AppSentinels.ai

Details

ID	`AppSentinels.ai`
Provider	AppSentinels Ai
Category	Analytics & SIEM
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

Appsentinels.ai offers a platform for collecting, analyzing, and managing security events to provide comprehensive application protection.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure AppSentinels.ai in Cortex

Parameter	Description	Required
Your server URL		True
User Key	The Client User key for connection with AppSentinels.ai.	True
API Key	The Client API key for connection with AppSentinels.ai.	True
Organization name	The organization name.	True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch events		False
Maximum number of audit logs per fetch	Maximum number of Audit Log entries to retrieve per fetch cycle. default value is 5000.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

appsentinels-get-events

Retrieves a list of events from the AppSentinels.ai instance.

Base Command

appsentinels-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to true to create events, otherwise it only displays them. Possible values are: true, false. Default is false.	Required
limit	Returns no more than the specified number of events.	Optional
first_fetch	The UTC date or relative timestamp from when to start fetching events. Supported formats: N minutes, N hours, N days, N weeks, N months, N years, yyyy-mm-dd, yyyy-mm-ddTHH:MM.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
credentials — User Key (required)
organization — Organization name (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetchEvents — Fetch events
max_audit_per_fetch — Maximum number of audit logs per fetch

Commands (1)

appsentinels-get-events
Retrieves a list of events from the AppSentinels.ai instance.

Source

AppSentinelsAi.py AppSentinelsAi_test.py AppSentinelsAi.yml AppSentinelsAi_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: AppSentinels Ai
sectionorder:
- Connect
- Collect
commonfields:
  id: AppSentinels.ai
  version: -1
configuration:
- defaultvalue: https://in-cloud.appsentinels.ai/
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- additionalinfo: The Client User key and API key for connection with AppSentinels.ai.
  displaypassword: API Key
  display: User Key
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Organization name
  additionalinfo: The organization name.
  name: organization
  required: true
  type: 0
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Fetch events
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
  defaultvalue: "true"
- additionalinfo: 'Maximum number of Audit Log entries to retrieve per fetch cycle. default value is 5000.'
  defaultvalue: "5000"
  display: Maximum number of audit logs per fetch
  name: max_audit_per_fetch
  required: false
  type: 0
  section: Collect
  advanced: true
description: 'Appsentinels.ai offers a platform for collecting, analyzing, and managing security events to provide comprehensive application protection.'
display: AppSentinels.ai
name: AppSentinels.ai
supportlevelheader: xsoar
script:
  commands:
  - name: appsentinels-get-events
    description: Retrieves a list of events from the AppSentinels.ai instance.
    arguments:
      - auto: PREDEFINED
        defaultValue: 'false'
        description: Set this argument to true to create events, otherwise it only displays them.
        name: should_push_events
        predefined:
          - 'true'
          - 'false'
        required: true
      - description: Returns no more than the specified number of events.
        name: limit
        required: false
      - description: "The UTC date or relative timestamp from where to start fetching events.
                      Supported formats: N minutes, N hours, N days, N weeks, N months, N years, yyyy-mm-dd, yyyy-mm-ddTHH:MM."
        name: first_fetch
        required: false
  isfetch: false
  runonce: false
  script: '-'
  type: python
  subtype: python3
  isfetchevents: true
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
marketplaces:
- marketplacev2
- platform
tests:
- No tests (auto formatted)