Retrieve the List of Tool Packages

Note

To use incident response tool features, you can add the DFIR package to your instance of the Cybereason platform for an additional cost or request an Express IR environment (partners only). Contact your Customer Success representative to request access to this package or for details on how to submit the request, see How to Request a Cybereason Express IR Environment.

Endpoint URL: https://<your server>/rest/irtools/packages
Endpoint URI: irtools/packages

Action: GET

Retrieves a list of previously uploaded packages from your environment.

This request is supported for versions 21.1.81 and later.

You must have the Responder L2 role assigned for your Cybereason user to run this request.

Note

Ensure that you have logged into the Cybereason platform. For details, see Log in with the API.

You must add an Content-Type:application/json header with the request.

Note

If you are using cURL, add the authorization cookie details or the path to the file containing the cookie details as part of every request.

None

URL/URI parameters: none

Request Body Parameters: none

This request can return the following status codes:

200: Request OK

The response contains the following fields:

Field	Type	Description
name	String	Unique name provided for the tool package.
description	String	Description of the tool package.
metadata	JSON	An object containing details on the configuration for the package. The metadata object includes the runCommand and outputDir details if were specified during tool upload.
osInfos	Array	Array of OS specifications which the tool supports.

None

Important information is found in these fields:

name: The name of the package
metadata: An object containing details on the required configuration for the package.

Request

curl --request GET \
  --url https://12.34.56.78/rest/irtools/packages \
  --header 'Content-Type:application/json' \

Response

[
  {
      "name": "deploy-example3",
      "description": "IR tool which results  will be created default CR directory",
      "metadata": "{\"PackageRunConfiguration\":{\"runCommand\":null,\"outputDir\":null}}",
      "osInfos": [
          "OSInfo{osMajor=0, osMinor=0, product=0, buildNumber=0, platform=ARCH_X86, osDistribution=null, osType=null, osTypeGroup=WINDOWS_TYPES}"
      ]
  },
  {
      "name": "deploy-example2",
      "description": "VR client",
      "metadata": "{\"PackageRunConfiguration\":{\"runCommand\":\"client -v\",\"outputDir\":null}}",
      "osInfos": [
          "OSInfo{osMajor=0, osMinor=0, product=0, buildNumber=0, platform=ARCH_AMD64, osDistribution=null, osType=null, osTypeGroup=WINDOWS_TYPES}"
      ]
  }
]

Request

Response

[
    {
        "name": "deploy-example3",
        "description": "IR tool which results  will be created default CR directory",
        "metadata": "{\"PackageRunConfiguration\":{\"runCommand\":null,\"outputDir\":null}}",
        "osInfos": [
            "OSInfo{osMajor=0, osMinor=0, product=0, buildNumber=0, platform=ARCH_X86, osDistribution=null, osType=null, osTypeGroup=WINDOWS_TYPES}"
        ]
    },
    {
        "name": "deploy-example2",
        "description": "VR client",
        "metadata": "{\"PackageRunConfiguration\":{\"runCommand\":\"client -v\",\"outputDir\":null}}",
        "osInfos": [
            "OSInfo{osMajor=0, osMinor=0, product=0, buildNumber=0, platform=ARCH_AMD64, osDistribution=null, osType=null, osTypeGroup=WINDOWS_TYPES}"
        ]
    }
  ]

Request

Note

Ensure you replace the value of the totpCode parameter in the script example below with your unique TOTP code generated from your app or program.

Download Python script

Depending on your browser settings, this linked file may open in a separate tab instead of downloading directly to your machine. If this happens, use the Save As option in your browser to save the file locally.

import requests
import json

# Login information

username = "[email protected]"
password = "password"
server = "myserver.com"
port = "443"

data = {
    "username": username,
    "password": password
}

headers = {"Content-Type": "application/json"}

base_url = "https://" + server + ":" + port

login_url = base_url + "/login.html"

session = requests.session()

login_response = session.post(login_url, data=data, verify=True)

print (login_response.status_code)
print (session.cookies.items())

payload='totpCode=814920&Submit=Login'
tfa_headers = {"Content-Type": "application/x-www-form-urlencoded"}

tfa_url = "https://" + server + "/"

tfa_response = session.post(tfa_url, headers=tfa_headers, data=payload, verify=True)

# Request URL

endpoint_url = "/rest/irtools/packages"

api_url = base_url + endpoint_url

api_response = session.request("GET", api_url, headers=headers)

your_response = json.loads(api_response.content)

print(json.dumps(your_response, indent=4, sort_keys=True))

Response

[
   {
       "name": "deploy-example3",
       "description": "IR tool which results  will be created default CR directory",
       "metadata": "{\"PackageRunConfiguration\":{\"runCommand\":null,\"outputDir\":null}}",
       "osInfos": [
           "OSInfo{osMajor=0, osMinor=0, product=0, buildNumber=0, platform=ARCH_X86, osDistribution=null, osType=null, osTypeGroup=WINDOWS_TYPES}"
       ]
   },
   {
       "name": "deploy-example2",
       "description": "VR client",
       "metadata": "{\"PackageRunConfiguration\":{\"runCommand\":\"client -v\",\"outputDir\":null}}",
       "osInfos": [
           "OSInfo{osMajor=0, osMinor=0, product=0, buildNumber=0, platform=ARCH_AMD64, osDistribution=null, osType=null, osTypeGroup=WINDOWS_TYPES}"
       ]
   }
 ]