CohesityHelios
This Integration is part of the Cohesity Helios Pack.#
Supported versions
Supported Cortex XSOAR versions: 6.0.0 and later.
Integrate with Cohesity Helios services to fetch alerts and take remedial action. This integration was integrated and tested with version 08.01 of CohesityHelios.
Configure CohesityHelios on Cortex XSOAR#
Navigate to Settings > Integrations > Servers & Services.
Search for CohesityHelios.
Click Add instance to create and configure a new integration instance.
Parameter Description Required Your server URL True API Key The API Key to use for connection True Trust any certificate (not secure) Trust any certificate (not secure). False Use system proxy settings Use system proxy settings. False Incident type False Maximum number of incidents to fetch every time True First fetch timestamp False Fetch incidents False Incidents Fetch Interval False Click Test to validate the URLs, token, and connection.
Commands#
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
cohesity-helios-get-ransomware-alerts#
Get Cohesity Helios ransomware alerts.
Base Command#
cohesity-helios-get-ransomware-alerts
Input#
| Argument Name | Description | Required |
|---|---|---|
| created_after | Returns only alerts created after the provided timestamp (ISO8601 format YYYY-MM-DDTHH:MM:SSZ). | Optional |
| created_before | Returns only alerts created before the provided timestamp (ISO8601 format YYYY-MM-DDTHH:MM:SSZ). | Optional |
| limit | Limits the number of alerts to return. Default is 200. | Optional |
| alert_id_list | List of comma-separated alert identifiers to filter alerts. | Optional |
| cluster_id_list | List of comma-separated cluster identifiers to filter alerts. | Optional |
| region_id_list | List of comma-separated region identifiers to filter alerts. | Optional |
| alert_state_list | One or more state values. Possible values are: kOpen, kSuppressed, kResolved, kNote. Default is kOpen. | Optional |
| alert_severity_list | One or more severity levels. Possible values are: kCritical, kWarning, kInfo. Default is kCritical,kWarning. | Optional |
Context Output#
| Path | Type | Description |
|---|---|---|
| CohesityHelios.RansomwareAlert.alert_id | String | Identifier for the ransomware alert. |
| CohesityHelios.RansomwareAlert.occurrence_time | Date | Name of the detected anomalous object. |
| CohesityHelios.RansomwareAlert.severity | String | Severity of the ransomware alert. |
| CohesityHelios.RansomwareAlert.alert_description | String | Description for the ransomware alert. |
| CohesityHelios.RansomwareAlert.alert_cause | String | Cause for the ransomware alert. |
| CohesityHelios.RansomwareAlert.anomalous_object_name | String | Name of the detected anomalous object. |
| CohesityHelios.RansomwareAlert.anomalous_object_env | String | Env of the detected anomalous object. |
| CohesityHelios.RansomwareAlert.anomaly_strength | Number | Strength of the detected ransomware alert. |
Command Example#
!cohesity-helios-get-ransomware-alerts created_after=2021-09-26T created_before=2021-09-230T limit=2 alert_severity_list=kCritical,kInfo
Context Example#
Human Readable Output#
Cohesity Helios Ransomware Alerts#
Alert Id Alert Description Alert Cause Anomalous Object Env Anomalous Object Name Anomaly Strength 9346668452014081:1632849269030240 Anomalous change in file system detected on pankajk-ubuntu18-06, a symptom of potential ransomware attack on your primary environment The recent protection run of Protection Group testSimJobCWWMwith job id 24248 has dramatic changes in the composition of files, which is a significant deviation from the previously observed protection runs kVMware pankajk-ubuntu18-06 66 2122491972847952:1632848348897740 Anomalous change in file system detected on pankajk-ubuntu18-05, a symptom of potential ransomware attack on your primary environment The recent protection run of Protection Group testSimJobBTYAwith job id 24229 has dramatic changes in the composition of files, which is a significant deviation from the previously observed protection runs kVMware pankajk-ubuntu18-05 63
cohesity-helios-ignore-anomalous-object#
Ignore detected anomalous object.
Base Command#
cohesity-helios-ignore-anomalous-object
Input#
| Argument Name | Description | Required |
|---|---|---|
| object_name | Anomalous object name to be ignored. Can be retrieved by running the command cohesity-helios-get-ransomware-alerts. | Required |
Context Output#
There is no context output for this command.
Command Example#
!cohesity-helios-ignore-anomalous-object object_name=pankajk-ubuntu18-02
Human Readable Output#
Ignored object pankajk-ubuntu18-02
cohesity-helios-restore-latest-clean-snapshot#
Restore the latest clean snapshot for the given object.
Base Command#
cohesity-helios-restore-latest-clean-snapshot
Input#
| Argument Name | Description | Required |
|---|---|---|
| object_name | Anomalous object name to be restored. Can be retrieved by running the command cohesity-helios-get-ransomware-alerts. | Required |
Context Output#
There is no context output for this command.
Command Example#
!cohesity-helios-restore-latest-clean-snapshot object_name=pankajk-ubuntu18-05
Human Readable Output#
Restored object pankajk-ubuntu18-05.