icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Log4Shell Vulnerability: Information and guidance for you. Get resources.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Cybereason
SHA256 checksum (cybereason_220.tgz) 9742472e2ab24139aeeaa9f8c654d10147f5477bb8a0476ac21c1f1429ddc03c SHA256 checksum (cybereason_213.tgz) be59ec2c260c38030d6231f3b2a027c4d4349c0e73512344980cd69c2724a177 SHA256 checksum (cybereason_200.tgz) 6ec9f3a9f7617747c2edf9c31d72a39ca1518b4cc06f3754aec81a384283f445

Flag As Inappropriate

soar

Cybereason

Splunk SOAR Cloud
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
This app integrates with the Cybereason platform to perform investigative, contain, and corrective actions on Malop and Malware events

Supported Actions Version 2.2.0

  • test connectivity: Validate the asset configuration for connectivity using supplied configuration
  • on poll: Callback action for the on_poll ingest functionality
  • delete registry key: Deletes the specified registry key for a given malop ID and machine name
  • get sensor status: Get the connectivity status for all machine sensors in a Malop
  • add malop comment: Add a comment to the provided Malop ID
  • update malop status: Update status for the provided Malop ID such as Under Investigation, To review, etc
  • isolate machine: Blocks all communication to and from the machine. Communication with the Cybereason platform is not affected
  • unisolate machine: Unblocks all communication to and from the machine
  • isolate specific machine: Blocks all communication to and from the machine identified by the given Name or IP. Communication with the Cybereason platform is not affected
  • unisolate specific machine: Unblocks all communication to and from the machine identified by the given Name or IP. Communication with the Cybereason platform is not affected
  • kill process: Kills the active process on the machine
  • get remediation status: Gets the remediation status for a previously executed remediation action like Kill Process
  • set reputation: Blacklists / Whitelists / Removes a file hash reputation so that future malop detections can quickly identify the hash
  • query processes: Queries a given malop to retrieve all processes
  • query machine: Queries a given machine name to retrieve all that machine's information
  • query machine ip: Queries a given machine IP to retrieve all that machine's information
  • query users: Queries a given user to retrieve all user-related details
  • query files: Queries a given filename to retrieve all file details
  • query domain: Queries a given domain name to retrieve all details of that domain
  • query connections: Queries a given name to retrieve all details of that connection
  • upgrade sensor: Upgrade a sensor
  • restart sensor: Restart a sensor

Supported Actions Version 2.1.3

  • test connectivity: Validate the asset configuration for connectivity using supplied configuration
  • on poll: Callback action for the on_poll ingest functionality
  • delete registry key: Deletes the specified registry key for a given malop ID and machine name
  • get sensor status: Get the connectivity status for all machine sensors in a Malop
  • add malop comment: Add a comment to the provided Malop ID
  • update malop status: Update status for the provided Malop ID such as Under Investigation, To review, etc
  • isolate machine: Blocks all communication to and from the machine. Communication with the Cybereason platform is not affected
  • unisolate machine: Unblocks all communication to and from the machine
  • isolate specific machine: Blocks all communication to and from the machine identified by the given Name or IP. Communication with the Cybereason platform is not affected
  • unisolate specific machine: Unblocks all communication to and from the machine identified by the given Name or IP. Communication with the Cybereason platform is not affected
  • kill process: Kills the active process on the machine
  • get remediation status: Gets the remediation status for a previously executed remediation action like Kill Process
  • set reputation: Blacklists / Whitelists / Removes a file hash reputation so that future malop detections can quickly identify the hash
  • query processes: Queries a given malop to retrieve all processes
  • query machine: Queries a given machine name to retrieve all that machine's information
  • query machine ip: Queries a given machine IP to retrieve all that machine's information
  • query users: Queries a given user to retrieve all user-related details
  • query files: Queries a given filename to retrieve all file details
  • query domain: Queries a given domain name to retrieve all details of that domain
  • query connections: Queries a given name to retrieve all details of that connection
  • upgrade sensor: Upgrade a sensor
  • restart sensor: Restart a sensor

Supported Actions Version 2.0.0

  • test connectivity: Validate the asset configuration for connectivity using supplied configuration
  • on poll: Callback action for the on_poll ingest functionality
  • delete registry key: Deletes the specified registry key for a given malop id and machine name
  • get sensor status: Get the connectivity status for all machine sensors in a Malop
  • add malop comment: Add a comment to the provided Malop ID
  • update malop status: Update status for the provided Malop ID such as Under Investigation, To review, etc
  • isolate machine: Blocks all communication to and from the machine. Communication with the Cybereason platform is not affected
  • unisolate machine: Unblocks all communication to and from the machine
  • kill process: Kills the active process on the machine
  • get remediation status: Gets the remediation status for a previously executed remediation action like Kill Process
  • set reputation: Blacklists / Whitelists / Removes a file hash reputation so that future malop detections can quickly identify the hash
  • query processes: Queries a given malop to retrieve all processes
  • query machine: Queries a given machine name to retrieve all that machine's information
  • query users: Queries a given user to retrieve all user-related details
  • query files: Queries a given filename to retrieve all file details
  • query domain: Queries a given domain name to retrieve all details of that domain
  • query connections: Queries a given name to retrieve all details of that connection

Release Notes

Version 2.2.0
Aug. 4, 2022
  • Minor fixes and enhancements
Version 2.1.3
Nov. 29, 2021

Cybereason Release Notes - Published by Cybereason November 29, 2021

Version 2.1.3 - Released November 29, 2021

  • Added below-mentioned new actions
    • isolate specific machine
    • unisolate specific machine
    • upgrade sensor
    • restart sensor
    • query machine ip
  • Fixed miscellaneous JSON and documentation issues
Version 2.0.0
Sept. 21, 2021

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.