FireEye Client Library for Python

This is the Python client library for all things FireEye API. Currently it only supports FireEye's Detection On Demand but will have support for other FireEye API's soon.

For more API information, visit the FireEye Developer Hub

Installation

To install the Python client library:

pip install fireeyepy

To upgrade your installed library:

pip install fireeyepy --upgrade

Alternatively, you can clone the repository via the command line:

git clone https://github.com/fireeye/fireeye-python.git

Usage

Begin by importing the 'fireeye' module:

import fireeyepy

Detection On Demand

Construct a Detection object with your api key:

detection = fireeyepy.Detection(key=api_key)

To obtain a free trial API key, subscribe on the AWS Marketplace

Upload A File

  import fireeyepy

  detection = fireeyepy.Detection(key="yourapikeyhere")

  result = detection.submit_file(
    files={
      "file": ('filename', open('./path/to/filename', 'rb'))
    }
  )

With configuration options:

  result = detection.submit_file(
    body={
      "file_name": "different_name.txt",
      "screenshot": true
    },
    files={
      "file": ('filename', open('./path/to/filename', 'rb'))
    }
  )

Submit URLs

  import fireeyepy

  detection = fireeyepy.Detection(key="yourapikeyhere")

  result = detection.submit_urls(["url1","url2",...])

Retrieve File or URL Report

response = detection.get_report(report_id)

You may also provide the optional extended=True flag to get the full, in-depth report:

response = detection.get_report(report_id, extended=True)

Search for a file from a connector (ex. Box, Teams, S3, etc.)

response = detection.search_reports(connector_type="box", file_id="123456")

Get a list of reports

Start and end time are in Unix epoch time.

response = detection.telemetry(start_time=1603980060, end_time=1604066460)

Retrieve Presigned URL for Dashboard Report

result = detection.get_presigned_url(report_id)

Perform Hash Lookup

response = detection.get_hash(hash)

Get a report artifact

artifact = detection.get_artifact(report_id="8d0aa90b-8bf3-4483-ae3b-0ded00d157ab", artifact_type="screenshot")

Get the health of the Detection on Demand service

health = detection.get_health()