Fidelis EDR v1.1.0

About the connector

Fidelis Endpoint EDR detects endpoint activity in real time and retrospectively so you can accelerate your response and stop adversaries at the point of entry. This connector supports following actions Get Alerts, Get Endpoints, Detete Endpoints, etc

This document provides information about the Fidelis EDR connector, which facilitates automated interactions, with a Fidelis EDR server using FortiSOAR™ playbooks. Add the Fidelis EDR connector as a step in FortiSOAR™ playbooks and perform automated operations with Fidelis EDR.

Version information

Connector Version: 1.1.0

Authored By: spryIQ.co

Certified: No

Release Notes for version 1.1.0

Following enhancements have been made to the Fidelis EDR connector in version 1.1.0:

• Added the following new operations and playbooks:
  • Get Alert Responses
  • Get Installed Software
  • Get Endpoints By Search Query
  • Get Job Status By Job ID
  • Create Custom Task

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-fidelis-edr

Prerequisites to configuring the connector

• You must have the credentials of Fidelis EDR server to which you will connect and perform automated operations.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Fidelis EDR server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Fidelis EDR connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

You can use the following automated operations in playbooks and also use the annotations to access operations:

operation: Get Alerts

Input parameters

Output

The output contains the following populated JSON schema:

{
    "entities": [
        {
            "id": "",
            "createDate": "",
            "endpointName": "",
            "endpointId": "",
            "name": "",
            "description": "",
            "artifactName": "",
            "source": "",
            "sourceType": "",
            "severity": "",
            "intelId": "",
            "intelName": "",
            "validatedDate": "",
            "actionsTaken": "",
            "eventId": "",
            "eventTime": "",
            "parentEventId": "",
            "eventType": "",
            "eventIndex": "",
            "reportId": "",
            "telemetry": "",
            "insertionDate": "",
            "hasJob": "",
            "osType": "",
            "agentTag": "",
            "enrichments": []
        }
    ],
    "totalCount": ""
}

operation: Get Endpoints

Input parameters

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "error": "",
    "data": {
        "entities": [
            {
                "id": "",
                "hostName": "",
                "ipAddress": "",
                "externalAddress": "",
                "description": "",
                "lastContactDate": "",
                "agentInstalled": "",
                "agentVersion": "",
                "os": "",
                "macAddress": "",
                "aV_Enabled": "",
                "eventsStopped": "",
                "locality": "",
                "groupList": "",
                "isGroupMember": "",
                "agentConnected": "",
                "isolated": "",
                "osType": "",
                "osArch": "",
                "agentTag": "",
                "createdDate": "",
                "avSigVersion": "",
                "advMalwareVersion": "",
                "aR_Enabled": "",
                "events_Enabled": "",
                "agentId": "",
                "groups": "",
                "processorName": "",
                "processorCount": "",
                "processorSpeedInMhz": "",
                "processorNumOfCores": "",
                "processorNumOfLogicalProcessors": "",
                "ramSize": "",
                "flag": "",
                "createdByType": "",
                "interfaceIPs": "",
                "agentScoreboardHash": "",
                "investigativeModeEnabled": "",
                "investigativeModeDuration": "",
                "investigativeModeStartTime": "",
                "eventsVersion": "",
                "activeDirectoryId": "",
                "lastAvScanDate": "",
                "motherboardSerial": "",
                "assetTag": "",
                "manufacturer": "",
                "model": "",
                "protectStatus": "",
                "hasAllAuthCerts": "",
                "hasAllCommCerts": ""
            }
        ],
        "totalCount": ""
    }
}

operation: Get Endpoint By Name

Input parameters

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "error": "",
    "data": []
}

operation: Delete Endpoint

Input parameters

Output

The output contains the following populated JSON schema:

{
    "error": "",
    "success": ""
}

operation: Get Playbooks

Input parameters

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "error": "",
    "data": {
        "entities": [
            {
                "id": "",
                "name": "",
                "description": "",
                "createdByName": "",
                "createdById": "",
                "createdDate": "",
                "scriptCount": "",
                "tags": "",
                "hasEndpointAction": "",
                "endpointActionText": ""
            }
        ],
        "totalCount": ""
    }
}

operation: Get Playbooks And Scripts

Input parameters

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "error": "",
    "data": {
        "entities": [
            {
                "id": "",
                "name": "",
                "description": "",
                "createdByName": "",
                "createdById": "",
                "createdDate": "",
                "tags": "",
                "platforms": {
                    "windows32": "",
                    "windows64": "",
                    "linux32": "",
                    "linux64": "",
                    "solaris": "",
                    "aix": "",
                    "osx": ""
                },
                "platformsStringList": "",
                "packageType": ""
            }
        ],
        "totalCount": ""
    }
}

operation: Get Playbooks Details

Input parameters

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "error": "",
    "data": {
        "scripts": [
            {
                "hash": "",
                "executionOrder": "",
                "scriptId": "",
                "scriptName": "",
                "questions": [
                    {
                        "paramNumber": "",
                        "question": "",
                        "answer": "",
                        "isOptional": "",
                        "inputType": ""
                    }
                ],
                "details": {
                    "id": "",
                    "name": "",
                    "platforms": {
                        "windows32": "",
                        "windows64": "",
                        "linux32": "",
                        "linux64": "",
                        "solaris": "",
                        "aix": "",
                        "osx": ""
                    },
                    "tags": "",
                    "createdBy": "",
                    "createdByName": "",
                    "createdDate": "",
                    "fileCount": "",
                    "scriptPackageFiles": [
                        {
                            "fileName": "",
                            "fileId": ""
                        }
                    ],
                    "platformsStringList": "",
                    "platformsLocalizedStringList": "",
                    "description": "",
                    "priority": "",
                    "resultColumns": [],
                    "timeoutSeconds": "",
                    "impersonationUser": "",
                    "impersonationPassword": "",
                    "command": "",
                    "wizardOverridePassword": "",
                    "questions": [
                        {
                            "paramNumber": "",
                            "question": "",
                            "answer": "",
                            "isOptional": "",
                            "inputType": ""
                        }
                    ],
                    "jsonQuestions": "",
                    "questionsHaveLoadError": "",
                    "resultDelimiter": "",
                    "dataDependencies": [],
                    "hasEndpointAction": "",
                    "endpointActionText": "",
                    "tenants": "",
                    "hash": ""
                },
                "queueExpirationEnabled": "",
                "queueExpirationInhours": "",
                "wizardOverridePassword": "",
                "impersonationUser": "",
                "impersonationPassword": "",
                "impersonationPasswordEnc": "",
                "integrationOutputFormat": "",
                "priority": "",
                "filter": "",
                "basicOptions": "",
                "volatileDetail": "",
                "processDetail": "",
                "iocDetail": "",
                "yaraDetail": "",
                "timeoutInSeconds": "",
                "jsonAnswers": "",
                "jsonQuestions": "",
                "isPlaybook": ""
            }
        ],
        "tenants": "",
        "baseTenantId": "",
        "hash": "",
        "id": "",
        "name": "",
        "description": "",
        "createdByName": "",
        "createdById": "",
        "createdDate": "",
        "scriptCount": "",
        "tags": "",
        "hasEndpointAction": "",
        "endpointActionText": ""
    }
}

operation: Get API version Information

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "error": "",
    "data": {
        "version": ""
    }
}

operation: Get Script Packages

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "error": "",
    "data": {
        "scripts": [
            {
                "id": "",
                "name": "",
                "description": ""
            }
        ],
        "totalCount": ""
    }
}

operation: Get Script Packages File

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "@id": "",
    "file": {
        "id": "",
        "@id": "",
        "size": "",
        "uuid": "",
        "@type": "",
        "assignee": "",
        "filename": "",
        "metadata": [],
        "mimeType": "",
        "thumbnail": "",
        "uploadDate": ""
    },
    "name": "",
    "type": "",
    "uuid": "",
    "@type": "",
    "tasks": [],
    "alerts": [],
    "assets": [],
    "owners": [],
    "people": [],
    "@context": "",
    "assignee": "",
    "comments": [],
    "warrooms": [],
    "incidents": [],
    "createDate": "",
    "createUser": {
        "id": "",
        "@id": "",
        "name": "",
        "uuid": "",
        "@type": "",
        "avatar": "",
        "userId": "",
        "userType": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": ""
    },
    "indicators": [],
    "modifyDate": "",
    "modifyUser": {
        "id": "",
        "@id": "",
        "name": "",
        "uuid": "",
        "@type": "",
        "avatar": "",
        "userId": "",
        "userType": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": ""
    },
    "recordTags": [],
    "userOwners": [],
    "description": ""
}

operation: Get Script Packages Manifest

Input parameters

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "error": "",
    "data": {
        "id": "",
        "name": "",
        "platforms": {
            "windows32": "",
            "windows64": "",
            "linux32": "",
            "linux64": "",
            "solaris": "",
            "aix": "",
            "osx": ""
        },
        "tags": "",
        "createdBy": "",
        "createdByName": "",
        "createdDate": "",
        "fileCount": "",
        "scriptPackageFiles": [
            {
                "fileName": "",
                "fileId": ""
            }
        ],
        "platformsStringList": "",
        "platformsLocalizedStringList": "",
        "description": "",
        "priority": "",
        "resultColumns": [
            "Not Before",
            "Serial Number"
        ],
        "timeoutSeconds": "",
        "impersonationUser": "",
        "impersonationPassword": "",
        "command": "",
        "wizardOverridePassword": "",
        "questions": [],
        "jsonQuestions": "",
        "questionsHaveLoadError": "",
        "resultDelimiter": "",
        "dataDependencies": [],
        "hasEndpointAction": "",
        "endpointActionText": "",
        "tenants": "",
        "hash": ""
    }
}

operation: Get Script Packages Metadata

Input parameters

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "error": "",
    "data": {
        "integrationOutputs": "",
        "scriptPackageId": "",
        "useImpersonation": "",
        "impersonationUser": "",
        "impersonationPassword": "",
        "timeoutInSeconds": "",
        "hosts": "",
        "endpointIds": [
            {}
        ],
        "questions": {},
        "useSchedule": "",
        "schedule": {
            "initialDateTime": "",
            "recurrenceRange": "",
            "maxRecurrenceCount": "",
            "endDateTime": "",
            "timeUnit": "",
            "period": "",
            "ordinalUnit": "",
            "ordinal": "",
            "ordinalDayOfWeek": "",
            "ordinalMonth": "",
            "weekday": "",
            "timeZoneName": "",
            "isIncremental": ""
        }
    }
}

operation: Get Script Packages Template

Input parameters

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "error": "",
    "data": {
        "integrationOutputs": [],
        "scriptPackageId": "",
        "useImpersonation": "",
        "impersonationUser": "",
        "impersonationPassword": "",
        "timeoutInSeconds": "",
        "hosts": [],
        "endpointIds": [],
        "questions": {},
        "useSchedule": "",
        "schedule": {
            "initialDateTime": "",
            "recurrenceRange": "",
            "maxRecurrenceCount": "",
            "endDateTime": "",
            "timeUnit": "",
            "period": "",
            "ordinalUnit": "",
            "ordinal": "",
            "ordinalDayOfWeek": "",
            "ordinalMonth": "",
            "weekday": [],
            "timeZoneName": "",
            "isIncremental": ""
        }
    }
}

operation: Execute Script Package

Input parameters

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "error": "",
    "data": {
        "jobId": "",
        "jobResultId": ""
    }
}

operation: Get Script Job Results

Input parameters

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "error": "",
    "data": {
        "hits": {
            "total": {
                "value": "",
                "relation": ""
            },
            "hits": [],
            "useNonDeterministicPaging": "",
            "nonDeterministicPagingInfo": ""
        },
        "columns": [],
        "pendingMigration": ""
    }
}

operation: Execute Task

Input parameters

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "error": "",
    "data": ""
}

operation: Get Installed Software

Input parameters

Output

The output contains the following populated JSON schema:

{
    "entities": [
        {
            "installSource": "",
            "installLocation": "",
            "installDate": "",
            "uninstallString": "",
            "canUninstall": "",
            "installedSoftwareKey": "",
            "name": "",
            "publisher": "",
            "version": "",
            "hasCVE": "",
            "cveCount": "",
            "cveHighestScore": "",
            "cveList": "",
            "highestCVESeverity": "",
            "cveSeverity": ""
        }
    ],
    "totalCount": ""
}

operation: Get Alert Responses

Input parameters

Output

The output contains the following populated JSON schema:

{
    "alertResponseInfos": [],
    "totalCount": ""
}

operation: Get Endpoints By Search Query

Input parameters

Output

The output contains the following populated JSON schema:

{
    "entities": [
        {
            "id": "",
            "hostName": "",
            "ipAddress": "",
            "externalAddress": "",
            "description": "",
            "lastContactDate": "",
            "agentInstalled": "",
            "agentVersion": "",
            "os": "",
            "macAddress": "",
            "aV_Enabled": "",
            "eventsStopped": "",
            "locality": "",
            "groupList": "",
            "isGroupMember": "",
            "agentConnected": "",
            "isolated": "",
            "osType": "",
            "osArch": "",
            "agentTag": "",
            "createdDate": "",
            "avSigVersion": "",
            "advMalwareVersion": "",
            "aR_Enabled": "",
            "events_Enabled": "",
            "agentId": "",
            "groups": "",
            "processorName": "",
            "processorCount": "",
            "processorSpeedInMhz": "",
            "processorNumOfCores": "",
            "processorNumOfLogicalProcessors": "",
            "ramSize": "",
            "flag": "",
            "createdByType": "",
            "interfaceIPs": "",
            "agentScoreboardHash": "",
            "investigativeModeEnabled": "",
            "investigativeModeDuration": "",
            "investigativeModeStartTime": "",
            "eventsVersion": "",
            "activeDirectoryId": "",
            "lastAvScanDate": "",
            "motherboardSerial": "",
            "assetTag": "",
            "manufacturer": "",
            "model": "",
            "protectStatus": "",
            "hasAllAuthCerts": "",
            "hasAllCommCerts": ""
        }
    ],
    "totalCount": ""
}

operation: Get Job Status By Job ID

Input parameters

Output

The output contains the following populated JSON schema:

{
    "jobID": "",
    "resultID": "",
    "name": "",
    "startDate": "",
    "endDate": "",
    "createdDate": "",
    "hasSchedule": "",
    "fromScheduledTask": "",
    "status": "",
    "statusCode": "",
    "scriptPackage": "",
    "scriptPackageId": "",
    "playbookId": "",
    "createdBy": "",
    "createdById": "",
    "hasAlert": "",
    "alertName": "",
    "alertId": "",
    "fromPlaybook": "",
    "playbook": "",
    "order": ""
}

operation: Create Custom Task

Input parameters

Output

The output contains the following populated JSON schema:

The output contains a non-dictionary value.

Included playbooks

The Sample - Fidelis EDR - 1.1.0 playbook collection comes bundled with the Fidelis EDR connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Fidelis EDR connector.

• Create Custom Task
• Delete Endpoint
• Execute Script Package
• Execute Task
• Get API version Information
• Get Alert Responses
• Get Alerts
• Get Endpoint By Name
• Get Endpoints
• Get Endpoints By Search Query
• Get Installed Software
• Get Job Status By Job ID
• Get Playbooks
• Get Playbooks And Scripts
• Get Playbooks Details
• Get Script Job Results
• Get Script Packages
• Get Script Packages File
• Get Script Packages Manifest
• Get Script Packages Metadata
• Get Script Packages Template

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.