Armorblox

Details

ID	`Armorblox`
Provider	Cisco Systems
Category	Email
From Version	6.0.0
Docker Image	`demisto/armorblox:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

Armorblox is an API-based platform that stops targeted email attacks,
protects sensitive data, and automates incident response.
This integration was integrated and tested with version 4.3.0 of Armorblox

Configure Armorblox on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Armorblox.
Click Add instance to create and configure a new integration instance.
Select Fetches incidents to pull incidents from Armorblox to Cortex
Select Classifier as Armorblox-Classifier

Select Mapper as Armorblox-Mapper

Parameter	Required
Armorblox tenant name	True
Incident type	False
API key	True
Fetch limit	False
First fetch timestamp (last <number> <time unit>, e.g., last7Days)	False
Incidents Fetch Interval	False
Trust any certificate (not secure)	False
Use system proxy settings	False
Fetch incidents	False

Click Test to validate the URLs, token, and connection.
Save and Exit to enable the instance.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

armorblox-check-remediation-action

Check the recommended remediation action for any incident

Base Command

armorblox-check-remediation-action

Input

Argument Name	Description	Required
incident_id	The incident id of the incident under inspection.	Required

Context Output

Path	Type	Description
Armorblox.Threat.remediation_actions	string

Command Example


#### Context Example

{
“Armorblox”:
{
“Threat”:
{
“incident_id”: “5375”,
“remediation_actions”: “NEEDS REVIEW”
}
}
}
```

Human Readable Output

incident_id	5375
remediation_actions	NEEDS REVIEW

fetch-incidents

Gets a list of armorblox incidents

Base Command

fetch-incidents

Context Output

There is no context output for this command.

Configuration parameters

tenantName — Armorblox tenant name (required)
incidentType — Incident type
apikey — API key (required)
max_fetch — Fetch limit
first_fetch — First fetch timestamp
incidentFetchInterval — Incidents Fetch Interval
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents

Commands (2)

armorblox-check-remediation-action
Check the recommended remediation action for any incident.
fetch-incidents
Gets a list of armorblox incidents.

Source

Armorblox.py Armorblox_test.py Armorblox.yml Armorblox_description.md command_examples.txt

Download History Raw

category: Email
provider: Cisco Systems
sectionorder:
- Connect
- Collect
commonfields:
  id: Armorblox
  version: -1
configuration:
- display: Armorblox tenant name
  name: tenantName
  required: true
  type: 0
  section: Connect
- defaultvalue: Armorblox
  display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: API key
  name: apikey
  required: true
  type: 4
  section: Connect
- defaultvalue: "50"
  display: Fetch limit
  name: max_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: lastDay
  display: First fetch timestamp
  name: first_fetch
  options:
  - lastDay
  - last3Days
  - last5Days
  - last7Days
  - lastMonth
  - last3Months
  - lastYear
  - last2Years
  - allTime
  type: 15
  section: Collect
  required: false
- defaultvalue: "1"
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
description: |-
  Armorblox is an API-based platform that stops targeted email attacks,
    protects sensitive data, and automates incident response.
display: Armorblox
name: Armorblox
script:
  commands:
  - arguments: []
    description: Gets a list of armorblox incidents.
    name: fetch-incidents
  - arguments:
    - description: The incident id of the incident under inspection.
      name: incident_id
      required: true
    description: Check the recommended remediation action for any incident.
    name: armorblox-check-remediation-action
    outputs:
    - contextPath: Armorblox.Threat.remediation_actions
      description: Should be the remediation action name for the incident under inspection.
      type: string
  dockerimage: demisto/armorblox:1.0.0.10120494
  isfetch: true
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)