McAfee ATD
Versi integrasi: 11.0
Mengonfigurasi integrasi McAfee ATD di Google Security Operations
Untuk mendapatkan petunjuk mendetail terkait cara mengonfigurasi integrasi di Google SecOps, lihat Mengonfigurasi integrasi.
Tindakan
Periksa Hash
Deskripsi
Memeriksa apakah hash masuk dalam daftar hitam.
Parameter
T/A
Kasus penggunaan
T/A
Run On
Tindakan ini dijalankan pada entity Filehash.
Hasil Tindakan
Pengayaan Entity
T/A
Insight
T/A
Hasil Skrip
| Nama Hasil Skrip | Opsi Nilai | Contoh |
|---|---|---|
| is_blacklisted | Benar/Salah | is_blacklisted:False |
Hasil JSON
[{
"EntityResult": true,
"Entity": "ebdd035084968f675ee1510519dd8319"
}]
Mendapatkan Profil Penganalisis
Deskripsi
Mendapatkan data profil penganalisis Trellix ATD.
Parameter
T/A
Kasus penggunaan
T/A
Run On
Tindakan ini dijalankan di semua entity.
Hasil Tindakan
Pengayaan Entity
T/A
Insight
T/A
Hasil Skrip
| Nama Hasil Skrip | Opsi Nilai | Contoh |
|---|---|---|
| is_success | Benar/Salah | is_success:False |
Hasil JSON
[{
"overrideOS": 0,
"logZip": 0,
"family": 0,
"default64OSName": "",
"artimas": 0,
"yararules": 0,
"xMode": 0,
"consoleLog": 0,
"sophosAV": 0,
"defaultVM": 0,
"userLog": 0,
"filePassword1": "",
"dnnEnable": 0,
"recusiveAnalysis": 0,
"imageid": 0,
"vmDesc": "Only Down Selectors",
"heuristic": 0,
"netdriveZip": 0,
"ssKeyid": 1,
"gtiTS": 1,
"ssAPIid": 1,
"pe32": 0,
"createTime": "2012-12-01 02:16:01",
"locBlackList": 1,
"openarchive": 1,
"yaraScan": 0,
"runtimeArgument": "",
"dumpZip": 0,
"userid": 1,
"filePassword": "",
"internet": 0,
"default32OSName": "",
"lastChange": "2018-08-20 01:04:37",
"summary": 1,
"maxExecTime": 180,
"asm": 0,
"ntvLog": 0,
"name": "Analyzer Profile 1",
"reAnalysis": 1,
"noPDF": 0,
"flp": 0,
"mfeAV": 1,
"aviraAV": 0,
"vmProfileid": 1,
"gam": 1,
"gml": 0,
"netLog": 0,
"sandbox": 0,
"dropZip": 0,
"selectedOSName": "",
"minExecTime": 5,
"ssLevelid": 1,
"gtiURLRep": 0,
"customrules": 0,
"locWhiteList": 0
}]
Dapatkan Laporannya
Deskripsi
Mendapatkan laporan untuk ID tugas.
Parameter
| Parameter | Jenis | Nilai Default | Deskripsi |
|---|---|---|---|
| ID Tugas | String | T/A | ID tugas yang akan diambil laporannya, dipisahkan dengan koma. |
| Buat Insight | Boolean | Dicentang | Jika diaktifkan, tindakan akan membuat insight yang berisi semua informasi yang diambil tentang laporan. |
Kasus penggunaan
T/A
Run On
Tindakan ini dijalankan di semua entity.
Hasil Tindakan
Insight
T/A
Hasil Skrip
| Nama Hasil Skrip | Opsi Nilai | Contoh |
|---|---|---|
| report | Benar/Salah | report:False |
Hasil JSON
{
"95":
{
"Summary":
{
"JSONversion": "1.002",
"SubmitterName": "User",
"Subject":
{
"Name": "events.txt",
"Timestamp": "2018-08-21 08:29:48",
"FileType": "2",
"sha-256": "74834D752D73B4C81EAD10184A091C12AA30BD809D575FD9CFA07B0EBBD7A0D7", "sha-1": "6BDA9FCFB56CE2B34168D499EE04970F640ADD9A",
"parent_archive": "Not Available",
"md5": "11FBEF3A9916BF50EC5002B5795B23C3",
"Type": "ASCII text",
"size": "481231"
},
"Process":
[{
"Reason": "processed by down selectors",
"Name": "events.txt",
"Severity": "0"
}],
"Data":
{
"compiled_with": "Not Available",
"analysis_seconds": "181",
"sandbox_analysis": "0"
},
"SUMversion": "1.1.1.1",
"JobId": "95",
"SubmitterType": "STAND_ALONE",
"Behavior": ["Identified as --- by GTI File Reputation", "Identified as --- by Anti-Malware"],
"hasDynamicAnalysis": "false",
"TaskId": "95",
"Verdict":
{
"Severity": "0",
"Description": "No malicious activity was detected, but this does NOT mean that execution of the sample is safe"
},
"OSversion": "StaticAnalysis",
"Selectors":
[{
"Engine": "GTI File Reputation",
"Severity": "0",
"MalwareName": "---"
},
{
"Engine": "Anti-Malware",
"Severity": "0",
"MalwareName": "---"
},
{
"Engine": "Sandbox",
"Severity": "0",
"MalwareName": "---"
}],
"MISversion": "1.1.1.1",
"DETversion": "1.1.1.1"
}
}
}
Ping
Deskripsi
Pastikan pengguna memiliki koneksi ke Trellix ATD melalui perangkat pengguna.
Parameter
T/A
Kasus penggunaan
T/A
Run On
Tindakan ini dijalankan di semua entity.
Hasil Tindakan
Pengayaan Entity
T/A
Insight
T/A
Hasil Skrip
| Nama Hasil Skrip | Opsi Nilai | Contoh |
|---|---|---|
| is_success | Benar/Salah | is_success:False |
Hasil JSON
N/A
Kirim File
Deskripsi
Kirim file untuk dianalisis.
Parameter
| Parameter | Jenis | Nilai Default | Deskripsi |
|---|---|---|---|
| Jalur File | String | T/A | Jalur file yang akan dikirimkan, dipisahkan dengan koma. |
| ID Profil Analisis | String | T/A | ID profil penganalisis yang akan digunakan untuk menganalisis. |
Kasus penggunaan
T/A
Run On
Tindakan ini dijalankan di semua entity.
Hasil Tindakan
Pengayaan Entity
T/A
Insight
T/A
Hasil Skrip
| Nama Hasil Skrip | Opsi Nilai | Contoh |
|---|---|---|
| task_id | Benar/Salah | task_id:False |
Hasil JSON
{
"C:\\temp\\test.txt\": 95
}
Kirimkan URL
Deskripsi
Kirimkan URL untuk dianalisis.
Parameter
| Parameter | Jenis | Nilai Default | Deskripsi |
|---|---|---|---|
| ID Profil Analisis | String | T/A | ID profil penganalisis untuk menganalisis URL. ID ini dapat ditemukan di ATD pada bagian Profil Penganalisis Kebijakan. |
| Buat Insight | Boolean | Dicentang | Jika diaktifkan, tindakan akan membuat insight yang berisi semua informasi yang diambil tentang entity. |
Run On
Tindakan ini dijalankan pada entity URL.
Hasil Tindakan
Pengayaan Entity
| Nama Kolom Pengayaan | Logika-Kapan harus diterapkan |
|---|---|
| Ringkasan | Menampilkan apakah ada di hasil JSON |
Hasil Skrip
| Nama Hasil Skrip | Opsi Nilai | Contoh |
|---|---|---|
| report | Benar/Salah | report:False |
Hasil JSON
[{
"EntityResult":
{
"Summary":
{
"JSONversion": "1.002",
"SubmitterName": "User",
"Subject":
{
"sha-1": "6BDA9FCFB56CE2B34168D499EE04970F640ADD9A",
"Timestamp": "2018-08-21 08:29:48",
"FileType": "2",
"sha-256": "74834D752D73B4C81EAD10184A091C12AA30BD809D575FD9CFA07B0EBBD7A0D7",
"parent_archive": "Not Available",
"Name": "events.txt",
"md5": "11FBEF3A9916BF50EC5002B5795B23C3",
"Type": "ASCII text",
"size": "481231"
},
"Process":
[{
"Reason": "processed by down selectors",
"Name": "events.txt",
"Severity": "0"
}],
"Data":
{
"compiled_with": "Not Available",
"analysis_seconds": "181",
"sandbox_analysis": "0"
},
"SUMversion": "1.1.1.1",
"JobId": "95",
"SubmitterType": "STAND_ALONE",
"Behavior":
["Identified as --- by GTI File Reputation",
"Identified as --- by Anti-Malware"],
"hasDynamicAnalysis": "false",
"TaskId": "95",
"Verdict":
{
"Description": "No malicious activity was detected, but this does NOT mean that execution of the sample is safe",
"Severity": "0"
},
"OSversion": "StaticAnalysis",
"Selectors":
[{
"Engine": "GTI File Reputation",
"Severity": "0",
"MalwareName": "---"
},
{
"Engine": "Anti-Malware",
"Severity": "0",
"MalwareName": "---"
},
{
"Engine": "Sandbox",
"Severity": "0",
"MalwareName": "---"
}],
"MISversion": "1.1.1.1",
"DETversion": "1.1.1.1"
}
},
"Entity": "http://google.com"
}]
Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.