Cyware Orchestrate

The below configuration parameters can be used to configure the Cisco Advanced Malware Protection app in the Orchestrate application.

This action is used to get a list of forensic snapshots from Cisco AMP.

Input Parameters

Example Request

[
    {
    "connector_guid":"Example Unique ID",
    "limit":"10",
    }
]

This action is used to get details of a forensic snapshot.

Input Parameters

Example Request

[
    {
    "snapshot_id":"Example Unique ID",
    }
]

This action is used to get a list of vulnerabilities observed on a specific computer.

Input Parameters

Example Request

[
    {
        "connector_guid":"Example Connector ID",
        "extra_params": {
                    "limit":"10",
                    "offset":"10"
                    }
    }
]

This action is used to get information about a specific computer.

Input Parameters

Example Request

[
    {
        "connector_guid": "xxxc3d-46de-4476-xxxx-37xx059d"
    }
]

This action is used to search all computers for user activity across your organization. You can search for any events or activities associated with a file or network operation.

Input Parameters

Example Request

[
    {
        "query_string":"Example Query",
        "extra_params": {
                    "limit":"10",
                    "offset":"10"
                    }
    }
]

This action is used to get a list of indicators.

Input Parameters

Example Request

[
    {
        "extra_params": {
                    "limit":"10",
                    "offset":"10"
                    }
    }
]

This action is used to get information about a specific computer.

Input Parameters

Example Request

[
    {
        "indicator_guid": "3axxxxxb35-e8f4-483c-912f-dxxx48"
    }
]

This action is used to stop requested isolation for a computer.

Input Parameters

Example Request

[
    {
        "comment": "The isolation request is not valid",
        "connector_guid": "984xx94-61e4-4bdf-9533-5axxxxx63"
    }
]

This action is used to submit a request to isolate a computer.

Input Parameters

Example Request

[
    {
        "comment": "test value ",
        "unlock_code": "088",
        "connector_guid": "98xx4-61e4-4bdf-9533-5axx763"
    }
]

This action is used to get the isolation status of a computer.

Input Parameters

Example Request

[
    {
        "connector_guid": "98x94-61e4-4bdf-9533-5axxa763"
    }
]

This action is used to get a list of computers on which the vulnerability has been observed with respect to a given SHA-256 hash.

Input Parameters

Example Request

[
    {
        "sha256":"Example hash",
        "extra_params": {
                    "limit":"10",
                    "offset":"10"
                    }
    }
]

This action is used to move a computer to a group with a given connector GUID and GROUP GUID.

Input Parameters

Example Request

[
    {
        "group_guid": "2fx7e7-49ad-42ae-acc7-4xxfc",
        "connector_guid": "984xe94-61e4-4bdf-9533-5a1fxx763"
    }
]

This action is used to get a list of vulnerabilities.

Input Parameters

Example Request

[
    {
        "extra_params": {
                    "limit":"10",
                    "offset":"10"
                    }
    }
]

This action is used to get details of a policy.

Input Parameters

Example Request

[
    {
        "policy_guid": "d4xc2-d4ab-49f4-b2e8-a5xx4754",
    }
]

This action is used to get a list of policies.

Input Parameters

Example Request

[
    {
        "extra_params": {
                    "limit":"10",
                    "offset":"10"
                    }
    }
]

This action is used to get a list of groups.

Input Parameters

Example Request

[
    {
        "extra_params": {
                    "limit":"10",
                    "offset":"10"
                    }
    }
]

This action is used to get the details of a particular group.

Input Parameters

Example Request

[
    {
        "group_guid": "2f0xx7e7-49ad-42ae-acc7-49b4xxx9cfc",
    }
]

This action is used to get the details of a particular item for a given file list.

Input Parameters

Example Request

[
    {
        "file_list_guid": "Example ID",
        "sha256": "Example SHA Hash",
    }
]

This action is used to get a list of files from a particular file list.

Input Parameters

Example Request

[
    {
        "file_list_guid": "Example ID""sha256",
        "extra_params": {
                    "limit":"10",
                    "offset":"10"
                    }
    }
]

This action is used to get the details of a file list for application blocking or simple custom detections.

Input Parameters

Example Request

[
    {
        "file_list_guid": "Example ID",
    }
]

This action is used to get a list of events.

Input Parameters

Example Request

[
    {
        "extra_params": {
                    "limit":"10",
                    "offset":"10"
                    }
    }
]

This action is used to get a list of event types.

Input Parameters

No input parameters are required for this action.

This action is used to get a list of computers that has an agent installed.

Input Parameters

Example Request

[
    {
        "extra_params": {
                    "limit":"10",
                    "offset":"10"
                    }
    }
]

This action can be used to get a list of all activities associated with a particular computer.

Input Parameters

Example Request

[
    {
        "connector_guid":"Example Connector ID",
        "extra_params": {
                    "limit":"10",
                    "offset":"10"
                    }
    }
]

This action is used to search all computers across your organization for any events or activities associated with a file or network operation.

Input Parameters

Example Request

[
    {
        "query_string":"Example Query",
        "extra_params": {
                    "limit":"10",
                    "offset":"10"
                    }
    }
]

This action is used to get a specific computer's trajectory for events with user name activity.

Input Parameters

Example Request

[
    {
        "connector_guid":"Example Connector ID",
        "extra_params": {
                    "limit":"10",
                    "offset":"10"
                    }
    }
]

This action is used to delete an item from a file list.

Input Parameters

Example Request

[
    {
        "file_list_guid": "Example ID",
        "sha256": "Example SHA Hash",
    }
]

This action is used to add a SHA-256 hash to a file list.

Input Parameters

Example Request

[
    {
        "file_list_guid": "Example ID",
        "sha256": "Example SHA Hash",
        "description": "Example description",
    }
]

This action is used to get a list of blocked applications.

Input Parameters

Example Request

[
    {
        "extra_params": {
                    "limit":"10",
                    "offset":"10"
                    }
    }
]