{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44512,"path":"security-management/security-incident-response/fireeye-additional-actions-on-endpoint.md","title":"FireEye Additional Actions on Endpoint","bundle":null,"doc_type":null,"release":"australia","body":"\n# FireEye Additional Actions on Endpoint\n\nFireEye integration supports running additional actions beyond the gold standard actions.\n\nThese actions comprise of Triage Acquisition and Data Acquisitions. Out of the box, two data acquisitions are supported:\n\n- Comprehensive Investigative Details Script\n- Standard Investigative Details Script\n\nIn addition, Triage Acquisition is also supported out of the box. All these three are created by default along with the source. The customers can also create their own actions i.e., Data acquisitions from the FireEye Additional Actions Module.\\[1\\] The maximum file size supported for FireEye Additional Actions is 1024, and this value can be configured by changing **com.glide.attachment.max\\_size**, and the default timeout is 120 minutes that can be configured from the FireEye Default Setting page.\n\n## Comprehensive Investigative Details Script\n\nEnables collecting all forensic and investigative artifacts from the endpoint but is the most prohibitively expensive option. This configuration is ideal for situations where there will only be one window for collecting data from the endpoint in question, and the ability to acquire more data cannot be guaranteed later. So, use this action with caution.\n\n## Standard Investigative Details Script\n\nEnables the most common options for collecting forensic and investigative artifacts from an endpoint. Meant to be the primary response tool when you have suspicion that an endpoint may be compromised and need to perform a deep dive analysis of that endpoint. Aims to strike a balance between collecting the most relevant and valuable data whilst avoiding the costly options that can be collected later once further investigation proves them necessary.\n\n## Triage Acquisition\n\nTriage collections contain information from within the lookback cache as well as additional forensic audit information, such as URL download history, file download history, process and ports listings, and standard system information. You might want to examine such information when anomalous network traffic is detected, and you want more visibility into endpoint actions.\n\n## Maintaining Data Acquisition Scripts on FireEye\n\nData acquisition requests \\(sometimes referred to as Live Response requests\\) allow you to acquire any data you need from a single running endpoint. Using the Data Acquisition Scripts page on FireEye, you can create, edit, copy, and delete the data acquisitions scripts used for data acquisition requests.\n\n## Accessing the Data Acquisition Scripts Page on FireEye\n\nTo access the Data Acquisition Scripts page:\n\n1. Navigate to Endpoint Security web user interface.\n2. Select Data Acquisition Scripts on the Admin menu.\n\n## Creating a Script on FireEye\n\nTo create a data acquisition script:\n\n1. Select **Data Acquisition Scripts** > **Admin** menu of the Endpoint Security web user interface.\n2. Click **Create Script**.\n3. Enter a name for the new script in the **Script Name** field.\n4. Optionally, enter a description of the script.\n5. Select the operating system to which the script applies. You can only select a single operating system on the Create Script dialog.\n6. Click **Create** to start the script definition.\n7. Select an acquisition data type in the **Add an acquisition type**drop-down box and click **Add**. Options for the acquisition type you requested appear to the right of the script list.\n8. Supply values for the acquisition type options or use the default values that are already selected. The Web UI does not warn you or remove tabs, spaces, or unwanted characters \\(such as \\\\n\\) in your specifications.\n9. Repeat the previous 2 steps to request additional data for the data acquisition script. Some acquisition data types are available only once for a script, while others can be specified more than once. After adding an acquisition type to a script, the list of acquisition types available in the **Add an acquisition type**drop-down box adjusts appropriately.\n10. To remove an acquisition data type from the script, click the x icon \\( \\) on the acquisition tab on the left side of the page.\n\n**Note:** This integration does not support **Allow Edits before acquiring** option while creating scripts. So, ensure that the check box is unchecked.\n\n## Exporting a Script from FireEye\n\nYou can export a data acquisition script to a JSON file. To export a data acquisition script:\n\n1. Select **Data Acquisition Scripts** > **Admin** of the Endpoint Security web user interface.\n2. Select Data Acquisition Scripts on the Admin menu.\n3. Select the script you want to export on the left side of the page.\n4. select **Actions** > **Export Script**.\n5. A JSON file is downloaded to your computer. The JSON file name includes the operating system so you can easily determine which scripts are for which operating system.\n\n## Creating a new Data Acquisition Action in the ServiceNow AI Platform\n\nTo create a new action, follow these steps:\n\n1. Navigate to **FireEye Integration** > **FireEye Additional Actions**. The FireEye Additional Actions list is displayed.\n2. Click **New**. The form for the new action is displayed.\n3. Fill out of the form.\n\n\n
\n\n \n\n\n\n \n\n
\n\nAction Name\n\n\n\nName of the FireEye action that is performed. This name helps you identify the Action type and describe it.\n\n
\n\nAcquisition\n\n\n\nAn acquisition obtains the data to analyze. This is a read only field, and is defaulted to Data Acquisition.\n\n
\n\nSource\n\n\n\nName of the FireEye source. Only configured sources are available from the choice list.\n\n
\n\nCapability\n\n\n\nThis is a read only field and is populated with Run Additional Action\\(s\\) capability\n\n
\n\nAcquisition Type\n\n\n\nType of acquisition action that needs to be obtained, and analyzed.\n\n
\n\nActive\n\n\n\nThis indicates that the Action is active.\n\n
\n\nRequire Approval\n\n\n\nWhen you enable the Require Approval option, the Approvers field is available on the form. After you submit a request, approval is required from the group to complete the request.\n\n
\n\nDisplay tag\n\n\n\nType of operation system such as Windows, Mac, Linux for adding scripts.**Note:** Only one type of OS is supported currently. You can create one action per operating system. For other operating systems, create new actions as required.\n\n
\n\nScripts\n\n\n\nImported script from FireEye needs to be provided for the selected OS Type. Only one script can be added to each OS type.\n\n
4. Click **Submit**.\n\n## Triggering Data Acquisitions from Security Incident\n\nThe Additional actions created can be run via the Related Link called **Run Additional Action\\(s\\) on Endpoint** on the security incident.\n\n**Note:** **Allow Edits before acquiring** FireEye functionality is not supported for the Additional Actions on Endpoint.\n\n"}}