In this installment of the Tips and Insights series, Mohammad Anwar gives a brief overview of customs scripts that can be used in the FireEye Security Orchestrator (FSO).
The problem that setup here is we’re getting a DHCP by hostname and the return type will be a string. However the input for this next command is a MAC address and we can see that they’re not aligning and it’s saying data is invalid.
In order to resolve this we’ll be creating a custom script that would be in between these two that would convert the string to a MAC address.
In order to do that well append a new task and put it in between these two.
And we would select ‘script task’ in the dropdown. Go to custom script and you can go ahead and name this.
Write a short description.
Go ahead and save it.
Now we can go ahead and edit the script.
Since the return type for the first command will be a list. We’re gonna set it as a list input and since the output we just want a similar output we would just set it to empty string and then the main function we would then just type ‘output.bar equals input.foo’ and then select that first element. Go ahead and click save and for the input we want to select that is a list and for the output we want to change it from string to a MAC address type and since it’s not a list we’ll just leave that alone.
Go ahead and save the script.
Now we can alter the downstream command to get the input from our custom script and we can see that it is a MAC address type and once we hit save we can see that it’s valid input and we can go in and publish the playbook.
Now that the playbook is published, we can go ahead and run the activities. Run the playbook activities and we can do this by sending a message and we can refresh this to make sure that it comes in and we can see that it did come in and we can see that the DHCP returned four results.
The custom script then took that result and took the first element and changed it to a MAC address and fed it to the ‘get host by Mac’ command and we can see the result of the ‘get host by Mac’ command here.
This concludes the overview for custom scripts in FireEye Security Orchestrator. I hope this overview gives you an understanding of custom scripts and how to use them in FSO. Thank you for taking the time to check out our plugin overview series and stay tuned for more FireEye Tips and Insights.