FireEye Helix Archive Search

Creates an archive search in FireEye Helix, and fetch the results as events.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

  • fireeye-helix-archive-search
  • fireeye-helix-archive-search-get-results

Playbook Inputs


NameDescriptionDefault ValueRequired
QueryThe query to execute. This is the search clause in an MQL.-Required
StartThe start time of the event in date format yyyy-mm-dd or yyyy-mm.-Optional
OffsetThe offset of the result.-Optional
GroupbyThe unique values for the specified field. This input groups them together based on the specified frequency. For example, groupby="srcipv4 5 100" will group the top 5 srcipv4 that have at least 100 occurences. Multiple values can be provided using a comma-separated list.-Optional
Sort_bySorts the results by this field. The default is descending order. To change the default, the following command must be used: argument sort_order="asc".-Optional
Sort_orderControls the order of the results sorted by the sort_by argument. Can be, "ascending" or "descending".-Optional
LimitThe number of events for which to search.-Optional
TimeoutThe amount of time for which to poll before declaring a timeout and resuming the playbook (in minutes).10Required
IntervalThe frequency with which the polling command runs (in minutes).1Required
EndThe end time of the event, in date format yyyy-mm-dd or yyyy-mm.-Optional

Playbook Outputs


PathDescriptionType
FireEyeHelixSearch.Result.IDThe event ID.string
FireEyeHelixSearch.Result.TypeThe event type.string
FireEyeHelixSearch.Result.ResultThe event result.string
FireEyeHelixSearch.Result.MatchedAtThe time at which the the event was matched.date
FireEyeHelixSearch.Result.ConfidenceThe confidence of the event. Can be, "low", "medium" or "high".string
FireEyeHelixSearch.Result.StatusThe status of the event.string
FireEyeHelixSearch.Result.EventTimeThe time at which the event took place.date
FireEyeHelixSearch.Result.DetectedRuleIDThe ID of the detected rule.string
FireEyeHelixSearch.Result.PIDThe process ID.string
FireEyeHelixSearch.Result.ProcessThe process details.string
FireEyeHelixSearch.Result.ProcessPathThe process path.string
FireEyeHelixSearch.Result.FileNameThe name of the file affected by the event.string
FireEyeHelixSearch.Result.FilePathThe path of the file affected by the event.string
FireEyeHelixSearch.Result.DeviceNameThe device name.string
FireEyeHelixSearch.Result.SizeThe size of the file that created the event in bytes.string
FireEyeHelixSearch.Result.VirusThe virus that was detected in the event.string
FireEyeHelixSearch.Result.MalwareTypeThe malware type of the virus that was detected.string
FireEyeHelixSearch.Result.CreatedTimeThe time at which the event was created.date
FireEyeHelixSearch.Result.ClassThe event class.string
FireEyeHelixSearch.Result.MD5The MD5 hash of the affected file.string
FireEyeHelixSearch.Result.SHA1The SHA1 hash of the affected file.string
FireEyeHelixSearch.Result.ProtocolThe protocol used in the event.string
FireEyeHelixSearch.Result.SourceIPv4The IPv4 address of the event source.string
FireEyeHelixSearch.Result.SourceIPv6The IPv6 address of the event source.string
FireEyeHelixSearch.Result.SourcePortThe port of the event source address.string
FireEyeHelixSearch.Result.SourceLongitudeThe longitude of the event source address.string
FireEyeHelixSearch.Result.SourceLatitudeThe latitude of the event source address.string
FireEyeHelixSearch.Result.DestinationIPv4The IPv4 address of the event destination.string
FireEyeHelixSearch.Result.DestinationIPv6The IPv6 address of the event destination.string
FireEyeHelixSearch.Result.DestinationPortThe port of the event destination address.string
FireEyeHelixSearch.Result.ReportTimeThe time at which the event was reported.date
FireEyeHelixSearch.Result.FalsePositiveWhether event is a false positive.string
FireEyeHelixSearch.Result.DomainThe domain of the recepient.string
FireEyeHelixSearch.Result.FromThe source email address.string
FireEyeHelixSearch.Result.SourceDomainThe domain of the host that created the event.string
FireEyeHelixSearch.Result.SourceISPThe ISP of the source of the event.string
FireEyeHelixSearch.Result.DestinationISPThe ISP of the destination of the event.string
FireEyeHelixSearch.Result.ToThe destination email address.string
FireEyeHelixSearch.Result.AttachmentThe email attachment.unknown
FireEyeHelixSearch.MQLThe MQL query that created the result.string
FireEyeHelixSearch.GroupByThe group by values.unknown
FireEyeHelixSearch.GroupBy.DocCountThe number of matches for the group.number
FireEyeHelixSearch.Result.RcpToThe "Recipient of" email address.string
FireEyeHelixSearch.Result.InReplyToThe "Reply to" email address.string

Playbook Image


FireEye_Helix_Archive_Search