search

tobor88 / CybereasonAPI

PowerShell module containing commands to easily interact with the Cybereason API.
https://www.cybereason.com/
GNU General Public License v3.0
15 stars 6 forks source link

Just checking in are you still working on this project? #4

Open TATUMTOT opened 2 years ago

TATUMTOT commented 2 years ago

Thanks

tobor88 commented 2 years ago

Unfortunately I am no longer working for an organization where I was working with Cybereason and I am not able to work with it in the same way I was before. Is there something in particular you would like me to check on

TATUMTOT commented 2 years ago

Possibly I have a meeting to go over somethings regarding issues I’m having the dashboard for example you can mass remediate or exclude. So far we have not had the best experience.

tobor88 commented 2 years ago

I am sorry for the trouble. Can you give me an example of what you are attempting to do and what happens instead. My first thought is that I have run into a few issues with the API and Two Factor Authentication. It also could be as simple as something with single quotes when building the json string.

After authenticating we get a JWT token that is passed on. For some reason that token does not seem to work in the situations that it should. Despite not changing any cmdlets I became unable to use them after previously taking screenshots of their results. I believe I need to change how I keep the session information and no longer store it in a Session Variable; instead If that is I probably need to make a header and pass that on with every request. I have not figured out why the token in the session variable would work for the API user but not TFA accounts. The results have been discombobulating.

I do not currently have access to a Cybereason API to communicate with and I am relying entirely on their documentation. Any error messages you can provide would be helpful as well. If you prefer to send them to me at rosborne@osbornepro.com that is fine. I will post an update here when we get something going.

TATUMTOT commented 2 years ago

We dont have TFA enabled just yet. But I’m going to be working with this week and over the next month so I will have to get back to you.

tobor88 commented 2 years ago

Sounds good. I will do my best to get it resolved quickly. I would like to have everything that is completed so far working.