Use the Quin-C AccessData integration to protect against and provide additional visibility into phishing and other malicious email attacks. This integration was integrated and tested with version 20190926 of Quin-C Accessdata.

Documentation for the integration was provided by Quin-C.

For example, you can look at “Accessdata: Dump memory for malicious process” playbook to understand how to use this integration.

1. Navigate to Settings > Integrations > Servers & Services.

2. Search for Accessdata.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Description	Example
   Name	A meaningful name for the integration instance.	Quin-C Instance Alpha
   Server URL	The URL to the AccessData server, including the scheme.	FQDN or IP address in X.X.X.X format with scheme specified.
   Token	A piece of data that servers use to verify for authenticity	eea810f5-a6f6
   Trust any certificate (not secure)	When selected, certificates are not checked.	N/A
   Use system proxy settings	Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration.	https://proxyserver.com

4. Click Test to validate the URLs, token, and connection.

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Returns a list of processes from the legacy agent.

accessdata-legacyagent-get-processlist

accessdata-legacyagent-get-processlist caseid=2 target_ip=X.X.X.X

{
    "Accessdata.Job": {
        "ID": 157, 
        "Type": "Volatile", 
        "CaseID": "2", 
        "State": "Unknown", 
        "CaseJobID": "2_157"
    }
}

JobID: 157

Creates a legacy agent memory dump.

accessdata-legacyagent-get-memorydump

accessdata-legacyagent-get-memorydump caseid=2 target_ip=X.X.X.X

{
    "Accessdata.Job": {
        "ID": 158, 
        "Type": "LegacyMemoryDump", 
        "CaseID": "2", 
        "State": "Unknown", 
        "CaseJobID": "2_158"
    }
}

JobID: 158

Reads a file from a case folder and puts the contents into the context output.

accessdata-read-casefile

accessdata-read-casefile filepath="\\X.X.X.X\D$\paths\cases\ProcessingHelperCase\b389a8e9-4ce4-473d-8d2e-9026f53f925c\Jobs\job_153\fa9787a3-49a1-4d73-a194-7c944eb9a3bf\1\snapshot.xml"

{
    "Accessdata.File.Contents": "<?xml version=\"1.0\"?>\r\n<root>\r\n<Process resultitemtype=\"15\"><Name>addm.exe</Name><Path/><StartTi ... ress>0</baseAddress><ImageSize>0</ImageSize><ProcessName/><FromAgent/></DLL>\r\n</root>\r\n"
}

<?xml version="1.0"?>
<root>
<Process resultitemtype="15">\<Name>addm.exe</Name>\<Path/>\<StartTi ... ress>0</baseAddress>\<ImageSize>0</ImageSize>\<ProcessName/>\<FromAgent/>\</DLL>
</root>

Checks the status of a job.

accessdata-jobstatus-scan

accessdata-jobstatus-scan caseJobID=2_153

{
    "Accessdata.Job": {
        "ID": "153", 
        "CaseID": "2", 
        "State": "Success", 
        "CaseJobID": "2_153"
    }
}

Current job state: Success

Gets a snapshot of the path from the results of the process list job.

accessdata-get-jobstatus-processlist

accessdata-get-jobstatus-processlist caseID=2 jobID=153

{
    "Accessdata.Job": {
        "ID": "153", 
        "Result": "\\\\X.X.X.X\\D$\\paths\\cases\\ProcessingHelperCase\\b389a8e9-4ce4-473d-8d2e-9026f53f925c\\Jobs\\job_153\\fa9787a3-49a1-4d73-a194-7c944eb9a3bf\\1\\snapshot.xml", 
        "CaseID": "2", 
        "State": "Success", 
        "CaseJobID": "2_153"
    }
}

\X.X.X.X\D$\paths\cases\ProcessingHelperCase\b389a8e9-4ce4-473d-8d2e-9026f53f925c\Jobs\job_153\fa9787a3-49a1-4d73-a194-7c944eb9a3bf\1\snapshot.xml

Gets a memory dump path from the results of a memory dump job.

accessdata-get-jobstatus-memorydump

accessdata-get-jobstatus-memorydump caseID=2 jobID=154

{
    "Accessdata.Job": {
        "ID": "154", 
        "Result": "\\\\X.X.X.X\\data\\SiteServer\\storage\\60564598-ca55-475c-9f27-ab4992e8ff46\\1\\memdump.mem", 
        "CaseID": "2", 
        "State": "Success", 
        "CaseJobID": "2_154"
    }
}

\X.X.X.X\data\SiteServer\storage\60564598-ca55-475c-9f27-ab4992e8ff46\1\memdump.mem

Returns the ID of the processing case.

accessdata-get-processing-case-id

There are no input arguments for this command.

accessdata-get-processing-case-id

{
    "Accessdata.ProcessingCaseId": 2
}

2