Alibaba Action Trail Event Collector

Details

ID	`Alibaba Action Trail Event Collector`
Provider	Alibaba Group
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/auth-utils:1.0.0.10133006`
Supported Modules	Agentix XSIAM

README

Alibaba log event collector integration for XSIAM.
This integration was integrated and tested with API version 0.6 of Alicloud Log Service.

Configure Alibaba Action Trail Event Collector in Cortex

Parameter	Description	Required
Endpoint	The URL used to access your project and the data of your project.	True
Access key id	The ID used to identify the user.	True
Access key	The key provided to you by Alibaba Cloud for authentication.	True
Project name	The name of your project in your Log Service used to isolate the resources of different users and control access to specific resources.	True
Logstore name	The unit in your Log Service that is used to collect, store, and query logs.	True
Query	The filter conditions in search statements used to obtain specific logs. Each query statement consists of a search statement and an analytic statement. The search statement and the analytic statement are separated with a vertical bar (\|).A search statement can be a keyword, a numeric value, a numeric value range, a space, or an asterisk . If you specify a space or an asterisk as the search statement, no conditions are used for searching, and all logs are returned. For example: (\|) select from actiontrail_pa_trail, will retrieve all the events from the project as set above.	True
Number of incidents to fetch per fetch.	The maximum number of incidents to fetch each time.	False
First fetch time interval	The period to retrieve events for. format: [number] [time unit], for example 12 hours, 1 day, 3 months. Default is 3 days.	False
Use system proxy settings	Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration.	False
Use Secured Connection	Use SSL secure connection or ‘None’.	False

Commands

You can execute these commands Alert War Room in the CLI in XSIAM.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

alibaba-get-events

Manual command to fetch events and display them.

Base Command

alibaba-get-events

Input

Argument Name	Description	Required
from	The date after which to search for logs in seconds Example: 1652617222.	Optional
limit	Number of events to fetch. Default is 1.	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False.	Required

Context Output

There is no context output for this command.

Configuration parameters

endpoint — Endpoint (required)
access_key — Access key ID (required)
project_name — Project name (required)
logstore_name — Logstore name (required)
query — Query (required)
limit — Number of incidents to fetch per fetch.
from — First fetch time interval
proxy — Use system proxy settings
verify — Trust any certificate (not secure)

Commands (1)

alibaba-get-events
Manual command to fetch events and display them.

Source

AlibabaActionTrailEventCollector.py AlibabaActionTrailEventCollector.yml AlibabaActionTrailEventCollector_description.md

Download History Raw

commonfields:
  id: Alibaba Action Trail Event Collector
  version: -1
sectionorder:
- Connect
- Collect
name: Alibaba Action Trail Event Collector
display: Alibaba Action Trail Event Collector
category: Analytics & SIEM
provider: Alibaba Group
description: Alibaba logs event collector integration for XSIAM.
configuration:
- display: Endpoint
  name: endpoint
  type: 0
  required: true
  section: Connect
- display: "Access key ID"
  displaypassword: Access key
  name: access_key
  type: 9
  required: true
  section: Connect
- display: Project name
  name: project_name
  type: 0
  required: true
  section: Connect
- display: Logstore name
  name: logstore_name
  type: 0
  required: true
  section: Connect
- display: Query
  name: query
  type: 0
  required: true
  defaultvalue: "*| select * from actiontrail_pa_trail"
  section: Collect
- display: Number of incidents to fetch per fetch.
  name: limit
  type: 0
  defaultvalue: 1000
  section: Collect
  required: false
- display: First fetch time interval
  name: from
  type: 0
  defaultvalue: 3 days
  section: Collect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: verify
  type: 8
  section: Connect
  advanced: true
  required: false
script:
  script: ""
  type: python
  commands:
  - description: Manual command to fetch events and display them.
    name: alibaba-get-events
    arguments:
    - name: from
      description: The date after which to search for logs in ISO format. For example, 2020-12-24T00:00:00.
    - name: limit
      required: true
      description: Number of events to fetch.
      defaultValue: "1"
    - auto: PREDEFINED
      defaultValue: "False"
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - "True"
      - "False"
      required: true
  dockerimage: demisto/auth-utils:1.0.0.10133006
  isfetchevents: true
  subtype: python3
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
tests:
- No tests
supportedModules:
- xsiam