Sample API Scenarios

As you work on the Cybereason platform you may want to utiliize the API to help you perform a number of different tasks:

• Investigate suspicious items in your environment

• Retrieve Malop data

• Perform Sensor management functions

• Search for files in your environment

• Download a file from the Element Details

• Create a custom detection rule

The following use-case examples provide more detailed, step-by-step instructions and code samples for common uses of the Cybereason API.

Investigation use cases

• Run a simple query

• Run an advanced query

• Find Indicators of Suspicious Behavior

• Find Indicators of Suspicious Behavior - Advanced Example

• Find processes with connections transmitting a large amount of data

• Investigate items in a Malop

• Search for files

• Download a file from the Element Details screen

• Find connections for a specific IP address

Malop management and triage use cases

• Get a list of Malops

• Get a report of Malops and suspicions for a specific time period

• Get a list of suspicions or evidences

• Automatically remediate items in a Malop

• Add sensor tags to machines associated with Malops

• Find MalOps where the automatic protection action failed

• Find MalOps for a specific machine

Sensor management use cases

• Check sensor versions and upgrade sensors

• Find sensors running on a machine with a specific operating system

• Download sensor logs

Other use cases

• Update item reputations based on threat intel

• Create a custom detection rule