Skip to main content

DeepInstinct v3

This Integration is part of the DeepInstinct Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.2.0 and later.

Deep Instinct is a prevention-first approach to stopping ransomware and other malware using the world's first purpose-built, deep learning cybersecurity framework. This integration was integrated and tested with version 3.3.x of DeepInstinct v3

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure DeepInstinct v3 on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for DeepInstinct v3.

  3. Click Add instance to create and configure a new integration instance.

    ParameterRequired
    Base server URLTrue
    API KeyTrue
    First event ID to fetch fromFalse
    Fetch incidentsFalse
    Incidents Fetch IntervalFalse
    Incident typeFalse
    Trust any certificate (not secure)False
    Use system proxy settingsFalse
  4. Click Test to validate the URLs, token, and connection.

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

deepinstinctv3-get-device#


Get device information from its ID

Base Command#

deepinstinctv3-get-device

Input#

Argument NameDescriptionRequired
device_idGet device information from its ID.Required

Context Output#

PathTypeDescription
deepinstinctv3.devices.IDnumberDevice ID
deepinstinctv3.devices.osstringDevice OS
deepinstinctv3.devices.osvstringDevice OS version
deepinstinctv3.devices.ip_addressstringDevice IP address
deepinstinctv3.devices.emailstingDevice email ip_address
deepinstinctv3.devices.mac_addressstringDevice mac address
deepinstinctv3.devices.hostnamestringDevice hostname
deepinstinctv3.devices.domainstringDevice domain
deepinstinctv3.devices.scanned_filesnumberNum of device scanned files
deepinstinctv3.devices.commentstringDevice comment
deepinstinctv3.devices.tagstringDevice tag
deepinstinctv3.devices.connectivity_statusstringDevice connectivity status
deepinstinctv3.devices.deployment_statusstringDevice deployment status
deepinstinctv3.devices.deployment_status_last_updatestringDevice last client version update
deepinstinctv3.devices.license_statusstringDevice license status
deepinstinctv3.devices.last_registrationstringDevice last registration datetime
deepinstinctv3.devices.last_contactstringDevice last contact datetime
deepinstinctv3.devices.distinguished_namestringDevice distinguished name
deepinstinctv3.devices.group_namestringDevice group name
deepinstinctv3.devices.group_idnumberDevice group ID
deepinstinctv3.devices.policy_namestringDevice policy name
deepinstinctv3.devices.policy_idnumberDevice policy ID
deepinstinctv3.devices.log_statusstringDevice log status
deepinstinctv3.devices.agent_versionstringDevice agent version
deepinstinctv3.devices.brain_versionstringDevice brain version
deepinstinctv3.devices.logged_in_usersstringDevice logged in user(s)
deepinstinctv3.devices.msp_namestringDevice msp name
deepinstinctv3.devices.msp_idnumberDevice msp ID
deepinstinctv3.devices.tenant_namestringDevice tenant name
deepinstinctv3.devices.tenant_idnumberDevice tenant ID

deepinstinctv3-get-events#


Get all events after given event ID

Base Command#

deepinstinctv3-get-events

Input#

Argument NameDescriptionRequired
first_event_idGet all events. Max events in response is 50, use first_event_id parameter to define first event id to get. Default is 0.Required

Context Output#

PathTypeDescription
deepinstinctv3.Events.events.idnumberevent ID
deepinstinctv3.Events.events.device_idnumberevent device ID
deepinstinctv3.Events.events.timestampstringevent timestamp from device
deepinstinctv3.Events.events.insertion_timestampstringevent timestamp from console
deepinstinctv3.Events.events.close_timestampstringevent closed timestamp
deepinstinctv3.Events.events.last_actionstringevent last last_action
deepinstinctv3.Events.events.statusstringevent status
deepinstinctv3.Events.events.commentstringevent comment
deepinstinctv3.Events.events.recorded_device_infounknownevent device information
deepinstinctv3.Events.events.msp_namestringevent msp name
deepinstinctv3.Events.events.msp_idnumberevent msp id
deepinstinctv3.Events.events.tenant_namestringevent tenant name
deepinstinctv3.Events.events.tenant_idnumberevent tenant id
deepinstinctv3.Events.events.mitre_classificationsunknownevent MITRE classification
deepinstinctv3.Events.events.typestringevent type
deepinstinctv3.Events.events.triggerstringevent trigger
deepinstinctv3.Events.events.actionstringevent action
deepinstinctv3.Events.events.close_triggerstringevent close trigger
deepinstinctv3.Events.events.reoccurrence_countnumberevent reoccurrence_count
deepinstinctv3.Events.events.file_typestringevent file type
deepinstinctv3.Events.events.file_hashstringevent file hash
deepinstinctv3.Events.events.file_archive_hashstringevent file archive hash
deepinstinctv3.Events.events.pathunknownevent file path
deepinstinctv3.Events.events.file_sizenumberevent file size
deepinstinctv3.Events.events.threat_severitystringevent threat severity
deepinstinctv3.Events.events.certificate_thumbprintstringevent certificate certificate thumbprint
deepinstinctv3.Events.events.certificate_vendor_namestringevent certificate certificate vendor name
deepinstinctv3.Events.events.deep_classificationstringDeep Instinct classification
deepinstinctv3.Events.events.file_statusstringevent file status
deepinstinctv3.Events.events.sandbox_statusstringevent sandbox status

deepinstinctv3-get-suspicious-events#


Get all suspicious events after given event ID

Base Command#

deepinstinctv3-get-suspicious-events

Input#

Argument NameDescriptionRequired
first_event_idGet all suspicious events. Max events in response is 50, use first_event_id parameter to define first event id to get. Default is 0.Required

Context Output#

PathTypeDescription
deepinstinctv3.Suspicious-Events.events.IDnumberevent ID
deepinstinctv3.Suspicious-Events.events.device_idnumberevent device ID
deepinstinctv3.Suspicious-Events.events.timestampstringevent timestamp from device
deepinstinctv3.Suspicious-Events.events.insertion_timestampstringevent timestamp from console
deepinstinctv3.Suspicious-Events.events.statusstringevent status
deepinstinctv3.Suspicious-Events.events.recorded_device_infounkownevent device info
deepinstinctv3.Suspicious-Events.events.msp_namestringevent msp name
deepinstinctv3.Suspicious-Events.events.msp_idnumberevent msp id
deepinstinctv3.Suspicious-Events.events.tenant_namestringevent tenant name
deepinstinctv3.Suspicious-Events.events.tenant_idnumberevent tenant id
deepinstinctv3.Suspicious-Events.events.mitre_classificationsunknownevent MITRE classification
deepinstinctv3.Suspicious-Events.events.typestringevent type
deepinstinctv3.Suspicious-Events.events.triggerstringevent trigger
deepinstinctv3.Suspicious-Events.events.actionstringevent action
deepinstinctv3.Suspicious-Events.events.close_triggerstringevent close trigger
deepinstinctv3.Suspicious-Events.events.file_typestringevent file type
deepinstinctv3.Suspicious-Events.events.rule_triggerstringevent rule trigger
deepinstinctv3.Suspicious-Events.events.file_archive_hashstringevent file archive hash
deepinstinctv3.Suspicious-Events.events.remediationunknownevent remediation
deepinstinctv3.Suspicious-Events.events.pathunknownevent file path

deepinstinctv3-get-all-groups#


Get all groups

Base Command#

deepinstinctv3-get-all-groups

Input#

There are no input arguments for this command.

Context Output#

PathTypeDescription
deepinstinctv3.Groups.IDnumbergroup id
deepinstinctv3.Groups.is_default_groupbooleanTrue if group is a default group, false otherwise
deepinstinctv3.Groups.msp_idnumbermsp ID
deepinstinctv3.Groups.namestringgroup name
deepinstinctv3.Groups.osstringgroup operation system
deepinstinctv3.Groups.policy_idnumbergroup policy ID

deepinstinctv3-get-all-policies#


Get list of all policies

Base Command#

deepinstinctv3-get-all-policies

Input#

There are no input arguments for this command.

Context Output#

PathTypeDescription
deepinstinctv3.Policies.IDnumberpolicy ID
deepinstinctv3.Policies.namestringpolicy name
deepinstinctv3.Policies.osstringpolicy operating system
deepinstinctv3.Policies.is_default_policybooleanTrue if policy is a default policy, False otherwise
deepinstinctv3.Policies.msp_idnumbermsp ID
deepinstinctv3.Policies.msp_namestringmsp name

deepinstinctv3-add-hash-to-deny-list#


Add file hash to Deny List

Base Command#

deepinstinctv3-add-hash-to-deny-list

Input#

Argument NameDescriptionRequired
policy_idPolicy ID.Required
file_hashfile hash.Required
commentcomment to hash field.Optional

Context Output#

There is no context output for this command.

deepinstinctv3-add-hash-to-allow-list#


Add file hash to Allow List

Base Command#

deepinstinctv3-add-hash-to-allow-list

Input#

Argument NameDescriptionRequired
policy_idPolicy ID.Required
file_hashfile hash.Required
commentcomment to hash field.Optional

Context Output#

There is no context output for this command.

deepinstinctv3-remove-hash-from-deny-list#


Remove hash from Deny List

Base Command#

deepinstinctv3-remove-hash-from-deny-list

Input#

Argument NameDescriptionRequired
policy_idPolicy ID.Required
file_hashfile hash.Required

Context Output#

There is no context output for this command.

deepinstinctv3-remove-hash-from-allow-list#


Remove hash from Allow List

Base Command#

deepinstinctv3-remove-hash-from-allow-list

Input#

Argument NameDescriptionRequired
policy_idPolicy ID.Required
file_hashfile hash.Required

Context Output#

There is no context output for this command.

deepinstinctv3-add-devices-to-group#


Add multiple devices to a group

Base Command#

deepinstinctv3-add-devices-to-group

Input#

Argument NameDescriptionRequired
group_idgroup ID.Required
device_idscomma seperated list of device ids to address.Required

Context Output#

There is no context output for this command.

deepinstinctv3-remove-devices-from-group#


Remove list of devices from groups

Base Command#

deepinstinctv3-remove-devices-from-group

Input#

Argument NameDescriptionRequired
group_idGroup ID to remove from.Required
device_idsComma seperated list of device ids to remove.Required

Context Output#

There is no context output for this command.

deepinstinctv3-delete-files-remotely#


Delete multiple files remotely

Base Command#

deepinstinctv3-delete-files-remotely

Input#

Argument NameDescriptionRequired
event_idscomma separated list of event ids.Required

Context Output#

There is no context output for this command.

deepinstinctv3-terminate-processes#


Terminate list of processes

Base Command#

deepinstinctv3-terminate-processes

Input#

Argument NameDescriptionRequired
event_idscomma separated list of event ids.Required

Context Output#

There is no context output for this command.

deepinstinctv3-close-events#


Close list of events

Base Command#

deepinstinctv3-close-events

Input#

Argument NameDescriptionRequired
event_idscomma separated list of event ids.Required

Context Output#

There is no context output for this command.

deepinstinctv3-disable-device#


Disable device at next check-in

Base Command#

deepinstinctv3-disable-device

Input#

Argument NameDescriptionRequired
device_idsingle device id.Required

Context Output#

There is no context output for this command.

deepinstinctv3-enable-device#


Enable device at next check-in

Base Command#

deepinstinctv3-enable-device

Input#

Argument NameDescriptionRequired
device_idsingle device id.Required

Context Output#

There is no context output for this command.

deepinstinctv3-isolate-from-network#


Isolate device(s) from Network

Base Command#

deepinstinctv3-isolate-from-network

Input#

Argument NameDescriptionRequired
device_idscomma separated list of device ids.Required

Context Output#

There is no context output for this command.

deepinstinctv3-release-from-isolation#


Release device(s) from isolation

Base Command#

deepinstinctv3-release-from-isolation

Input#

Argument NameDescriptionRequired
device_idscomma separated list of device ids.Required

Context Output#

There is no context output for this command.

deepinstinctv3-remote-file-upload#


Upload file associated with given event id at next check-in

Base Command#

deepinstinctv3-remote-file-upload

Input#

Argument NameDescriptionRequired
event_idthe event id.Required

Context Output#

There is no context output for this command.

deepinstinctv3-upload-logs#


Upload device logs from given device at next check-in

Base Command#

deepinstinctv3-upload-logs

Input#

Argument NameDescriptionRequired
device_idsingle device id.Required

Context Output#

There is no context output for this command.

deepinstinctv3-remove-device#


Remove agent from device at next check-in

Base Command#

deepinstinctv3-remove-device

Input#

Argument NameDescriptionRequired
device_idsingle device id.Required

Context Output#

There is no context output for this command.