Queries should be written for a SQLite database. A list of tables can be found at osquery.io/schema, or by using the query "select * from information_schema.tables" Base Command # } Copy Human Readable Output # Uptycs Assets # idĮnter a SQL query to run against your Uptycs database. Uptycs-get-assets os="Mac OS X/Apple OS X/macOS" limit=1 Context Example #
#Osquery add ec2 metadata mac os
Os installed on asset (Windows, Linux, Mac OS X)Ĭurrent version of osquery installed on the asset Only return the asset with this unique asset id Only return assets with this type of operating system. Use -1 to return all entries (may run slow or cause a time out). Do not use arguments "host_name_is" and "host_name_like" at the same time. Use this to find a selection of assets with similar hostnames. Only return assets with this string in the hostname.
Only return assets which are a member of this asset group Return assets enrolled with Uptycs Base Command # You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.Īfter you successfully execute a command, a DBot message appears in the War Room with the command details. The Cortex XSOAR-Uptycs integration creates incients from Uptycs alerts using the Uptycs API Commands #
#Osquery add ec2 metadata download
In order to create an instance of the integration, you need to download a user API key and secret from your Uptycs account. Get details about connections which have been opened to known bad IP addresses, including process and parent process information, IP addresses, ports, sockets, and the source of the threat intelligence. Uptycs - Bad IP Incident and Uptycs - Outbound Connection to Threat IOC Incident.Features include fetching and handling alerts, threat investigation, posting new threat sources, setting tags on assets, and the ability to run arbitrary SQL queries against your Uptycs database or in real-time against registered endpoints. The integration allows the use of Uptycs data in existing workflows. The Cortex XSOAR-Uptycs integration connects to the Uptycs backend via the Uptycs API. Finally, take action with real-time alerts, dashboards and reports packaged for multiple security protocols.
Integrated third party feeds of known malware, threats and over 170,000 indicators of compromise (IOCs) further enhance threat visibility. Uptycs will stream that data over secure TLS protocol, storing it in your unique instance, and continuously monitoring for suspicious activity. Uptycs deploys osquery to your entire infrastructure, regardless of operating system mix or hosting environment, collects, and stores system state data. Uptycs combines the open source universal agent, osquery, with a scalable security analytics platform for fleet visibility, intrusion detection, vulnerability monitoring and compliance.
This Integration is part of the Uptycs Pack.
0 kommentar(er)
