event source address.
FireEyeHelixSearch.Result.SourceLongitudeStringThe longitude of the event source address.
FireEyeHelixSearch.Result.SourceLatitudeStringThe latitude of the event source address.
FireEyeHelixSearch.Result.DestinationIPv4StringThe IPv4 address of the event destination.
FireEyeHelixSearch.Result.DestinationIPv6StringThe IPv6 address of the event destination.
FireEyeHelixSearch.Result.DestinationPortStringThe port of the event destination address.
FireEyeHelixSearch.Result.ReportTimeDateThe time that the event was reported.
FireEyeHelixSearch.Result.FalsePositiveStringWhether the event is a false positive.
FireEyeHelixSearch.Result.DomainStringThe domain of the recipient.
FireEyeHelixSearch.Result.FromStringThe source email address.
FireEyeHelixSearch.Result.SourceDomainStringThe domain of the host that created the event.
FireEyeHelixSearch.Result.SourceISPStringThe ISP of the source of the event.
FireEyeHelixSearch.Result.DestinationISPStringThe ISP of the destination of the event.
FireEyeHelixSearch.Result.ToStringThe destination email address.
FireEyeHelixSearch.Result.AttachmentUnknownThe email attachment.
FireEyeHelixSearch.MQLStringThe MQL query that created the result.
FireEyeHelixSearch.GroupByUnknownThe group by values.
FireEyeHelixSearch.GroupBy.DocCountNumberThe number of matches for the group.
FireEyeHelixSearch.Result.RcpToStringThe recipient email address.
FireEyeHelixSearch.Result.InReplyToStringThe reply email address.
Command Example
!fireeye-helix-search query=domain:google.com start="4 days ago" groupby=subject limit=1 page_size=2
Human Readable Output
FireEye Helix - Search result for domain:google.com and meta_ts>=2019-10-25T09:07:43.810Z {page_size:2 offset:1 limit:1} | groupby subject sep=|%$,$%|
ClassDomainEvent TimeFromIDIn Reply ToSource DomainSource I Pv 4Source ISPSource LatitudeSource LongitudeStatusToType
fireeye_etpmx.google.com2019-10-28T10:43:11.000Zde@demisto.comdemistodemistogoogle.com8.8.8.8google llc37.40599060058594-122.0785140991211delivereddemisto@demisto.comtrace
fireeye_etpgmr-mx.google.com2019-10-29T05:08:39.000Zdem@demisto.comdemistodemisto@demisto.comgoogle.com8.8.8.8google llc37.40599060058594-122.0785140991211delivereddemisto@demisto.comtrace
Group By
subjectDocCount
google alert - gold3
accepted: meeting1
invitation: Declined1

Add an item to a list


Adds an item to a list.

Base Command

fireeye-helix-add-list-item

Input
Argument NameDescriptionRequired
typeThe item type. Can be, "email", "fqdn", "ipv4", "ipv6", "md5", "misc", or "sha-1".Required
valueThe item value.Required
list_idThe ID of the list.Required
riskThe risk of the item. Can be, "Low", "Medium", "High", or "Critical".Optional
notesThe item notes.Optional
Context Output
PathTypeDescription
FireEyeHelixList.Item.IDNumberThe ID of the item.
FireEyeHelixList.Item.ValueStringThe value of the item.
FireEyeHelixList.Item.TypeStringThe type of the item. Can be "email", "fqdn", "ipv4", "ipv6", "md5", "misc", or "sha-1".
FireEyeHelixList.Item.RiskStringThe risk of the item. Can be "Low", "Medium", "High", or "Critical".
FireEyeHelixList.Item.NotesStringThe notes of the item.
FireEyeHelixList.Item.ListIDStringThe list ID with which the item is associated.
Command Example
!fireeye-helix-add-list-item list_id=3232 value=test type=misc risk=Low
Human Readable Output
FireEye Helix - List item 163 was added successfully to 3232
IDListIDNotesRiskTypeValue
1633232test okMediummiscaTest list

Fetch list items


Fetches the items of a list.

Base Command

fireeye-helix-get-list-items

Input
Argument NameDescriptionRequired
list_idThe ID of the list for which to fetch items.Required
offsetTHe item offset. The default is 0.Optional
Context Output
PathTypeDescription
FireEyeHelixList.Item.IDNumberThe ID of the item.
FireEyeHelixList.Item.ValueStringThe value of the item.
FireEyeHelixList.Item.TypeStringThe type of the item. Can be "email", "fqdn", "ipv4", "ipv6", "md5", "misc", or "sha-1".
FireEyeHelixList.Item.RiskStringThe risk of the item. Can be "Low", "Medium", "High", or "Critical".
FireEyeHelixList.Item.NotesStringThe notes of the item.
FireEyeHelixList.Item.ListIDStringThe list ID with which the item is associated.
FireEyeHelixList.Item.CountNumberThe number of items in the list.
Command Example
!fireeye-helix-get-list-items list_id=3232 offset=0
Human Readable Output
FireEye Helix - List items for list 3232
IDListIDNotesRiskTypeValue
1633232LowmiscTest list

Update an item on a list


Updates a single list item.

Base Command

fireeye-helix-update-list-item

Input
Argument NameDescriptionRequired
item_idThe ID of the item to update.Required
typeThe item type. Can be "email", "fqdn", "ipv4", "ipv6", "md5", "misc", or "sha-1".Optional
valueThe value of the item.Optional
list_idThe ID of the list.Required
riskThe risk of the item. Can be "Low", "Medium", "High", or "Critical".Optional
notesThe notes of the item.Optional
Context Output
PathTypeDescription
FireEyeHelixList.Item.IDNumberThe ID of the item.
FireEyeHelixList.Item.ValueStringThe value of the item.
FireEyeHelixList.Item.TypeStringThe item type. Can be "email", "fqdn", "ipv4", "ipv6", "md5", "misc", or "sha-1".
FireEyeHelixList.Item.RiskStringThe risk of the item. Can be, "Low", "Medium", "High", or "Critical".
FireEyeHelixList.Item.NotesStringThe notes of the item.
FireEyeHelixList.Item.ListIDStringThe list ID with which the item is associated.
Command Example
!fireeye-helix-update-list-item list_id=3232 value=test type=misc risk=Low item_id=163
Human Readable Output
FireEye Helix - List item 163 from list 3232 was updated successfully
IDListIDNotesRiskTypeValue
1633232test okMediummiscaTest list

Remove an item from a list


Removes an item from a list.

Base Command

fireeye-helix-remove-list-item

Input
Argument NameDescriptionRequired
list_idThe ID of the list from which to remove an item.Required
item_idThe ID of the item.Required
Context Output

There is no context output for this command.

Fetch archive search results


Fetches archive search results.

Base Command

fireeye-helix-archive-search-get-results

Input
Argument NameDescriptionRequired
search_idThe ID of the search for which to return archive results.Required
headersA comma-separated list of output values to display in the command result. For example, "ID", "Type", and "SourceIPv4".Optional
Context Output
PathTypeDescription
FireEyeHelixSearch.Result.IDStringThe ID of the event.
FireEyeHelixSearch.Result.TypeStringThe type of the event.
FireEyeHelixSearch.Result.ResultStringThe result of the event.
FireEyeHelixSearch.Result.MatchedAtDateThe time that the event was matched.
FireEyeHelixSearch.Result.ConfidenceStringThe confidence of the event. Can be "low", "medium", or "high".
FireEyeHelixSearch.Result.StatusStringThe status of the event.
FireEyeHelixSearch.Result.EventTimeDateThe time that the event occurred.
FireEyeHelixSearch.Result.DetectedRuleIDStringThe ID of the detected rule.
FireEyeHelixSearch.Result.PIDStringThe ID of the process.
FireEyeHelixSearch.Result.ProcessStringThe details of the process.
FireEyeHelixSearch.Result.ProcessPathStringThe path of the process.
FireEyeHelixSearch.Result.FileNameStringThe name of the file affected by the event.
FireEyeHelixSearch.Result.FilePathStringThe path of the the file affected by the event.
FireEyeHelixSearch.Result.DeviceNameStringThe name of the device.
FireEyeHelixSearch.Result.SizeStringThe size of the file (in bytes) that created the event.
FireEyeHelixSearch.Result.VirusStringThe virus that was detected in the event.
FireEyeHelixSearch.Result.MalwareTypeStringThe malware type of the virus that was detected.
FireEyeHelixSearch.Result.CreatedTimeDateThe time that the event was created.
FireEyeHelixSearch.Result.ClassStringThe class of the event.
FireEyeHelixSearch.Result.MD5StringThe MD5 hash of the affected file.
FireEyeHelixSearch.Result.SHA1StringThe SHA1 hash of the affected file.
FireEyeHelixSearch.Result.ProtocolStringThe protocol used in the event.
FireEyeHelixSearch.Result.SourceIPv4StringThe IPv4 address of the event source.
FireEyeHelixSearch.Result.SourceIPv6StringThe IPv6 address of the event source.
FireEyeHelixSearch.Result.SourcePortStringThe port of the event source address.
FireEyeHelixSearch.Result.SourceLongitudeStringThe longitude of the event source address.
FireEyeHelixSearch.Result.SourceLatitudeStringThe latitude of the event source address.
FireEyeHelixSearch.Result.DestinationIPv4StringThe IPv4 address of the event destination.
FireEyeHelixSearch.Result.DestinationIPv6StringThe IPv6 address of the event destination.
FireEyeHelixSearch.Result.DestinationPortStringThe port of the event destination address.
FireEyeHelixSearch.Result.ReportTimeDateThe time that the event was reported.
FireEyeHelixSearch.Result.FalsePositiveStringWhether the event is a false positive.
FireEyeHelixSearch.Result.DomainStringThe domain of the recipient.
FireEyeHelixSearch.Result.FromStringThe email address of the source.
FireEyeHelixSearch.Result.SourceDomainStringThe domain of the host that created the event.
FireEyeHelixSearch.Result.SourceISPStringThe ISP of the source of the event.
FireEyeHelixSearch.Result.DestinationISPStringThe ISP of the destination of the event.
FireEyeHelixSearch.Result.ToStringThe destination email address.
FireEyeHelixSearch.Result.AttachmentUnknownThe email attachment.
FireEyeHelixSearch.MQLStringThe MQL query that created the result.
FireEyeHelixSearch.GroupByUnknownThe group by values.
FireEyeHelixSearch.GroupBy.DocCountNumberThe number of matches for the group.
FireEyeHelixSearch.Result.RcpToStringThe recipient email address.
FireEyeHelixSearch.Result.InReplyToStringThe reply email address.
Command Example
!fireeye-helix-archive-search-get-results search_id=82
Human Readable Output
FireEye Helix - Search result for domain:[google,com] | groupby eventtype sep=|%$,$%|
ClassDomainEvent TimeFromIDIn Reply ToSource DomainSource I Pv 4Source ISPSource LatitudeSource LongitudeStatusToType
fireeye_etpdomain.com2019-10-06T10:48:13.000Zsquidward@demisto.comevenidsquidward squidward@demisto.com8.8.8.851.8594-0.12574delivereddemisto@demisto.comtrace
fireeye_etpdemisto.com2019-10-06T11:02:01.000Zsquidward@demisto.comdemisto\"squidward\" <fsquidward@demisto.com>squidward.com8.8.8.8squidward40.282958-75.19625deliveredsquidward@demisto.comtrace
fireeye_etpdemisto.com2019-10-06T11:02:18.000Zsquidward@demisto.comdwasdkffvsquidward <squidward@demisto.com>demisto.com8.8.8.8demistos33.5-93.119deliveredsquidward@demisto.comtrace
fireeye_etpdemisto.com2019-10-06T11:03:00.000Zsquidward@demisto.com93730geroge <hello@demisto.com>demisto.com8.8.8.8the demisto group33.770843-84.377deliveredsquidward@demisto.comtrace

Create an archive from a query


Creates an archive search from a query.

Base Command

fireeye-helix-archive-search

Input
Argument NameDescriptionRequired
startThe start time of the event in the format yyyy-mm-dd or yyyy-mm.Optional
endThe end time of the event in the format yyyy-mm-dd or yyyy-mm.Optional
offsetThe offset of the result.Optional
groupbyThe unique values for the specified field. This groups them based on the specified frequency. For example, groupby="srcipv4 5 100" will group the top five srcipv4 addresses that have at least 100 occurrences. Supports comma-separated values.Optional
sort_bySorts results by this field.Optional
sort_orderControls the order of the results sorted by the sort_by argument. Can be "asc" for ascending, or "desc" for descending. The default is "desc".Optional
queryThe query to execute. This is the search clause in an MQL.Required
limitThe number of events to search.Optional
Context Output
PathTypeDescription
FireEyeHelixSearch.IDNumberThe ID of an archive search.
FireEyeHelixSearch.PercentCompleteStringThe percentage of the search that was completed.
FireEyeHelixSearch.QueryStringThe search query.
FireEyeHelixSearch.StateStringThe state of the search.
Command Example
!fireeye-helix-archive-search query=domain:google.com start="4 days ago" groupby=subject limit=1 offset=1
Human Readable Output
FireEye Helix - Successfully created archive search
IDPercent CompleteQueryState
82100.0domain:[google,com] | groupby eventtypecompleted
83100.0domain:[google] | groupby eventtypecompleted

Get the status of an archive search


Gets the status of an archive search.

Base Command

fireeye-helix-archive-search-get-status

Input
Argument NameDescriptionRequired
search_idThe archive search's ID.Required
Context Output
PathTypeDescription
FireEyeHelixSearch.IDNumberThe archive search's ID.
FireEyeHelixSearch.PercentCompleteStringThe percentage of the search that was completed.
FireEyeHelixSearch.QueryStringThe search query.
FireEyeHelixSearch.StateStringThe state of the search.
Command Example

!fireeye-helix-archive-search-get-status search_id=82,83

Human Readable Output
FireEye Helix - Search status
IDPercent CompleteQueryState
82100.0domain:[google,com] | groupby eventtypecompleted
83100.0domain:[google,com] | groupby eventtypecompleted