Lumu Documentation

https://docs.lumu.io/portal/en/
Admin
Lumu Documentation provides a knowledge base and articles to help users learn about the features and...
Tokens:90,305
Snippets:1,082
Trust Score:9.2
Update:4 months ago
Show doc for...
Tokens:
Raw
### Start Integration

Source: https://docs.lumu.io/portal/en/kb/articles/cisco-custom-response

Run this command to start the integration. Use 'start-ioc' to start IoC-related processes and 'start-component' for component-specific processes.

```bash
make start-ioc
```

```bash
make start-component
```

--------------------------------

### Configure Integration Parameters

Source: https://docs.lumu.io/portal/en/kb/articles/cisco-custom-response

Execute this command to start the configuration process. You will be prompted to enter parameters gathered during the setup steps.

```bash
make config
```

--------------------------------

### Start Cloudflare Integration

Source: https://docs.lumu.io/portal/en/kb/articles/cloudflare-custom-response-integration

Use this command to start the Cloudflare integration service.

```bash
docker start lumu-cloudflare-one-response
docker start lumu-cloudflare-one-response-ioc
```

--------------------------------

### Start the Integration

Source: https://docs.lumu.io/portal/en/kb/articles/cloudflare-custom-response-integration

Execute the start command to run the integration. Ensure the integration is active before proceeding.

```bash
bash manage.sh start
```

--------------------------------

### GET Request Example for Last Contacted Adversaries

Source: https://docs.lumu.io/portal/en/kb/articles/core-concepts-api

Example using curl to send a GET request to retrieve last contacted adversaries, specifying hours.

```Shell
curl --location --request GET 'https://defender.lumu.io/api/adversarial-activity/contacted-adversaries/spambox/last?key=56a0fc30-a6de-85eb-8249-a117f0a9f8g3&page=1&items=50&hours=1' \
--data-raw ''
```

--------------------------------

### Install Requirements for Netskope Collector

Source: https://docs.lumu.io/portal/en/kb/articles/cc-api-netskope-swg

Run this command from the deployment folder to install the necessary Python packages listed in requirements.txt.

```bash
pip install -r ./requirements.txt
```

--------------------------------

### Enable Proxy Credentials Prompt (.exe)

Source: https://docs.lumu.io/portal/en/kb/articles/lumu-agent-for-windows-server

This command enables the prompt for proxy credentials during the Lumu Agent installation using the .exe offline installer. It includes silent installation flags and license acceptance.

```bash
lum_server_agent_offline.exe /SP- /VERYSILENT /activationcode="[ActivationCode]" /acceptlicense=true /askcredentials=true
```

--------------------------------

### Retrieve Adversaries (GET Request Example)

Source: https://docs.lumu.io/portal/en/kb/articles/core-concepts-api

Use this cURL command to get a paginated summary of adversaries related to Lumu Email Intelligence. Specify your company API key, page number, and items per page.

```bash
curl --location --request GET 'https://defender.lumu.io/api/spambox/adversaries?key=&page=1&items=50' \
--data-raw ''
```

--------------------------------

### Start Lumu Universal SIEM Container

Source: https://docs.lumu.io/portal/en/kb/articles/datadog-and-lumu-universal-siem

Start the Docker container for the Lumu Universal SIEM integration tool after it has been created.

```bash
docker start lumu-universal-siem
```

--------------------------------

### Install Lumu Agent Component Only (.msi)

Source: https://docs.lumu.io/portal/en/kb/articles/lumu-agent-for-windows-server

This command installs only the Lumu Agent component using the .msi offline installer. It requires the activation code and license acceptance. Note the specific quoting for WRAPPED_ARGUMENTS.

```bash
"C:\Windows\System32\msiexec.exe" /i lum_server_agent_offline.msi /quiet WRAPPED_ARGUMENTS="/activationcode=\""[ActivationCode]\"" /acceptlicense=\"true\"" /COMPONENTS=agent"
```

--------------------------------

### POST Request Example for Last Contacted Adversaries

Source: https://docs.lumu.io/portal/en/kb/articles/core-concepts-api

Example using curl to send a POST request to retrieve last contacted adversaries, specifying hours and labels.

```Shell
curl --location --request POST 'https://defender.lumu.io/api/adversarial-activity/contacted-adversaries/spambox/last?key=56a0fc30-a6de-85eb-8249-a117f0a9f8g3&page=1&items=50' \
--data-raw '{ "hours": 200, "labels": [] }'
```

--------------------------------

### Example Response (Success)

Source: https://docs.lumu.io/portal/en/kb/articles/core-concepts-api

This is an example of a successful response (200 OK) when querying the Spambox API for adversaries. It includes adversary details, timestamp, and pagination information.

```json
{
"adversaries": [
{
"indicator": "http://mining.com"
"info": [
{
"type": "Mining",
"description": "CryptoMining domain"
}
]
}
],
"timestamp": "2021-04-29T15:29:48.177Z",
"paginationInfo": {
"page": 1,
"items": 1,
"next": 2
}
}
```

--------------------------------

### Example Response (200 - Success)

Source: https://docs.lumu.io/portal/en/kb/articles/core-concepts-api

This is an example of a successful response (200 OK) when querying for contacted adversaries. It includes details about the items found, the timestamp of the request, and pagination information.

```json
{
"items": [
{
"host": "example.xyz",
"adversary-types": [
"Spam"
],
"descriptions": [
"Spam related"
],
"contacts": 1,
"last-contact": {
"time": "2020-06-06T11:05:11.964Z",
"endpoint": "Gateway company 1",
"label": 37
}
}
],
"timestamp": "2021-03-15T15:15:30.234Z",
"pagination": {
"page": 1,
"items": 50
}
}
```

--------------------------------

### DNS Query Body Example

Source: https://docs.lumu.io/portal/en/kb/articles/cc-api-specifications

An example of the JSON body structure for posting DNS queries. Include timestamp, name, client IP, client name, and type.

```json
[
  {
    "timestamp": "2021-01-06T14:37:02.228Z",
    "name": "www.example.com",
    "client_ip": "192.168.0.103",
    "client_name": "MACHINE-0987",
    "type": "A"
  }
]
```

--------------------------------

### Example Incident Details Response (200 OK)

Source: https://docs.lumu.io/portal/en/kb/articles/core-concepts-api

This is an example of a successful response when retrieving incident details. It includes various fields such as timestamps, adversary information, and contact details.

```json
{
"id": "4d90fc30-a6de-11eb-8239-a117f0a9f6f5",
"timestamp": "2021-04-26T22:25:27.923Z",
"isUnread": false,
"contacts": 114,
"adversaryId": "Malware family qakbot",
"adversaries": [
"malicious.net",
"suspicious.biz",
"example.com"
],
"adversaryTypes": [
"DGA"
],
"description": "Malware family qakbot",
"labelDistribution": {
"144": 114
},
"totalEndpoints": 1,
"lastContact": "2021-04-26T22:39:16.131Z",
"actions": [
{
"datetime": "2021-04-27T15:13:56.939Z",
"userId": 0,
"action": "close",
"comment": "Incident close from external API"
},
{
"datetime": "2021-04-26T22:42:32.532Z",
"userId": 1,
"action": "read",
"comment": ""
}
],
"status": "closed",
"statusTimestamp": "2021-04-27T15:13:56.939Z",
"firstContactDetails": {
"uuid": "09e02310-de1b-11ec-b481-eb776e1a9b92",
"datetime": "2022-05-28T00:13:45.281Z",
"host": "111example.com",
"types": [
"Phishing"
],
"details": [
"Malware family Pony"
],
"endpointIp": "255.111.22.000",
"endpointName": "USER.USER-PC",
"label": 346,
"sourceType": "virtual_appliance",
"sourceId": "55719C03-b31t-4d5e-8e1e-9f2b7d651c45",
"sourceData": {
"DNSPacketExtraInfo": {
"question": {
"type": "A",
"name": "111example.com",
"class": "IN"
},
"responseCode": "NOERROR",
"flags": {
"authoritative": false,
"recursion_available": true,
"truncated_response": false,
"checking_disabled": false,
"recursion_desired": true,
"authentic_data": false
},
"answers": [
{
"name": "111example.com",
"type": "A",
"class": "IN",
"ttl": 2549,
"data": "51.225.156.155"
}
],
"opCode": "QUERY"
}
},
"isPlayback": false
},
"lastContactDetails": {
"uuid": "a53c04a0-de1b-11ec-8d45-eb776e3f5271",
"datetime": "2022-05-28T00:18:05.930Z",
"host": "111example.com",
"types": [
"Phishing"
],
"details": [
"Malware family Pony"
],
"endpointIp": "119.129.000.11",
"endpointName": "USER.USER-PC",
"label": 346,
"sourceType": "virtual_appliance",
"sourceId": "55719C03-b31t-4d5e-8e1e-9f2b7d651c45",
"sourceData": {
"DNSPacketExtraInfo": {
"question": {
"type": "A",
"name": "111example.com",
"class": "IN"
},
"responseCode": "NOERROR",
"flags": {
"authoritative": false,
"recursion_available": true,
"truncated_response": false,
"checking_disabled": false,
"recursion_desired": true,
"authentic_data": false
},
"answers": [
{
"name": "111example.com",
"type": "A",
"class": "IN",
"ttl": 2549,
"data": "250.4.148.28"
}
],
"opCode": "QUERY"
}
},
"isPlayback": false
}
}
```

--------------------------------

### Retrieve Latest Adversaries (GET Request Example)

Source: https://docs.lumu.io/portal/en/kb/articles/core-concepts-api

Use this cURL command to retrieve the latest adversaries via a GET request. This method allows specifying the number of past hours directly in the URL parameters.

```bash
curl --location --request GET 'https://defender.lumu.io/api/spambox/adversaries/last?key=56a0fc30-a6de-85eb-8249-a117f0a9f8g3&page=1&items=50&hours=1' \
--data-raw ''
```

--------------------------------

### Reinstall Integration from Scratch

Source: https://docs.lumu.io/portal/en/kb/articles/cisco-custom-response

Run this command to reinstall the integration from scratch. Use 'reset-ioc-force' for a forceful IoC-related reinstallation and 'reset-component-force' for a forceful component-specific reinstallation.

```bash
make reset-ioc-force
```

```bash
make reset-component-force
```

--------------------------------

### Configure the Integration

Source: https://docs.lumu.io/portal/en/kb/articles/cloudflare-custom-response-integration

Run the configuration option of the management script. This will launch a wizard to guide you through setting up the integration parameters.

```bash
bash manage.sh config
```

--------------------------------

### Install Lumu Agent Component Only (.exe)

Source: https://docs.lumu.io/portal/en/kb/articles/lumu-agent-for-windows-server

This command installs only the Lumu Agent component using the .exe offline installer. It requires the activation code and license acceptance.

```bash
lum_server_agent_offline.exe /SP- /VERYSILENT /activationcode="[ActivationCode]" /acceptlicense="true" /COMPONENTS="agent"
```

--------------------------------

### Show Netskope Collector Script Options

Source: https://docs.lumu.io/portal/en/kb/articles/cc-api-netskope-swg

Execute this command from the deployment folder to display all available options and usage instructions for the netskope-collect.py script.

```bash
python netskope-collect.py --help
```

--------------------------------

### Silent Installation of Lumu Agent (.msi)

Source: https://docs.lumu.io/portal/en/kb/articles/lumu-agent-for-windows-server

Use this command for a silent, non-interactive installation of the Lumu Agent using the .msi offline installer. Ensure you replace '[ActivationCode]' with your actual activation code.

```bash
lum_server_agent_offline.msi /quiet WRAPPED_ARGUMENTS="/activationcode=\""[ActivationCode]\"" /acceptlicense=\"true\""
```

--------------------------------

### Example API URI with Pagination

Source: https://docs.lumu.io/portal/en/kb/articles/core-concepts-api

Demonstrates how to include pagination parameters in an API request URI. Ensure to replace {company-key} with your actual company key.

```http
https://defender.lumu.io/api/administration/labels?key={company-key}&items=20&page=3
```

--------------------------------

### Silent Installation of Lumu Agent (.exe)

Source: https://docs.lumu.io/portal/en/kb/articles/lumu-agent-for-windows-server

Use this command for a silent, non-interactive installation of the Lumu Agent using the .exe offline installer. Ensure you replace '[ActivationCode]' with your actual activation code.

```bash
lum_server_agent_offline.exe /SP- /VERYSILENT /activationcode="[ActivationCode]" /acceptlicense="true"
```

--------------------------------

### Deploy Integration as Docker Container

Source: https://docs.lumu.io/portal/en/kb/articles/cisco-custom-response

Run this command from the `<app_lumu_root>` directory to deploy the IoC Manager and Application components as Docker containers.

```bash
make run-build
```

--------------------------------

### Collect and Package Logs for Support

Source: https://docs.lumu.io/portal/en/kb/articles/cisco-custom-response

Run this command to collect and package the integration logs for Lumu support. This command creates a 'support.tar' file containing relevant information.

```bash
make support
```

--------------------------------

### Check BIND Configuration Syntax

Source: https://docs.lumu.io/portal/en/kb/articles/dns-linux-server

Verify the syntax of your BIND DNS configuration file for errors. A blank output indicates no syntax errors.

```bash
sudo named-checkconf
```

--------------------------------

### Retrieve latest adversaries related to Lumu Email Intelligence (GET)

Source: https://docs.lumu.io/portal/en/kb/articles/core-concepts-api

Get a detailed list of adversarial hosts related to Lumu Email Intelligence within a specified number of past hours using a GET request.

```APIDOC
## GET /spambox/adversaries/last

### Description
Retrieves a detailed list of adversarial hosts related to Lumu Email Intelligence, within a specified number of past hours.

### Method
GET

### Endpoint
https://defender.lumu.io/api/spambox/adversaries/last

### Parameters
#### Query Parameters
- **key** (string) - Required - Your company's unique API key, available in the Lumu Portal.
- **page** (integer) - Optional - Page number of the result set (default: 1).
- **items** (integer) - Optional - Limit the number of results per page (default: 50, max: 100).
- **hours** (integer) - Optional - The number of past hours you want to narrow your results to (default: 1).

### Request Example
```curl
curl --location --request GET 'https://defender.lumu.io/api/spambox/adversaries/last?key=56a0fc30-a6de-85eb-8249-a117f0a9f8g3&page=1&items=50&hours=1' \
--data-raw ''
```

### Response
#### Success Response (200)
- **adversaries** (array) - A list of adversary objects.
- **paginationInfo** (object) - Information about the pagination.
  - **page** (integer) - The current page number.
  - **items** (integer) - The number of items per page.
  - **next** (integer) - The next page number.

#### Response Example
```json
{
  "adversaries": [
    {
      "indicator": "http://mining.com",
      "info": [
        {
          "type": "Mining",
          "description": "CryptoMining domain"
        }
      ]
    }
  ],
  "paginationInfo": {
    "page": 1,
    "items": 1,
    "next": 2
  }
}
```
```

--------------------------------

### Check Installed Intel Microcode

Source: https://docs.lumu.io/portal/en/kb/articles/booting-issue-vmware

Use this command to list installed intel microcode packages on your system.

```bash
sudo dpkg -l|grep intel
```

--------------------------------

### Netflow Entry Body Example

Source: https://docs.lumu.io/portal/en/kb/articles/cc-api-specifications

An example of the JSON structure for a single Netflow entry. Ensure all required fields are populated.

```json
[
{
"timestamp": "2025-02-11T19:42:18.000Z",
"time_taken": 0,
"ip_version": 4,
"final": false,
"protocol": "tcp",
"control_bits": 2,
"end_reason": 1,
"source": {
"port": 59237,
"ip": "192.168.0.6"
},
"sent": {
"bytes": 40,
"packets": 1
},
"destination": {
"port": 80,
"ip": "126.21.132.40"
},
"received": {
"bytes": 0,
"packets": 0
}
}
]
```

--------------------------------

### GET Request to Retrieve Affected Endpoints

Source: https://docs.lumu.io/portal/en/kb/articles/core-concepts-api

Use this GET request to retrieve a paginated summary of incidents across endpoints. Query parameters include the API key, page number, and items per page. The request body is typically empty for GET requests of this nature.

```bash
curl --location --request GET 'https://defender.lumu.io/api/adversarial-activity/affected-endpoints?key=56a0fc30-a6de-85eb-8249-a117f0a9f8g3&page=1&items=50' \
--data-raw ''
```

--------------------------------

### Check Integration Logs

Source: https://docs.lumu.io/portal/en/kb/articles/cisco-custom-response

Run this command to check your integration logs. Use 'logs-ioc' for IoC-related logs and 'logs-component' for component-specific logs.

```bash
make logs-ioc
```

```bash
make logs-component
```
Tokens:
Raw