Trellix AX Operation

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Submit

The Submit action will submit a file (attachment) or a URL/FQDN to Trellix AX for sandboxing.

POST https:{host_url}/wsapis/v2.0.0/submissions/url

Sample Response:

    {
    "rawType": "com.fireeye.v200.rest.model.SubmitUrlResponse",
    "type": "com.fireeye.v200.rest.model.RestModelBase",
    "entity": {
        "response": [
            {
                "id": "L31",
                "link": {
                    "rel": "status",
                    "href": "/submissions/status/L31"
                },
                "submission_details": "[{\"vnc_port\":[],\"job_ids\":[],\"id\":501,\"uuid\":\"5b8d6f3a-3093-47df-9a41-c57e6c5319d3\"}]"
            }
        ]
    }
}

Configuration Options

The action provides the following configuration options:

Parameter	Description
Run Using Custom Application	Allows you to run the sample with a specific application within the sandbox profile.  This value is a number that corresponds to the custom application.  The default setting is 0 - this tells Trellix to determine the application to use.
Timeout	Determines how long the sandbox will take to "timeout" after inactivity.  The default setting is 500.
Priority	Sets a priority for the task.  Options include: Normal (default) Urgent
Profiles List (overrides config)	This parameter is a list of profiles to use to sandbox the sample. The action will use the profiles set in the UI configuration if this is left blank. Otherwise, this will override the profiles listed in the UI configuration
Force	This parameter will force resubmit a sample. If this is set to False, it will mark the sample as a duplicate and will not resubmit it.
Analysis Type	Set the Analysis Type. The default setting is Sandbox.
Prefetch	Determine the file target based on an internal determination rather than browsing to the target location. The Analysis Type must be set to 1 if you are using the Sandbox.

Get Reports

The Get Reports action will get all the reports for the sample, with the only condition being that the sample (in ThreatQ) has an attribute with the name "Trellix AX Submission ID" and the value will be the submission ID.

For each of these attributes, it will fetch a report correlating to the submission ID. If submission results are found, results will be shown and the full JSON report will be uploaded and related to the sample in ThreatQ.

GET https:{host_url}/wsapis/v2.0.0/submissions/results/{submisionID}

Sample Response:

    {
    "alert": [
        {
            "explanation": {
                "malwareDetected": {
                    "malware": [
                        {
                            "md5Sum": "be5d431e32bea4c4bbfc331e233f5a7b",
                            "sha256": "437d73cffc51cd3571b306430484bb781af93c45011c96cfc45eb2d6caa48a68"
                        }
                    ]
                },
                "osChanges": []
            },
            "src": {},
            "alertUrl": "https://10.20.0.133/malware_analysis/analyses?maid=500",
            "action": "notified",
            "attackTime": "2023-02-13 12:56:01 +0000",
            "dst": {},
            "applianceId": "AC1F6B720474",
            "id": 500,
            "name": "MALWARE_OBJECT",
            "severity": "MINR",
            "uuid": "4456d46b-d0e9-4b66-9ecc-0dfde7a67f07",
            "ack": "no",
            "product": "MAS",
            "vlan": 0,
            "malicious": "no"
        }
    ],
    "appliance": "MAS",
    "version": "MAS (MAS) 9.1.1.956704",
    "msg": "concise",
    "alertsCount": 1
}

 

Add YARA Rule

The Add YARA Rule action allows you to add YARA rules from ThreatQ to Trellix AX.

POST https:{host_url}/wsapis/v2.0.0/customioc/yara/add/{file_type}

Sample Response:

    sample

Configuration Options

The action provides the following parameters:

Parameter	Description
Content Type	Specify which content type the new YARA rule should be applied to.  Options include: Active content: Extracts the macros from files and executes special YARA rules on them. Base (default): If file contains a macro, don’t extract and analyze macros; only analyze the base file. All: Does both
File Type	The file type of the YARA rules file being submitted, such as exe, pdf, or ppt.  The default setting is Common.

Remove YARA Rule

The Remove YARA Rule action allows you to remove YARA rules from ThreatQ.  

POST https:{host_url}/wsapis/v2.0.0/customioc/yara/remove/{file_type}/{yara_rule}

Sample Response:

   sample

Configuration Options

The action provides the following parameters:

Parameter	Description
Content Type	Specify which content type the new YARA rule should be applied to.  Options include: Active content: Extracts the macros from files and executes special YARA rules on them. Base (default): If file contains a macro, don’t extract and analyze macros; only analyze the base file. All: Does both
File Type	The file type of the YARA rules file being submitted, such as exe, pdf, or ppt.  The default setting is Common.

Query Alerts

The Query Alerts action allows you to query alerts in Trellix AX.

This action only applies to FQDNs, Filenames, Emails, and IP Addresses.

GET https:{host_url}/wsapis/v2.0.0/alerts

Sample Response:

    {
    "alert": [],
    "appliance": "MAS",
    "version": "MAS (MAS) 9.1.1.956704",
    "msg": "extended",
    "alertsCount": 0
}

Configuration Options

The action provides the following parameters:

Parameter	Description
Start Time	Set the start time to search for alerts. This is used in conjunction with the Duration parameter. You cannot use this at the same time as using the End Time parameter Format: YYYY-MM-DDTHH:mm:ss.sss-OH:om Example: 2019-02-21T16:30:00.000-07:00
End Time	Set the end time to search for alerts. This is used in conjunction with the Duration parameter. You cannot use this at the same time as using the Start Time parameter. Format : YYYY-MM-DDTHH:mm:ss.sss-OH:om Example: 2019-02-21T16:30:00.000-07:00 If no end time or start time is provided, the end time will be set to the current date/time
Duration	Set the amount of time you want to either look after a start time or before an end time. The default setting is 12 hours.
Info Level	Set the detail level of the alerts.   Options include: Concise (default) Normal Extended Normal and Extended options will provide a very large alert and may take longer to download.

PDF Guides

Document	ThreatQ Version
Trellix AX Operation Guide v1.1.0	4.10 or Greater
FireEye AX Operation Guide v1.0.2	4.10 or Greater
FireEye AX Operation Guide v1.0.0	3.6.0 or Greater