soar
FireEye HX
Splunk SOAR Cloud
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
FireEye HX Endpoint Security
Supported Actions Version 2.3.2
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- get system info: Get system information for an endpoint
- quarantine device: Request to contain the endpoint
- get quarantine status: Get the containment status for an endpoint
- set quarantine approved: Approve containment request for host
- unquarantine device: Containment cancellation for host
- get acquisition status: Get status of file acquisition
- get triage: Request Endpoint Host Triage Package
- list device groups: Retrieve a list of host sets in HX optionally filtered by name
- get device group: List endpoints in a host set
- list endpoints: List and search the endpoints on HX
- list acquisitions: Retrieve a list of all acquisitions with optional filters
- start acquisition: Request a file to be acquired into FireEye HX
- get file: Pull the acquired file into Phantom Vault
- get alert: Pull single alert info by ID
Supported Actions Version 2.3.1
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- get system info: Get system information for an endpoint
- quarantine device: Request to contain the endpoint
- get quarantine status: Get the containment status for an endpoint
- set quarantine approved: Approve containment request for host
- unquarantine device: Containment cancellation for host
- get acquisition status: Get status of file acquisition
- get triage: Request Endpoint Host Triage Package
- list device groups: Retrieve a list of host sets in HX optionally filtered by name
- get device group: List endpoints in a host set
- list endpoints: List and search the endpoints on HX
- list acquisitions: Retrieve a list of all acquisitions with optional filters
- start acquisition: Request a file to be acquired into FireEye HX
- get file: Pull the acquired file into Phantom Vault
- get alert: Pull single alert info by ID
Supported Actions Version 2.2.1
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- get system info: Get system information for an endpoint
- quarantine device: Request to contain the endpoint
- get quarantine status: Get the containment status for an endpoint
- set quarantine approved: Approve containment request for host
- unquarantine device: Containment cancellation for host
- get acquisition status: Get status of file acquisition
- get triage: Request Endpoint Host Triage Package
- list device groups: Retrieve a list of host sets in HX optionally filtered by name
- get device group: List endpoints in a host set
- list endpoints: List and search the endpoints on HX
- list acquisitions: Retrieve a list of all acquisitions with optional filters
- start acquisition: Request a file to be acquired into FireEye HX
- get file: Pull the acquired file into Phantom Vault
- get alert: Pull single alert info by ID
Supported Actions Version 2.1.0
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- get system info: Get system information for an endpoint
- quarantine device: Request to contain the endpoint
- get quarantine status: Get the containment status for an endpoint
- set quarantine approved: Approve containment request for host
- unquarantine device: Containment cancellation for host
- get acquisition status: Get status of file acquisition
- get triage: Request Endpoint Host Triage Package
- list device groups: Retrieve a list of host sets in HX optionally filtered by name
- get device group: List endpoints in a host set
- list endpoints: List and search the endpoints on HX
- list acquisitions: Retrieve a list of all acquisitions with optional filters
- start acquisition: Request a file to be acquired into FireEye HX
- get file: Pull the acquired file into Phantom Vault
- get alert: Pull single alert info by ID
Supported Actions Version 2.0.0
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- get system info: Get system information for an endpoint
- quarantine device: Request to contain the endpoint
- get quarantine status: Get the containment status for an endpoint
- set quarantine approved: Approve containment request for host
- unquarantine device: Containment cancellation for host
- get acquisition status: Get status of file acquisition
- get triage: Request Endpoint Host Triage Package
- list device groups: Retrieve a list of host sets in HX optionally filtered by name
- get device group: List endpoints in a host set
- list endpoints: List and search the endpoints on HX
- list acquisitions: Retrieve a list of all acquisitions with optional filters
- start acquisition: Request a file to be acquired into FireEye HX
- get file: Pull the acquired file into Phantom Vault
- get alert: Pull single alert info by ID
Release Notes
Version 2.3.2
April 28, 2025
- Update Python dependencies for vulnerabilities, package updates, and platform built-in removals
- Update Python dependencies for Python 3.13 support
- Update NOTICE file with updated dependencies
- Apply pre-commit fixes
Version 2.3.1
March 12, 2022
- Updated retry logic in the code
Version 2.2.1
Jan. 17, 2022
FireEye HX Release Notes - Published by Splunk Community January 17, 2022
Version 2.2.1 - Released January 17, 2022
- Fixed py2 to py3 bugs
- Fixed minor issues in 'start_acquisition' action
- Added port details in app documentation
Version 2.1.0
Oct. 27, 2021
FireEye HX Release Notes - Published by Splunk Community October 27, 2021
Version 2.1.0 - Released October 27, 2021
- Updated output data paths for 'list endpoints' action
-
Removed existing unnecessary hard-coded summary data path from the output of the below-mentioned actions:
- get file
- get quarantine status
- unquarantine device
-
Fixed failed action result status for success status codes in case of empty response returned from the server
Version 2.0.0
Sept. 21, 2021
FireEye HX Release Notes - Published by Splunk Community September 8, 2021
Version 2.0.0 - Released September 8, 2021
- Compatibility changes for Python 3 support
- Added one new action 'get alert'
- Validation of parameters with numeric datatype
- Modified the defunct vault API method