FireEye NX

The action should not fail nor stop a playbook execution:

If successful:

Print "Successfully connected to the Trellix Network Security server with the provided connection parameters!"

The action should fail and stop a playbook execution:

If not successful:

Print "Failed to connect to the Trellix Network Security server! Error is {0}".format(exception.stacktrace)

The action should not fail nor stop a playbook execution:

if status code 200 (is_success = true):

Print "Successfully downloaded Trellix Network Security alert artifacts with alert id {0}!".format(alert uuid)

if status code 200 (is_success = true):

Print "Action wasn't able to download Trellix Network Security alert artifacts with alert id {0}. Reason: File with that path already exists."

if status code 404 (is_success = false) :

Print "Artifacts for alert with uuid {0} were not found. ".format(alert_uuid)

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other:

Print "Error executing action "Download Alert Artifacts". Reason: {0}''.format(error.Stacktrace)

ALL

Possible Values

A

B

C

D

ALL

Block

Possible Values

Block

Unblock

Suppress

Suppress-unblock

The action should not fail nor stop a playbook execution:
if status code 200 for at least one entity (is success=true):"Successfully added IPS policy exceptions in Trellix Network Security based on the following entities: {0}!".

If one or more entities didn't work (status code 400) (is success=true):"Action wasn't able to add IPS policy exceptions based on the following entities:\n{0}".

if none of the entities worked:"No IPS policy exception were created".

The action should fail and stop a playbook execution:
if fatal error, like wrong credentials, no connection to server, other:"Error executing action "Add IPS Policy Exception". Reason: {0}''.format(error.Stacktrace)

Describes the name of the field where the environment name is stored.

If the environment field isn't found, the environment is the default environment.

A regex pattern to run on the value found in the "Environment Field Name" field.

Default is .* to catch all and return the value unchanged.

Used to allow the user to manipulate the environment field via regex logic.

If the regex pattern is null or empty, or the environment value is null, the final environment result is the default environment.