AnomaliSecurityAnalyticsAlerts

Details

ID	`AnomaliSecurityAnalyticsAlerts`
Provider	Anomali
Category	Analytics & SIEM
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

The Anomali Security Analytics pack allows users to manage security alerts by interacting directly with the Anomali Security Analytics platform. It supports creating search jobs, monitoring their status, retrieving results, and updating alert statuses or comments, streamlining integration with Palo Alto XSOAR.
This integration was integrated and tested with version 1.0 of AnomaliSecurityAnalyticsAlerts.

Configure Anomali Security Analytics Alerts in Cortex

Parameter	Description	Required
Server URL		True
Username		True
API Key		True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch incidents		False
Incident type		False
Fetch query	Search query for fetching alerts. The default fetch query is “alert”.	False
Maximum incidents to fetch.	Maximum number of incidents per fetch. The default value is 200.	False
First fetch time	First alert created date to fetch. e.g., “1 min ago”,”2 weeks ago”,”3 months ago”	False
Incidents Fetch Interval		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

anomali-security-analytics-search-job-create

Create a new search job.

Base Command

anomali-security-analytics-search-job-create

Input

Argument Name	Description	Required
query	Search expression or keyword you’re looking for in logs, e.g. alerts.	Required
source	Filters results by the log source or origin system, e.g. third_party_xsoar_integration. Default value is third_party. Default is third_party.	Optional
from	Timerange - start time, e.g., 1 hour, 30 minutes. Default value is 1 day. Default is 1 day.	Optional
to	Timerange - end time, e.g., 1 hour, 30 minutes. Default value is present. Default is 0 minutes.	Optional
timezone	The desired timezone for the log source. Pass the official IANA name for the time zone you are interested in, e.g. Europe/London, America/New_York. Default value is UTC. Default is UTC.	Optional

Context Output

Path	Type	Description
AnomaliSecurityAnalytics.SearchJob.job_id	String	Job ID of the search job.

Human Readable Output

Search Job Created

job_id	status
7af7bc62c807446fa4bf7ad12dfbe64b	in progress

anomali-security-analytics-search-job-status

Get the status of one or more search jobs.

Base Command

anomali-security-analytics-search-job-status

Input

Argument Name	Description	Required
job_id	Unique identifier assigned to a background process or job.	Required

Context Output

Path	Type	Description
AnomaliSecurityAnalytics.SearchJobStatus.job_id	String	Job ID of the search job.
AnomaliSecurityAnalytics.SearchJobStatus.status	String	Current status of the search job. e.g. RUNNING, DONE.
AnomaliSecurityAnalytics.SearchJobStatus.progress	Number	Indicates the search progress. Numeric float value between 0 and 1.
AnomaliSecurityAnalytics.SearchJobStatus.scanned	Number	Number of records scanned by the search query.
AnomaliSecurityAnalytics.SearchJobStatus.total	Number	Total number of records matched by the search query.
AnomaliSecurityAnalytics.SearchJobStatus.start_time	Number	Start timestamp of the time interval of the search query, in UNIX timestamp milliseconds.
AnomaliSecurityAnalytics.SearchJobStatus.end_time	Number	End timestamp of the time interval of the search query, in UNIX timestamp milliseconds.
AnomaliSecurityAnalytics.SearchJobStatus.bucket_length	Number	Width of each histogram bin depending on the search duration.
AnomaliSecurityAnalytics.SearchJobStatus.num_of_bucket	Number	Number of buckets in which you receive all the search results.
AnomaliSecurityAnalytics.SearchJobStatus.is_aggregated	Boolean	Whether the search results are aggregated.
AnomaliSecurityAnalytics.SearchJobStatus.histogram_buckets	Array	Number of histogram buckets used to bucket the search result.

Human Readable Output

Search Job Status

job_id	status	progress	scanned	total	start_time	end_time
7af7bc62c807446fa4bf7ad12dfbe64b	in progress	0.5	100	100	1741867250299	1741867250299

anomali-security-analytics-search-job-results

Get search job results.

Base Command

anomali-security-analytics-search-job-results

Input

Argument Name	Description	Required
job_id	Unique identifier assigned to a background process or job.	Required
offset	Offset of records returned from the search result job. For example, if offset=10 and fetch_size=30, then this API will return results indexed 10 to 40. Default value is 0.	Optional
fetch_size	Number of records returned from the search result job. Maximum rows is 1000. Default value is 25. Default is 25.	Optional

Context Output

Path	Type	Description
AnomaliSecurityAnalytics.SearchJobResults.job_id	String	Job ID of the search job.
AnomaliSecurityAnalytics.SearchJobResults.status	String	Status of the search.
AnomaliSecurityAnalytics.SearchJobResults.count	Number	Number of records returned.
AnomaliSecurityAnalytics.SearchJobResults.has_next	Boolean	Indicates if more pages are available.
AnomaliSecurityAnalytics.SearchJobResults.is_aggregated	Boolean	Indicates if the search is aggregated.
AnomaliSecurityAnalytics.SearchJobResults.records	Array	List of records containing the fields included in the fields response attribute.
AnomaliSecurityAnalytics.SearchJobResults.result_row_count	Number	Total number of records retrieved by the search.
AnomaliSecurityAnalytics.SearchJobResults.search_end_time	Number	End timestamp of the search (UNIX timestamp in milliseconds).
AnomaliSecurityAnalytics.SearchJobResults.search_start_time	Number	Start timestamp of the search (UNIX timestamp in milliseconds).
AnomaliSecurityAnalytics.SearchJobResults.status	String	Status of the search job.
AnomaliSecurityAnalytics.SearchJobResults.types	Array	Data types of the search record attributes.

Human Readable Output

Search Job Results

id	name	owner	status	severity	alert_time	search_job_id
905	AlertTriageDemo	test@anomali.com	new	high	1741867250299	7af7bc62c807446fa4bf7ad12dfbe64b

anomali-security-analytics-alert-update

Update various fields of an alert including status, comment, assignee, severity, and owner.

Base Command

anomali-security-analytics-alert-update

Input

Argument Name	Description	Required
uuid	Universally unique identifier assigned to uniquely identify objects such as Jobs, Alerts, Observables, Threat model entities. You can find it in search job results command.	Required
comment	Field for adding analyst notes or remarks to Match events, IOC submissions and Alert triage decisions. Please provide at least one field.	Optional
status	Current state of the observable in ThreatStream, e.g., active, inactive, falsepos. Please provide at least one field.	Optional
assignee	Assignee of the alert. Please provide at least one field.	Optional
owner	Owner of the alert. Please provide at least one field.	Optional
severity	Severity of the alert. Please provide at least one field.	Optional

Context Output

Path	Type	Description
AnomaliSecurityAnalytics.UpdateAlert.message	String	Confirmation message returned after updating the alert status.		AnomaliSecurityAnalytics.UpdateAlert.uuid	String	The UUID of the updated alert.
AnomaliSecurityAnalytics.UpdateAlert.updated_fields	Dictionary	The fields that were updated in the alert.

Human Readable Output

Update Alert

message	uuid	updated_fields
Updated alert successfully	19e19eabd55e4b05a505fb64a803501d	{“comment”: “test_update”, “status”: “test_update”}

Configuration parameters

url — Server URL (required)
credentials — Username (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
incidentType — Incident type
fetch_query — Fetch query
max_fetch — Maximum incidents to fetch.
first_fetch — First fetch time
incidentFetchInterval — Incidents Fetch Interval

Commands (4)

anomali-security-analytics-alert-update
Update various fields of an alert including status, comment, assignee, severity, and owner.
anomali-security-analytics-search-job-create
Create a new search job.
anomali-security-analytics-search-job-results
Get search job results.
anomali-security-analytics-search-job-status
Get the status of one or more search jobs.

Source

AnomaliSecurityAnalyticsAlerts.py AnomaliSecurityAnalyticsAlerts_test.py AnomaliSecurityAnalyticsAlerts.yml AnomaliSecurityAnalyticsAlerts_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: Anomali
sectionorder:
- Connect
- Collect
commonfields:
  id: AnomaliSecurityAnalyticsAlerts
  version: -1
configuration:
- defaultvalue: https://optic.threatstream.com
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  displaypassword: API Key
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Fetch incidents
  name: isFetch
  section: Collect
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
- display: Fetch query
  additionalinfo: Search query for fetching alerts. The default fetch query is "alert".
  defaultvalue: 'alert'
  name: fetch_query
  section: Collect
  type: 0
  required: false
- additionalinfo: Maximum number of incidents per fetch. The default value is 200.
  defaultvalue: '200'
  display: Maximum incidents to fetch.
  name: max_fetch
  section: Collect
  type: 0
  required: false
- defaultvalue: 3 days
  display: First fetch time
  additionalinfo: First alert created date to fetch. e.g., "1 min ago","2 weeks ago","3 months ago"
  section: Collect
  name: first_fetch
  type: 0
  required: false
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  required: false
  type: 19
  section: Collect
description: The Anomali Security Analytics pack allows users to manage security alerts by interacting directly with the Anomali Security Analytics platform. It supports creating search jobs, monitoring their status, retrieving results, and updating alert statuses or comments, streamlining integration with Palo Alto XSOAR.
display: Anomali Security Analytics Alerts
name: AnomaliSecurityAnalyticsAlerts
script:
  commands:
  - name: anomali-security-analytics-search-job-create
    description: Create a new search job.
    arguments:
    - name: query
      description: Search expression or keyword you're looking for in logs, e.g. alerts.
      required: true
    - name: source
      defaultValue: third_party
      description: Filters results by the log source or origin system, e.g. third_party_xsoar_integration. Default value is third_party.
      required: false
    - name: from
      defaultValue: 1 day
      description: Timerange - start time, e.g., 1 hour, 30 minutes. Default value is 1 day.
      required: false
    - name: to
      defaultValue: 0 minutes
      description: Timerange - end time, e.g., 1 hour, 30 minutes. Default value is present.
      required: false
    - name: timezone
      defaultValue: "UTC"
      description: The desired timezone for the log source. Pass the official IANA name for the time zone you are interested in, e.g. Europe/London, America/New_York. Default value is UTC.
      required: false
    execution: false
    outputs:
      - contextPath: AnomaliSecurityAnalytics.SearchJob.job_id
        description: Job ID of the search job.
        type: String
  - name: anomali-security-analytics-search-job-status
    description: Get the status of one or more search jobs.
    arguments:
    - name: job_id
      description: Comma-separated list of job IDs to get their statuses.
      required: true
      isArray: true
    execution: false
    outputs:
    - contextPath: AnomaliSecurityAnalytics.SearchJobStatus.job_id
      description: Job ID of the search job.
      type: String
    - contextPath: AnomaliSecurityAnalytics.SearchJobStatus.status
      description: Current status of the search job. e.g. RUNNING, DONE.
      type: String
    - contextPath: AnomaliSecurityAnalytics.SearchJobStatus.progress
      description: Indicates the search progress. Numeric float value between 0 and 1.
      type: Number
    - contextPath: AnomaliSecurityAnalytics.SearchJobStatus.scanned
      description: Number of records scanned by the search query.
      type: Number
    - contextPath: AnomaliSecurityAnalytics.SearchJobStatus.total
      description: Total number of records matched by the search query.
      type: Number
    - contextPath: AnomaliSecurityAnalytics.SearchJobStatus.start_time
      description: Start timestamp of the time interval of the search query, in UNIX timestamp milliseconds.
      type: Number
    - contextPath: AnomaliSecurityAnalytics.SearchJobStatus.end_time
      description: End timestamp of the time interval of the search query, in UNIX timestamp milliseconds.
      type: Number
    - contextPath: AnomaliSecurityAnalytics.SearchJobStatus.bucket_length
      description: Width of each histogram bin depending on the search duration.
      type: Number
    - contextPath: AnomaliSecurityAnalytics.SearchJobStatus.num_of_bucket
      description: Number of buckets in which you receive all the search results.
      type: Number
    - contextPath: AnomaliSecurityAnalytics.SearchJobStatus.is_aggregated
      description: Whether the search results are aggregated.
      type: Boolean
    - contextPath: AnomaliSecurityAnalytics.SearchJobStatus.histogram_buckets
      description: Number of histogram buckets used to bucket the search result.
      type: Array
  - name: anomali-security-analytics-search-job-results
    description: Get search job results.
    arguments:
    - name: job_id
      description: Unique identifier assigned to a background process or job.
      required: true
      isArray: true
    - name: offset
      defaultValue: 0
      description:  Offset of records returned from the search result job. For example, if offset=10 and fetch_size=30, then this API will return results indexed 10 to 40. Default value is 0.
      required: false
    - name: fetch_size
      defaultValue: 25
      description: Number of records returned from the search result job. Maximum rows is 1000. Default value is 25.
      required: false
    execution: false
    outputs:
      - contextPath: AnomaliSecurityAnalytics.SearchJobResults.job_id
        description: Job ID of the search job.
        type: String
      - contextPath: AnomaliSecurityAnalytics.SearchJobResults.status
        description: Status of the search.
        type: String
      - contextPath: AnomaliSecurityAnalytics.SearchJobResults.count
        description: Number of records returned.
        type: Number
      - contextPath: AnomaliSecurityAnalytics.SearchJobResults.has_next
        description: Indicates if more pages are available.
        type: Boolean
      - contextPath: AnomaliSecurityAnalytics.SearchJobResults.is_aggregated
        description: Indicates if the search is aggregated.
        type: Boolean
      - contextPath: AnomaliSecurityAnalytics.SearchJobResults.records
        description: List of records containing the fields included in the fields response attribute.
        type: Array
      - contextPath: AnomaliSecurityAnalytics.SearchJobResults.result_row_count
        description: Total number of records retrieved by the search.
        type: Number
      - contextPath: AnomaliSecurityAnalytics.SearchJobResults.search_end_time
        description: End timestamp of the search (UNIX timestamp in milliseconds).
        type: Number
      - contextPath: AnomaliSecurityAnalytics.SearchJobResults.search_start_time
        description: Start timestamp of the search (UNIX timestamp in milliseconds).
        type: Number
      - contextPath: AnomaliSecurityAnalytics.SearchJobResults.status
        description: Status of the search job.
        type: String
      - contextPath: AnomaliSecurityAnalytics.SearchJobResults.types
        description: Data types of the search record attributes.
        type: Array
  - name: anomali-security-analytics-alert-update
    description: Update various fields of an alert including status, comment, assignee, severity, and owner.
    arguments:
    - name: uuid
      description: Universally unique identifier assigned to uniquely identify objects such as Jobs, Alerts, Observables, Threat model entities. You can find it in search job results command.
      required: true
    - name: comment
      description: Field for adding analyst notes or remarks to Match events, IOC submissions and Alert triage decisions. Please provide at least one field.
      required: false
    - name: status
      description: Current state of the observable in ThreatStream, e.g., active, inactive, falsepos. Please provide at least one field.
      required: false
    - name: assignee
      description: Assignee of the alert. Please provide at least one field.
      required: false
    - name: owner
      description: Owner of the alert. Please provide at least one field.
      required: false
    - name: severity
      description: Severity of the alert. Please provide at least one field.
      required: false
    execution: false
    outputs:
      - contextPath: AnomaliSecurityAnalytics.UpdateAlert.message
        description: Confirmation message returned after updating the alert status.
        type: String
      - contextPath: AnomaliSecurityAnalytics.UpdateAlert.uuid
        description: The UUID of the updated alert.
        type: String
      - contextPath: AnomaliSecurityAnalytics.UpdateAlert.updated_fields
        description: The fields that were updated in the alert.
        type: Dictionary
  isfetch: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
marketplaces:
- xsoar
- marketplacev2
- platform
tests:
- No tests