AlgoSec

Details

ID	`AlgoSec`
Provider	AlgoSec
Category	Network Security
From Version	5.0.0
Supported Modules	Agentix XSIAM

README

Algosec AppViz, Firewall Analyzer (AFA) and FireFlow(AFF).

Configure AlgoSec on XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for AlgoSec.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Server URL (e.g. https://192.168.0.1)
- Credentials
- Trust any certificate (not secure)
- Use system proxy settings
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

algosec-get-ticket
algosec-create-ticket
algosec-get-applications
algosec-get-network-object
algosec-query

1. algosec-get-ticket

Retrieves a FireFlow change request by its ID

Base Command

algosec-get-ticket

Input

Argument Name	Description	Required
ticketId	ID of requested change request	Required

Context Output

There is no context output for this command.

2. algosec-create-ticket

Creates a new FireFlow change request

Base Command

algosec-create-ticket

Input

Argument Name	Description	Required
description	A free text description of the issue	Optional
devices	A list of device names, on which the change should be made	Optional
action	The device action to perform for the traffic. This can be either of the following: \U0010FC00 1 - Allow the traffic \U0010FC00 0 - Block the traffic	Required
destAddress	The destination address to perform the action on	Required
sourceAddress	The source address to perform the action on	Required
requestor	The email address of the requestor	Required
subject	The change request’s title	Required
service	The device service or port for the connection, for example, “http” or Mandatory “tcp/123”	Required
user	The user for the connection	Required
application	The application for the connection	Required

Context Output

There is no context output for this command.

3. algosec-get-applications

Find applications containing network objects related to IP address using AppViz

Base Command

algosec-get-applications

Input

Argument Name	Description	Required
address	The IP/Subnet to search	Required
type	The search method for the address	Optional

Context Output

There is no context output for this command.

4. algosec-get-network-object

Find network objects related to IP address

Base Command

algosec-get-network-object

Input

Argument Name	Description	Required
address	The IP/Subnet to search	Required
type	The search method for the address (default is INTERSECT)	Optional

Context Output

There is no context output for this command.

5. algosec-query

Performs a batch traffic simulation query using Firewall Analyzer

Base Command

algosec-query

Input

Argument Name	Description	Required
source	source(s) for the query. Multiple values are separated by commas (,)	Required
destination	destination(s) for the query. Multiple values are separated by commas (,)	Required
service	service(s) for the query. Multiple values are separated by commas (,)	Required
user	user for the query	Optional
application	application for the query	Optional

Context Output

There is no context output for this command.

Configuration parameters

server — Server URL (e.g. https://192.168.0.1) (required)
credentials — Credentials (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (5)

algosec-create-ticket
Creates a new FireFlow change request
algosec-get-applications
Find applications containing network objects related to IP address using AppViz
algosec-get-network-object
Find network objects related to IP address
algosec-get-ticket
Retrieves a FireFlow change request by its ID
algosec-query
Performs a batch traffic simulation query using Firewall Analyzer

Source

AlgoSec.js AlgoSec.yml

Download History Raw

commonfields:
  id: AlgoSec
  version: -1
name: AlgoSec
display: AlgoSec
system: true
category: Network Security
provider: AlgoSec
description: Algosec AppViz, Firewall Analyzer (AFA) and FireFlow(AFF).
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: server
  defaultvalue: ""
  type: 0
  required: true
- display: Credentials
  name: credentials
  defaultvalue: ""
  type: 9
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: algosec-get-ticket
    arguments:
    - name: ticketId
      required: true
      default: true
      description: ID of requested change request.
    description: Retrieves a FireFlow change request by its ID
  - name: algosec-create-ticket
    arguments:
    - name: description
      description: A free text description of the issue.
    - name: devices
      description: A list of device names, on which the change should be made.
    - name: action
      required: true
      description: |
        The device action to perform for the traffic. This can be either
        of the following: \U0010FC00 1 - Allow the traffic \U0010FC00 0 - Block the
        traffic.
      predefined:
      - "0"
      - "1"
    - name: destAddress
      required: true
      description: The destination address to perform the action on.
    - name: sourceAddress
      required: true
      description: The source address to perform the action on.
    - name: requestor
      required: true
      description: The email address of the requestor.
    - name: subject
      required: true
      description: The change request's title.
    - name: service
      required: true
      description: The device service or port for the connection, for example, "http" or Mandatory "tcp/123".
    - name: user
      required: true
      description: The user for the connection.
    - name: application
      required: true
      description: The application for the connection.
    description: Creates a new FireFlow change request
  - name: algosec-get-applications
    arguments:
    - name: address
      required: true
      default: true
      description: The IP/Subnet to search.
    - name: type
      auto: PREDEFINED
      predefined:
      - INTERSECT
      - CONTAINED
      - CONTAINING
      - EXACT
      description: The search method for the address.
    description: Find applications containing network objects related to IP address using AppViz
  - name: algosec-get-network-object
    arguments:
    - name: address
      required: true
      default: true
      description: The IP/Subnet to search.
    - name: type
      auto: PREDEFINED
      predefined:
      - INTERSECT
      - CONTAINED
      - CONTAINING
      - EXACT
      description: The search method for the address (default is INTERSECT).
    description: Find network objects related to IP address
  - name: algosec-query
    arguments:
    - name: source
      required: true
      default: true
      description: source(s) for the query. Multiple values are separated by commas (,).
    - name: destination
      required: true
      description: destination(s) for the query. Multiple values are separated by commas (,).
    - name: service
      required: true
      description: service(s) for the query. Multiple values are separated by commas (,).
    - name: user
      description: user for the query.
    - name: application
      description: application for the query.
    description: Performs a batch traffic simulation query using Firewall Analyzer
tests:
- No tests
fromversion: 5.0.0