Aella Star Light

Aella Star Light Integration.

Data Enrichment & Threat Intelligence · Aella Star Light

Details

ID	`Aella Star Light`
Provider	AellaData
Category	Data Enrichment & Threat Intelligence
From Version	6.5.0
Docker Image	`demisto/python3:3.12.12.7090913`
Supported Modules	Agentix XSIAM

README

Overview

Use the Aella Starlight integration to get detailed information for security events detected by Aella Breach Detection software.

This integration was integrated and tested with Aella Startlight v2.2.1.

Use cases

Monitor security events and get event details
Periodically fetch new security events detected by Aella Starlight. Each security event will have a unique event_id, which you can pass to the |aella-get-event command to get the detailed information for. You can perform a follow-up action, such as sending a notification to security staff.

Fetched Incidents Data

name: Incident name
label: "Starlight event"
aella_eid: Aella event ID
aella_event: Aella event name
event_severity: Severity of the event

Configure Aella Starlight on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Aella Star Light.
Click Add instance to create and configure a new integration instance.
You should configure the following settings:

Name: a textual name for the integration instance.
Server URL (e.g. https://starlight.companyname.com:8889)
User name
Fetch incidents
Incident type
Fetching interval in minutes (default is 15, minimum is 15 )
The specific security event to look for. Default is all events
Security event severity threshold, between 0-100
Trust any certificate (not secure)
Use system proxy settings

Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get event details: aella-get-event

1. Get event details

Get details for a specific Startlight event.

Base Command

aella-get-event

Input

Argument Name	Description	Required
event_id	Event ID from the Starlight incident	Required

Context Output

Path	Type	Description
Aella.Event.event_name	string	Event name
Aella.Event.severity	string	Severity score
Aella.Event.dstip	string	Destination IP
Aella.Event.srcip	string	Source IP
Aella.Event.tenantid	string	Tenant ID
Aella.Event.srcip_reputation	string	Source IP reputation
Aella.Event.dstip_reputation	string	Destination IP reputation
Aella.Event.dstip_geo	unknown	Destination IP geolocation
Aella.Event.srcip_geo	unknown	Source IP geolocation

Configuration parameters

url — Server URL (e.g. https://starlight.companyname.com:8889) (required)
credentials — User name (required)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
fetch_interval — Fetching interval in minutes (default is 15, minimum is 15 )
event_name — The specific security event to look for. Default is all events
severity — Security event severity threshold, between 0-100
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

aella-get-event
Query the details for a specific Start Light event

Source

AellaStarLight.py AellaStarLight.yml

Download History Raw

commonfields:
  id: Aella Star Light
  version: -1
sectionorder:
- Connect
- Collect
name: Aella Star Light
display: Aella Star Light
category: Data Enrichment & Threat Intelligence
provider: AellaData
description: Aella Star Light Integration.
configuration:
- display: Server URL (e.g. https://starlight.companyname.com:8889)
  name: url
  defaultvalue: ''
  type: 0
  required: true
  section: Connect
- display: User name
  name: credentials
  defaultvalue: ''
  type: 9
  required: true
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Fetching interval in minutes (default is 15, minimum is 15 )
  name: fetch_interval
  section: Collect
  defaultvalue: '15'
  type: 0
  required: false
- display: The specific security event to look for. Default is all events
  name: event_name
  defaultvalue: ''
  type: 0
  required: false
  section: Collect
- display: Security event severity threshold, between 0-100
  name: severity
  defaultvalue: '50'
  type: 0
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  section: Connect
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  section: Connect
  defaultvalue: 'false'
  type: 8
  required: false
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: aella-get-event
    arguments:
    - name: event_id
      required: true
      description: event id from the Star Light incident.
    outputs:
    - contextPath: Aella.Event.event_name
      description: The event name.
      type: string
    - contextPath: Aella.Event.severity
      description: The severity score.
      type: string
    - contextPath: Aella.Event.dstip
      description: The Destination IP.
      type: string
    - contextPath: Aella.Event.srcip
      description: The source IP.
      type: string
    - contextPath: Aella.Event.tenantid
      description: The tenant ID.
      type: string
    - contextPath: Aella.Event.srcip_reputation
      description: The source IP reputation.
      type: string
    - contextPath: Aella.Event.dstip_reputation
      description: The destination IP reputation.
      type: string
    - contextPath: Aella.Event.dstip_geo
      description: The destination IP geo location.
    - contextPath: Aella.Event.srcip_geo
      description: The source  IP geo location.
    description: Query the details for a specific Start Light event
  isfetch: true
  runonce: false
  dockerimage: demisto/python3:3.12.12.7090913
tests:
- No test
fromversion: 6.5.0