Abnormal Security Event Collector

Details

ID	`Abnormal Security Event Collector`
Provider	Abnormal Security
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10404775`
Supported Modules	Agentix XSIAM

README

Abnormal Security Event Collector integration for XSIAM.
This integration was integrated and tested with version 01 of Abnormal Security Event Collector

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Abnormal Security Event Collector in Cortex

Parameter	Required
Token	True
First fetch time interval	False
Use system proxy settings	False
Trust any certificate (not secure)	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

abnormal-security-event-collector-get-events

Manual command to fetch events and display them.

Base Command

abnormal-security-event-collector-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False.	Required

Context Output

There is no context output for this command.

Note

This integration only fetches threats.

Configuration parameters

token — (required)
proxy — Use system proxy settings
verify — Trust any certificate (not secure)
after — First fetch time interval

Commands (1)

abnormal-security-event-collector-get-events
Manual command to fetch events.

Source

AbnormalSecurityEventCollector.py AbnormalSecurityEventCollector_test.py AbnormalSecurityEventCollector.yml AbnormalSecurityEventCollector_description.md

Download History Raw

commonfields:
  id: Abnormal Security Event Collector
  version: -1
name: Abnormal Security Event Collector
display: Abnormal Security Event Collector
category: Analytics & SIEM
provider: Abnormal Security
sectionorder:
- Connect
- Collect
description: Abnormal Security Event Collector integration for XSIAM.
configuration:
- display: ""
  displaypassword: Token
  name: token
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: verify
  type: 8
  required: false
  section: Connect
- display: First fetch time interval
  name: after
  type: 0
  defaultvalue: 1 day
  required: false
  section: Collect
  hidden:
  - xsoar
script:
  script: ""
  type: python
  commands:
  - description: Manual command to fetch events.
    name: abnormal-security-event-collector-get-events
    arguments:
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'True'
      - 'False'
      required: true
  dockerimage: demisto/python3:3.12.13.10404775
  isfetchevents: true
  subtype: python3
fromversion: 6.8.0
supportlevelheader: xsoar
marketplaces:
- marketplacev2
- platform
tests:
- No tests
supportedModules:
- xsiam